Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4521–4540 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 19 Aug 2026, 13:37 WIB

CVE-2026-15446

EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-le…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:37:54.690Z. Updated 2026-08-20T15:26:35.613Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:26 WIB

Official record

HighPublished 19 Aug 2026, 13:37 WIB

CVE-2026-15780

WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 4521 to 4540 of 12259.First page Next page

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:37:54.188Z. Updated 2026-08-19T14:39:39.863Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:39 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:04 WIB

CVE-2026-49426

Incorrect audit records for ptrace(2) syscall requests

When auditing a system call executed via ptrace(PT_SC_REMOTE), the kernel passed the return value of an internal setup function to AUDIT_SYSCALL_EXIT() rather than the actual result of the executed system call. As a result, committed audit records for system calls which returned an error do not reflect the true outcom…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:04:36.581Z. Updated 2026-08-26T17:44:51.652Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:44 WIB

Official record

MedPublished 19 Aug 2026, 13:03 WIB

CVE-2026-8810

HDD Password leakage vulnerability

On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:03:22.218Z. Updated 2026-08-20T15:36:47.245Z.

CVSS6.9v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:36 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19842

SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:21.841Z. Updated 2026-08-19T16:41:23.609Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:41 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19782

WPS Bidouille < 1.33.5 - Subscriber+ User Email Disclosure via wps_get_users

The WPS Bidouille WordPress plugin before 1.33.5 does not have proper authorisation checks in an AJAX action, allowing any authenticated user, such as a subscriber, to retrieve the email addresses of all registered users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:21.656Z. Updated 2026-08-19T16:39:16.783Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:39 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19709

Membership For WooCommerce < 3.1.2 - Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan details on sites where the AP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:21.457Z. Updated 2026-08-19T16:38:02.711Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:38 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19417

KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:21.240Z. Updated 2026-08-19T16:37:03.296Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:37 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19416

KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:21.042Z. Updated 2026-08-19T16:35:34.936Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:35 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19406

Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:20.837Z. Updated 2026-08-19T16:34:36.190Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:34 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19056

ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:20.663Z. Updated 2026-08-19T16:27:26.942Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:27 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-19055

ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:20.487Z. Updated 2026-08-19T16:25:40.127Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:25 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18937

Broken Link Checker < 2.4.12 - Unauthenticated RCE via Query Variable Injection

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:20.316Z. Updated 2026-08-19T16:23:42.509Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:23 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18779

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:20.143Z. Updated 2026-08-19T16:22:28.175Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:22 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18778

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Customer PII Disclosure via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to retrieve the personal information of customers who booked an appointment, including their name, email address, phone number and postal address.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:19.969Z. Updated 2026-08-19T16:21:18.195Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:21 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18777

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:19.779Z. Updated 2026-08-19T16:19:52.793Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:19 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18776

TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX Actions

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:19.610Z. Updated 2026-08-19T16:19:08.096Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:19 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18466

WP Maps < 4.9.8 - Subscriber+ Unlimited Autoloaded Option Creation

The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:19.430Z. Updated 2026-08-19T16:18:01.277Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:18 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18231

WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:18.999Z. Updated 2026-08-19T16:10:32.478Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:10 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-18202

JetEngine < 3.8.14 - Author+ Stored XSS via SVG Upload

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who opens it (Stored Cross…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:18.765Z. Updated 2026-08-19T16:10:47.047Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 23:10 WIB

Official record