Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 3361–3380 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 22 Oct 2026, 20:32 WIB

CVE-2026-92709

Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE

Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment beco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:32:56.695Z. Updated 2026-10-29T02:15:30.165Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:15 WIB

Official record

MedPublished 22 Oct 2026, 20:30 WIB

CVE-2026-115248

subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affects some unknown processing of the file patappointtime.php of the component Booking Handler. The manipulation results in enforcement of behavioral workflow. It is possible to launc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3361 to 3380 of 16156.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:30:10.769Z. Updated 2026-10-29T02:14:19.530Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:14 WIB

Official record

HighPublished 22 Oct 2026, 20:27 WIB

CVE-2026-113582

Apache Abdera: XML external entity expansion in Atom document parsing

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera is retired and no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:27:11.536Z. Updated 2026-10-22T20:08:11.797Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 03:08 WIB

Official record

MedPublished 22 Oct 2026, 20:23 WIB

CVE-2026-115400

crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens

crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:23:38.856Z. Updated 2026-10-29T02:13:18.485Z.

CVSS6.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:13 WIB

Official record

MedPublished 22 Oct 2026, 20:20 WIB

CVE-2026-115411

crawlseo before 0.2.4 Server-Side Request Forgery via Crawler

crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where isPrivateIp() fails to block reserved IP ranges such as RFC 6598 Carrier-Grade NAT, RFC 6890, TEST-NET ranges and certain IPv6 addresses, and additionally fails to pin the validated address for the actual outb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:20:01.875Z. Updated 2026-10-29T11:38:10.900Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:38 WIB

Official record

MedPublished 22 Oct 2026, 20:15 WIB

CVE-2026-115247

subhajitkhan online-clinic-management-system patientregistration.php missing encryption

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:15:19.125Z. Updated 2026-10-23T21:15:01.427Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Oct 2026, 04:15 WIB

Official record

MedPublished 22 Oct 2026, 20:00 WIB

CVE-2026-115246

subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting

A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file patdocmsg.php. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be performed from remote. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T13:00:19.637Z. Updated 2026-10-29T11:27:28.126Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:27 WIB

Official record

CritPublished 22 Oct 2026, 19:36 WIB

CVE-2026-102785

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T12:36:43.196Z. Updated 2026-10-22T15:04:40.346Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated22 Oct 2026, 22:04 WIB

Official record

CritPublished 22 Oct 2026, 18:00 WIB

CVE-2026-112832

WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T11:00:11.107Z. Updated 2026-10-22T13:37:46.390Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated22 Oct 2026, 20:37 WIB

Official record

MedPublished 22 Oct 2026, 18:00 WIB

CVE-2026-112842

WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T11:00:10.742Z. Updated 2026-10-22T13:37:46.527Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Oct 2026, 20:37 WIB

Official record

HighPublished 22 Oct 2026, 18:00 WIB

CVE-2026-112822

WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core allows Blind SQL Injection.This issue affects Workreap Core: from n/a before 3.4.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T11:00:10.699Z. Updated 2026-10-22T13:37:46.663Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated22 Oct 2026, 20:37 WIB

Official record

HighPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115334

Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:50.195Z. Updated 2026-10-22T10:57:50.195Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated22 Oct 2026, 17:57 WIB

Official record

HighPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115333

Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:49.499Z. Updated 2026-10-23T15:03:54.486Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 22:03 WIB

Official record

HighPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115332

Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:48.791Z. Updated 2026-10-29T11:25:42.720Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 18:25 WIB

Official record

HighPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115331

Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:48.115Z. Updated 2026-10-29T02:11:42.284Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:11 WIB

Official record

HighPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115330

Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:47.428Z. Updated 2026-10-22T10:57:47.428Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Oct 2026, 17:57 WIB

Official record

MedPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115329

Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:46.708Z. Updated 2026-10-23T15:04:20.467Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated23 Oct 2026, 22:04 WIB

Official record

HighPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115328

JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete histor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:45.975Z. Updated 2026-10-29T13:39:16.913Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:39 WIB

Official record

MedPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115327

libyang through 6.4.13 Uninitialized Pointer Free in NETCONF RPC Parser

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with a NETCONF session can send an action element containing non-whitespace text via lyd_parse_op() to crash servers like netopeer2 or corrupt the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:45.264Z. Updated 2026-10-29T02:10:37.665Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 09:10 WIB

Official record

MedPublished 22 Oct 2026, 17:57 WIB

CVE-2026-115326

QloApps through 1.7.0 IDOR via OrderDetailController Refund Request

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign id_service_product_order_detail values with their own id_orde…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-22T10:57:44.551Z. Updated 2026-10-22T10:57:44.551Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Oct 2026, 17:57 WIB

Official record