Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 14,934 published records · 32 KEV · 14,934 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

14,934 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2258.2%
High5,37436%
Med4,26529%
Low4232.8%
None20.01%
Legacy00.00%
Unscored3,64524%

Matching records by UTC month

Sep 2614,934

Signal coverage

KEV-listed: 32
With a forecast: 14,934
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.21% · forecast 100% · unscored 24%.

Showing 561–580 of 14,934By severity band: Critical · 9.0–10.0 1,225, High · 7.0–8.9 5,374, Medium · 4.0–6.9 4,265, Low · 0.1–3.9 423, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 3,645

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-90953

Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:23.862Z. Updated 2026-09-30T13:37:22.288Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-89193

Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 561 to 580 of 14934.First page Next page

Published 2026-09-30T06:00:23.440Z. Updated 2026-09-30T13:37:22.420Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-89190

Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax

The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:23.273Z. Updated 2026-09-30T13:37:22.549Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-88797

Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation

The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:23.061Z. Updated 2026-09-30T13:37:22.902Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-88791

Safe Redirect Manager < 2.3.0 - Open Redirect via Wildcard Redirect Rules

The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:22.862Z. Updated 2026-09-30T13:37:23.047Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-87777

Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:22.644Z. Updated 2026-09-30T13:37:23.186Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-86789

Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:22.472Z. Updated 2026-09-30T13:37:23.332Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-85576

All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:22.290Z. Updated 2026-09-30T13:37:23.466Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-85573

All in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files or verify the authenticity of its public upload requests, allowing unauthenticated users to store files containing active content which run in the site's origin when a victim opens…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:22.120Z. Updated 2026-09-30T13:37:23.599Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-85415

Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link (such as an administrator or e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:21.948Z. Updated 2026-09-30T13:37:23.730Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-85001

EmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute

The EmbedPress WordPress plugin before 4.6.7 does not sanitise and escape one of its Elementor widget settings before outputting it into an HTML attribute, which could allow users with the Contributor role or above to inject arbitrary web scripts that execute when the affected content is viewed.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:21.776Z. Updated 2026-09-30T13:37:23.863Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-83560

New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:21.365Z. Updated 2026-09-30T13:37:23.991Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-82127

Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:21.186Z. Updated 2026-09-30T13:37:24.125Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-80333

Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes

The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:21.014Z. Updated 2026-09-30T13:37:24.263Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-75873

Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload

The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:20.590Z. Updated 2026-09-30T13:27:28.428Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:27 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-75824

WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled

The User Frontend WordPress plugin before 4.3.12 does not check whether the site allows user registration before creating an account, allowing unauthenticated users to create accounts on sites where registration is disabled. The created account receives the site's default role.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:20.417Z. Updated 2026-09-30T13:37:24.396Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-75823

WP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:20.238Z. Updated 2026-09-30T13:37:24.527Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-100143

FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email

The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address together with the customer'…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:19.808Z. Updated 2026-09-30T13:37:24.649Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

MedPublished 30 Sep 2026, 11:15 WIB

CVE-2026-102913

SourceCodester Car Driving School Management System Master.php save_enrollment sql injection

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T04:15:08.214Z. Updated 2026-10-02T12:56:12.552Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 19:56 WIB

Official record

HighPublished 30 Sep 2026, 11:13 WIB

CVE-2026-103111

CVE-2026-103111

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T04:13:59.115Z. Updated 2026-10-03T23:51:52.352Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated04 Oct 2026, 06:51 WIB

Official record