Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4561–4580 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-12983

Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection

The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. The same handler also performs a database table truncation without any authorization check, allowing any unauthenticated visitor to wipe the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T06:00:14.031Z. Updated 2026-08-19T12:53:29.021Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:53 WIB

Official record

UnscoredPublished 19 Aug 2026, 13:00 WIB

CVE-2026-11565

Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access (as low as Subscriber) to read arbitrary files on the server — including sensitive configura…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4561 to 4580 of 12259.First page Next page

Published 2026-08-19T06:00:13.843Z. Updated 2026-08-19T12:52:52.335Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2026, 19:52 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:57 WIB

CVE-2026-49428

posixshm: system calls can incorrectly free memory of largepage objects

Certain system calls, such open(2) with the O_TRUNC flag set, and fspacectl(2), could incorrectly free memory in largepage objects. These operations are not permitted on largepage objects, but the implementation did not verify this. An unprivileged local user can abuse the bug to access freed kernel memory. This can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:57:04.674Z. Updated 2026-08-20T03:55:45.923Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:56 WIB

CVE-2026-49427

posixshm: largepage shared memory objects not explicitly wired

Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:56:53.494Z. Updated 2026-08-20T18:35:54.694Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:35 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:28 WIB

CVE-2026-49422

Use-after-free in TCP RACK stack option handler

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:28:32.468Z. Updated 2026-08-20T03:55:47.007Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:25 WIB

CVE-2026-49421

unlinkat(2) ignores AT_RESOLVE_BENEATH flag

The kernel function that implements unlinkat(2) and funlinkat(2) validated the AT_RESOLVE_BENEATH flag but failed to pass it through to the underlying path lookup. The flag was silently dropped, so path resolution was not actually restricted. A process that uses AT_RESOLVE_BENEATH with unlinkat(2) or funlinkat(2) to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:25:43.003Z. Updated 2026-08-26T17:44:13.985Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:44 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:20 WIB

CVE-2026-49420

Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:20:00.559Z. Updated 2026-08-20T03:55:48.116Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:15 WIB

CVE-2026-49431

Incorrect user validation in ZFS_IOC_SET_PROP ioctl

The ZFS_IOC_SET_PROP ioctl, used by zfs-set(8), incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv(8) stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on datasets via ZFS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:15:37.371Z. Updated 2026-08-26T17:42:19.637Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:42 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:15 WIB

CVE-2026-49430

Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl

The ZFS_IOC_RECV_NEW ioctl, in the heal receive path, similarly truncated a 64-bit payload size to a 32-bit integer for allocation, then used the original 64-bit size as the length for a byteswap operation. A local user with the "receive" delegated ZFS permission can trigger kernel memory corruption via ZFS_IOC_RECV_N…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:15:29.940Z. Updated 2026-08-26T17:41:36.355Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:41 WIB

Official record

UnscoredPublished 19 Aug 2026, 12:15 WIB

CVE-2026-49429

Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl

The ZFS_IOC_USERSPACE_MANY ioctl, used by zfs-userspace(8), truncated a 64-bit output buffer size to a 32-bit integer for the kernel allocation, but used the original 64-bit size as the buffer limit when writing records. A local user with the "userused" delegated ZFS permission can trigger a kernel heap overflow via t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T05:15:21.198Z. Updated 2026-08-20T03:55:49.215Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2026, 10:55 WIB

Official record

HighPublished 19 Aug 2026, 11:54 WIB

CVE-2026-70408

CVE-2026-70408

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T04:54:02.396Z. Updated 2026-08-19T15:46:04.620Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:46 WIB

Official record

MedPublished 19 Aug 2026, 11:53 WIB

CVE-2026-66358

CVE-2026-66358

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T04:53:33.355Z. Updated 2026-08-20T15:36:47.413Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:36 WIB

Official record

UnscoredPublished 19 Aug 2026, 11:38 WIB

CVE-2026-49415

Local privilege escalation via execve(2) TOCTOU race

During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel's debugging permission check still saw the original credent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T04:38:24.391Z. Updated 2026-08-20T18:35:31.505Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:35 WIB

Official record

UnscoredPublished 19 Aug 2026, 11:32 WIB

CVE-2026-49419

Jail reference count underflow

When the JAIL_AT_DESC flag is specified, kern_jail_set() and kern_jail_get() released the reference to the caller's current prison before looking up the jail descriptor. If the descriptor lookup failed, error-handling paths released the same reference a second time. An unprivileged local user can trigger a prison ref…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T04:32:39.446Z. Updated 2026-08-20T18:35:07.115Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:35 WIB

Official record

HighPublished 19 Aug 2026, 11:27 WIB

CVE-2026-19942

Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and includi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T04:27:08.789Z. Updated 2026-08-20T15:36:47.587Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:36 WIB

Official record

UnscoredPublished 19 Aug 2026, 11:14 WIB

CVE-2026-49418

Use-after-free in device pager page list

When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This corrupts the list, and on object destr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T04:14:17.429Z. Updated 2026-08-20T18:34:37.191Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2026, 01:34 WIB

Official record

MedPublished 19 Aug 2026, 10:30 WIB

CVE-2026-76050

SourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete_menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T03:30:09.391Z. Updated 2026-08-19T13:44:57.775Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:44 WIB

Official record

MedPublished 19 Aug 2026, 10:15 WIB

CVE-2026-76049

SourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=save_menu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T03:15:10.152Z. Updated 2026-08-21T21:49:44.635Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:49 WIB

Official record

MedPublished 19 Aug 2026, 10:00 WIB

CVE-2026-76048

SourceCodester Simple Online Food Ordering System ajax.php login sql injection

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T03:00:11.436Z. Updated 2026-08-21T19:23:14.325Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:23 WIB

Official record

MedPublished 19 Aug 2026, 09:45 WIB

CVE-2026-76014

BusyBox FEATURE_WGET_TIMEOUT wget.c null pointer dereference

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T02:45:08.531Z. Updated 2026-08-25T01:49:44.780Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 08:49 WIB

Official record