Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 501–520 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-76586

BookingPress 1.5.6 - 1.6.2 - Unauthenticated Booking Price Manipulation via PayPal Payment Confirmation

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.6.3 does not verify the amount actually paid against the server-side price staged for a booking when confirming an online payment, allowing unauthenticated users to have a paid appointment approved for a fraction of its price.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:21.763Z. Updated 2026-08-30T00:56:51.964Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-76548

Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 501 to 520 of 12259.First page Next page

Published 2026-08-29T06:00:20.799Z. Updated 2026-08-30T00:56:52.128Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-76547

Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:20.618Z. Updated 2026-08-30T00:56:52.277Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-76546

Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:20.446Z. Updated 2026-08-30T00:56:52.426Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-19430

CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all

The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of folders that were never published on the site.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:20.269Z. Updated 2026-08-30T00:56:52.572Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-18234

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:20.085Z. Updated 2026-08-30T00:56:52.716Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-18233

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:19.902Z. Updated 2026-08-30T00:56:52.868Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-17522

Newsletters < 4.17 - Arbitrary Plugin Option Update via CSRF

The Newsletters WordPress plugin before 4.17 does not perform any nonce or capability check when saving one of its settings screens, and writes every submitted parameter into its own options, allowing attackers to make a logged in administrator overwrite arbitrary Newsletters WordPress plugin before 4.17 settings, incl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:19.726Z. Updated 2026-08-30T00:56:53.030Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-17520

Newsletters < 4.17 - Unauthenticated API Access via Predictable API Key

The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently random source, deriving it from a publicly known value, allowing unauthenticated attackers to compute the key and perform privileged actions such as adding and deleting subscribers and sending emails, when the optional API h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:19.539Z. Updated 2026-08-30T00:56:53.189Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-16947

Total Processing Card Payments for WooCommerce <= 7.3 - Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure

The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to an arbitrary host (disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:19.359Z. Updated 2026-08-30T00:56:53.342Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-16600

SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the respon…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:19.184Z. Updated 2026-08-30T00:56:53.491Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-16259

Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:18.968Z. Updated 2026-08-30T00:56:53.643Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-16061

Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}

The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:18.773Z. Updated 2026-08-30T00:56:53.798Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2026, 07:56 WIB

Official record

UnscoredPublished 29 Aug 2026, 13:00 WIB

CVE-2026-10522

Simple User Registration <= 6.9 - Unauthenticated Privilege Escalation to Administrator

The MemberHero WordPress plugin through 6.9 does not restrict which account fields can be supplied during its frontend registration process, allowing unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolvin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T06:00:18.586Z. Updated 2026-09-03T15:50:36.890Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Sep 2026, 22:50 WIB

Official record

HighPublished 29 Aug 2026, 09:15 WIB

CVE-2026-41012

BOSH vSphere CPI Improper Cert Validation

Traffic interception vulnerability in BOSH Director vCenter CPI allows attackers positioned between BOSH Director and vCenter to impersonate vCenter REST API and capture administrator credentials via HTTP Basic auth, leading to complete virtualization infrastructure takeover. An attacker who can intercept traffic be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-29T02:15:11.400Z. Updated 2026-08-31T18:21:53.125Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:21 WIB

Official record

MedPublished 29 Aug 2026, 05:50 WIB

CVE-2026-55860

MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a secure connection. A h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:50:30.896Z. Updated 2026-08-31T14:05:55.997Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:05 WIB

Official record

MedPublished 29 Aug 2026, 05:48 WIB

CVE-2026-55859

MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output in org.mariadb:r2dbc-mariadb

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb encodes and decodes all character data under the assumption that the connection character set is UTF-8. A server can announce a mid-session change to character_set_client through the OK-pack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:48:41.592Z. Updated 2026-08-31T18:53:25.642Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:53 WIB

Official record

MedPublished 29 Aug 2026, 05:46 WIB

CVE-2026-55858

MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb-java-client

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The server can report a mid-s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:46:40.114Z. Updated 2026-09-01T02:06:07.389Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 09:06 WIB

Official record

MedPublished 29 Aug 2026, 05:44 WIB

CVE-2026-55857

MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysql_clear_password plugin is gated behind a secure transport,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:44:24.351Z. Updated 2026-08-31T18:22:34.595Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:22 WIB

Official record

MedPublished 29 Aug 2026, 05:41 WIB

CVE-2026-55856

MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects with sslMode=verify-full or sslMode=verify-ca, supplies a password, and does not configure serverSslCert or trustStore, Connector/J can accept …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-28T22:41:14.376Z. Updated 2026-08-31T18:37:36.732Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:37 WIB

Official record