Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 4581–4600 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

CritPublished 19 Aug 2026, 09:30 WIB

CVE-2026-76008

Comfast CF-N1-S URI Parameter Parsing mbox-config get_para_from_uri stack-based overflow

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T02:30:09.048Z. Updated 2026-08-19T15:47:03.268Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:47 WIB

Official record

CritPublished 19 Aug 2026, 09:15 WIB

CVE-2026-76004

UTT HiPER 1250GW HTTP aspApBasicConfigUrcp strcpy stack-based overflow

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is possible to initiate t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4581 to 4600 of 12259.First page Next page

Published 2026-08-19T02:15:10.114Z. Updated 2026-08-19T13:41:23.690Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:41 WIB

Official record

CritPublished 19 Aug 2026, 09:00 WIB

CVE-2026-76003

UTT HiPER 1200GW formGroupConfig strcpy stack-based overflow

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T02:00:11.106Z. Updated 2026-08-21T21:49:51.821Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:49 WIB

Official record

MedPublished 19 Aug 2026, 08:45 WIB

CVE-2026-75987

SPLWare esProc SocketData.java ObjectInputStream.readUnshared deserialization

A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStream.readUnshared of the file src/main/java/com/scudata/parallel/SocketData.java. Performing a manipulation results in deserialization. Remote exploitation of the attack is possible.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T01:45:09.722Z. Updated 2026-08-21T19:24:11.632Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:24 WIB

Official record

MedPublished 19 Aug 2026, 08:30 WIB

CVE-2026-75986

code-projects Online Job Portal System Password Recovery ForPass.php sql injection

A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The exploit has been disclosed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T01:30:09.202Z. Updated 2026-08-25T01:48:47.009Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 08:48 WIB

Official record

MedPublished 19 Aug 2026, 08:26 WIB

CVE-2026-15421

Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T01:26:11.381Z. Updated 2026-08-20T15:36:47.771Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:36 WIB

Official record

CritPublished 19 Aug 2026, 08:19 WIB

CVE-2026-11751

CVE-2026-11751

A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T01:19:34.960Z. Updated 2026-08-20T15:36:47.943Z.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2026, 22:36 WIB

Official record

MedPublished 19 Aug 2026, 08:15 WIB

CVE-2026-75985

TRENDnet Router ping.cgi command injection

A flaw has been found in TRENDnet Router 1.1.02b01. The affected element is an unknown function of the file /cgi-bin/ping.cgi. This manipulation of the argument wan_type causes command injection. The attack may be initiated remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T01:15:10.638Z. Updated 2026-08-19T15:49:29.000Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:49 WIB

Official record

MedPublished 19 Aug 2026, 08:00 WIB

CVE-2026-75984

TRENDnet TEW-823DRU admin.cgi command injection

A vulnerability was detected in TRENDnet TEW-823DRU 1.1.02b01. Impacted is an unknown function of the file /cgi-bin/admin.cgi. The manipulation of the argument Hostname results in command injection. The attack can be launched remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T01:00:10.794Z. Updated 2026-08-19T13:43:50.638Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2026, 20:43 WIB

Official record

MedPublished 19 Aug 2026, 07:45 WIB

CVE-2026-75979

xianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine

A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.java of the component SQL Preview Endpoint. The manipulation of the argument sqlText results in improper neutralization of special elements used in a template eng…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T00:45:08.237Z. Updated 2026-08-21T21:49:58.208Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 04:49 WIB

Official record

MedPublished 19 Aug 2026, 07:00 WIB

CVE-2026-75978

xianrendzw EasyReport QueryerFactory DataSourceController.java DataSourceController.add permission

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issues. The attack can be la…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T00:00:13.664Z. Updated 2026-08-21T19:24:51.463Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2026, 02:24 WIB

Official record

UnscoredPublished 19 Aug 2026, 07:00 WIB

CVE-2026-50719

CVE-2026-50719

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T00:00:00.000Z. Updated 2026-08-24T20:01:19.565Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 03:01 WIB

Official record

UnscoredPublished 19 Aug 2026, 07:00 WIB

CVE-2026-50720

CVE-2026-50720

The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modified SPL (Secondary Progra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T00:00:00.000Z. Updated 2026-08-24T19:59:08.374Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:59 WIB

Official record

UnscoredPublished 19 Aug 2026, 07:00 WIB

CVE-2026-51366

CVE-2026-51366

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T00:00:00.000Z. Updated 2026-08-24T19:57:07.437Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:57 WIB

Official record

UnscoredPublished 19 Aug 2026, 07:00 WIB

CVE-2026-51367

CVE-2026-51367

An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_chat parameter

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T00:00:00.000Z. Updated 2026-08-24T19:56:19.289Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:56 WIB

Official record

UnscoredPublished 19 Aug 2026, 07:00 WIB

CVE-2026-71694

CVE-2026-71694

An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz BOOM benchmark Benchma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-19T00:00:00.000Z. Updated 2026-08-24T19:55:23.543Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 02:55 WIB

Official record

CritPublished 19 Aug 2026, 06:30 WIB

CVE-2026-75976

TRENDnet TEW-823DRU NVRAM wan.cgi strcpy stack-based overflow

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T23:30:11.303Z. Updated 2026-08-25T01:47:43.353Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 08:47 WIB

Official record

MedPublished 19 Aug 2026, 06:25 WIB

CVE-2025-11729

PPWP: Password Protect Pages, Posts & Full or Partial Content <= 1.9.15 - Improper Authorization To Authenticated (Contributor+) Master Password Exposure

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the can_access function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Contributor-level acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T23:25:59.669Z. Updated 2026-08-19T15:50:02.251Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 22:50 WIB

Official record

MedPublished 19 Aug 2026, 05:19 WIB

CVE-2026-27365

WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T22:19:15.926Z. Updated 2026-08-19T19:28:14.918Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated20 Aug 2026, 02:28 WIB

Official record

MedPublished 19 Aug 2026, 05:17 WIB

CVE-2026-66589

WordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T22:17:42.065Z. Updated 2026-08-21T16:19:15.553Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated21 Aug 2026, 23:19 WIB

Official record