Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 5681–5700 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 18 Aug 2026, 23:00 WIB

CVE-2026-49227

Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T16:00:49.281Z. Updated 2026-08-18T17:46:14.304Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:46 WIB

Official record

HighPublished 18 Aug 2026, 22:57 WIB

CVE-2026-49221

Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 5681 to 5700 of 12259.First page Next page

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:57:45.748Z. Updated 2026-08-18T19:00:38.834Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 02:00 WIB

Official record

CritPublished 18 Aug 2026, 22:55 WIB

CVE-2026-45118

MyBB: Contact page reflected XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:55:27.280Z. Updated 2026-08-18T17:52:25.117Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:52 WIB

Official record

CritPublished 18 Aug 2026, 22:53 WIB

CVE-2026-45117

MyBB: Installer database configuration RCE

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:53:29.914Z. Updated 2026-08-18T18:58:22.820Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:58 WIB

Official record

MedPublished 18 Aug 2026, 22:53 WIB

CVE-2026-45129

MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:53:03.385Z. Updated 2026-08-18T18:57:46.576Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:57 WIB

Official record

MedPublished 18 Aug 2026, 22:52 WIB

CVE-2026-45124

MyBB: Mod CP report resolution missing authorization

MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:52:31.738Z. Updated 2026-08-19T14:45:32.486Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:45 WIB

Official record

MedPublished 18 Aug 2026, 22:52 WIB

CVE-2026-45120

MyBB: Insufficient authorization for private calendar events

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event acti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:52:03.093Z. Updated 2026-08-18T17:46:20.052Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:46 WIB

Official record

MedPublished 18 Aug 2026, 22:51 WIB

CVE-2026-47245

MyBB: Buddy list corruption

MyBB is free and open source forum software. Prior to 1.8.40, the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. The usercp.php?action=do_editlists delete handler removes the selected entry from the acting user's list and then updates mybb_users.buddylist for the target a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:51:33.857Z. Updated 2026-08-18T17:37:22.369Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:37 WIB

Official record

HighPublished 18 Aug 2026, 22:51 WIB

CVE-2026-71365

Awx: webhook status callback ssrf leaks the git pat

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:51:10.748Z. Updated 2026-08-25T08:47:09.117Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 15:47 WIB

Official record

MedPublished 18 Aug 2026, 22:51 WIB

CVE-2026-45734

MyBB: Default CAPTCHA missing invalidation

MyBB is free and open source forum software. Prior to 1.8.40, the built-in CAPTCHA does not consistently enforce single-use semantics, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:51:07.257Z. Updated 2026-08-19T14:43:38.996Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:43 WIB

Official record

MedPublished 18 Aug 2026, 22:50 WIB

CVE-2026-15806

`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:50:57.983Z. Updated 2026-10-02T00:39:20.429Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 07:39 WIB

Official record

CritPublished 18 Aug 2026, 22:50 WIB

CVE-2026-12564

Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:50:54.646Z. Updated 2026-09-24T05:59:57.362Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated24 Sep 2026, 12:59 WIB

Official record

MedPublished 18 Aug 2026, 22:50 WIB

CVE-2026-45125

MyBB: Email User CRLF injection

MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:50:38.936Z. Updated 2026-08-18T17:46:25.763Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:46 WIB

Official record

MedPublished 18 Aug 2026, 22:50 WIB

CVE-2026-45122

MyBB: Insufficient permission check for calendar event move

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:50:02.080Z. Updated 2026-08-18T17:54:36.990Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:54 WIB

Official record

MedPublished 18 Aug 2026, 22:49 WIB

CVE-2026-45119

MyBB: ACP UTF-8 Conversion CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:49:14.763Z. Updated 2026-08-19T14:41:09.985Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 21:41 WIB

Official record

CritPublished 18 Aug 2026, 22:47 WIB

CVE-2026-75926

Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in config/security/securityConfig.go, which makes no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:47:49.048Z. Updated 2026-09-24T14:19:33.478Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2026, 21:19 WIB

Official record

LowPublished 18 Aug 2026, 22:47 WIB

CVE-2026-45126

MyBB: ACP Questions state CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:47:09.205Z. Updated 2026-08-18T18:02:06.736Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:02 WIB

Official record

HighPublished 18 Aug 2026, 22:46 WIB

CVE-2026-45116

MyBB: Profile field type confusion XSS

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$fiel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:46:34.212Z. Updated 2026-08-18T17:55:31.261Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:55 WIB

Official record

HighPublished 18 Aug 2026, 22:46 WIB

CVE-2026-45115

MyBB: Buddy/ignore list username XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames throu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:46:00.862Z. Updated 2026-08-18T17:55:22.351Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 00:55 WIB

Official record

MedPublished 18 Aug 2026, 22:45 WIB

CVE-2026-45121

MyBB: Insufficient permission check for calendar select

MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks ag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T15:45:29.958Z. Updated 2026-08-18T18:50:21.265Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2026, 01:50 WIB

Official record