Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 661–680 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 28 Oct 2026, 22:32 WIB

CVE-2026-112357

GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can replace the searchd.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T15:32:47.972Z. Updated 2026-10-28T18:53:58.772Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:53 WIB

Official record

MedPublished 28 Oct 2026, 22:31 WIB

CVE-2026-50539

Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing object-level authorization on `/notification/export/{id}` allows an authenticated user to download attachments from any notification, including notifications created by admin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 661 to 680 of 16156.First page Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T15:31:12.074Z. Updated 2026-10-28T16:06:48.627Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:06 WIB

Official record

MedPublished 28 Oct 2026, 22:26 WIB

CVE-2026-112356

GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T15:26:52.847Z. Updated 2026-10-28T18:03:52.733Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 01:03 WIB

Official record

MedPublished 28 Oct 2026, 22:19 WIB

CVE-2026-67187

Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T15:19:16.649Z. Updated 2026-10-28T15:19:16.649Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 22:19 WIB

Official record

MedPublished 28 Oct 2026, 22:00 WIB

CVE-2026-115402

CVE-2026-115402

OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T15:00:23.951Z. Updated 2026-10-28T15:00:23.951Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 22:00 WIB

Official record

HighPublished 28 Oct 2026, 21:59 WIB

CVE-2026-93520

X.Org Server XKB ChangeKeycodeRange Heap Out-of-Bounds Write

A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X server before 2.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:59:50.140Z. Updated 2026-10-28T14:59:50.140Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 21:59 WIB

Official record

HighPublished 28 Oct 2026, 21:41 WIB

CVE-2026-93519

X.Org Server XFixes Pointer Barrier Event List Buffer Overflow

A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:41:33.873Z. Updated 2026-10-28T14:41:33.873Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 21:41 WIB

Official record

HighPublished 28 Oct 2026, 21:32 WIB

CVE-2026-93518

X.Org Server XKB ResizeKeyType Numeric Truncation

An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients in X.org X server before 21.1.25 and XWayland before 24.1.14 could be exploited for crashes or potential code execution in the X server.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:32:01.702Z. Updated 2026-10-28T14:32:01.702Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 21:32 WIB

Official record

HighPublished 28 Oct 2026, 21:02 WIB

CVE-2026-115603

WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH Advanced Ads – Tracking advanced-ads-tracking allows Blind SQL Injection.This issue affects Advanced Ads – Tracking: from n/a before 4.0.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:02:57.872Z. Updated 2026-10-29T13:47:37.343Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:47 WIB

Official record

CritPublished 28 Oct 2026, 21:02 WIB

CVE-2026-115968

WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:02:57.496Z. Updated 2026-10-28T16:07:03.811Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:07 WIB

Official record

HighPublished 28 Oct 2026, 21:02 WIB

CVE-2026-116390

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:02:57.098Z. Updated 2026-10-29T13:47:37.495Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:47 WIB

Official record

HighPublished 28 Oct 2026, 21:02 WIB

CVE-2026-116389

WordPress Phoenix Media Rename plugin <= 3.13.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue affects Phoenix Media Rename: from n/a through 3.13.5.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:02:56.685Z. Updated 2026-10-29T13:47:37.643Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:47 WIB

Official record

HighPublished 28 Oct 2026, 21:02 WIB

CVE-2026-115590

WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects Dokan: from n/a through 5.3.1.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T14:02:56.306Z. Updated 2026-10-29T13:47:37.789Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 20:47 WIB

Official record

HighPublished 28 Oct 2026, 20:26 WIB

CVE-2026-116078

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib/bandit/http2/stream.ex keeps every DATA frame payload as it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T13:26:25.372Z. Updated 2026-10-28T13:26:25.372Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 20:26 WIB

Official record

MedPublished 28 Oct 2026, 20:25 WIB

CVE-2026-50541

Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `GET /dataset/export/csv/{id}` allow an authenticated user to export data from any dataset, including datasets created by administrators, by iteratin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T13:25:10.271Z. Updated 2026-10-28T13:25:10.271Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 20:25 WIB

Official record

HighPublished 28 Oct 2026, 20:23 WIB

CVE-2026-52729

Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing access-control checks on `PUT/DELETE /action/{id}` allow an authenticated user to modify or delete actions on any Layout. Exploitation requires the privilege to allow edits, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T13:23:13.291Z. Updated 2026-10-28T13:23:13.291Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 20:23 WIB

Official record

CritPublished 28 Oct 2026, 20:19 WIB

CVE-2026-105420

Path Traversal in Wing WFTP Server leading to Remote Code Execution

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with process owner privileges.Critically, sinc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T13:19:31.908Z. Updated 2026-10-28T13:19:31.908Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 20:19 WIB

Official record

MedPublished 28 Oct 2026, 20:17 WIB

CVE-2026-59959

SAIL: WebP decoder division by zero through malformed animated canvas metadata

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T13:17:29.214Z. Updated 2026-10-28T13:17:29.214Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 20:17 WIB

Official record

HighPublished 28 Oct 2026, 20:16 WIB

CVE-2026-93517

X.Org Server GLX RenderLarge Heap Buffer Overflow

A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T13:16:39.431Z. Updated 2026-10-28T13:16:39.431Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 20:16 WIB

Official record

HighPublished 28 Oct 2026, 20:15 WIB

CVE-2026-59185

identrail: Cross-tenant GitHub installation binding without ownership verification

identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` heade…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T13:15:53.456Z. Updated 2026-10-28T16:07:10.634Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:07 WIB

Official record