Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 1,988 published records · 4 KEV · 1,988 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

1,988 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med1,988100%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Feb 261,988

Signal coverage

KEV-listed: 4
With a forecast: 1,988
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.20% · forecast 100% · unscored 0.00%.

Showing 1–20 of 1,988By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 1,988, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

MedPublished 01 Mar 2026, 04:47 WIB

CVE-2026-28561

wpForo Forum 2.4.14 Stored XSS via Unescaped Forum Description in Templates

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows administrators to inject persistent JavaScript via forum description fields echoed without output escaping across multiple theme template files. On multisite installations or with a compromised admin account, attackers set a forum desc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-28T21:47:40.861Z. Updated 2026-05-11T23:11:41.206Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 01 Mar 2026, 04:47 WIB

CVE-2026-28560

wpForo Forum 2.4.14 Stored XSS via Unsafe JSON Encoding in Inline Script

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows script injection via forum URL data output into an inline script block using json_encode without the JSON_HEX_TAG flag. Attackers set a forum slug containing a closing script tag or unescaped single quote to break out of the JavaScript…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 1988.Next page

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-28T21:47:40.000Z. Updated 2026-05-11T23:11:40.505Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 01 Mar 2026, 04:47 WIB

CVE-2026-28559

wpForo Forum 2.4.14 Information Disclosure via Global RSS Feed

wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-28T21:47:39.149Z. Updated 2026-05-11T23:11:39.755Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 01 Mar 2026, 04:47 WIB

CVE-2026-28558

wpForo Forum 2.4.14 Stored XSS via SVG Avatar File Upload

wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-28T21:47:38.290Z. Updated 2026-05-11T23:11:38.958Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 01 Mar 2026, 04:47 WIB

CVE-2026-28556

wpForo Forum 2.4.14 Missing Authorization via Topic Management Form Handlers

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic_move, topic_merge, and topic_split form action handlers. Attackers with a valid form nonce can reorganize arbitrary forum content without moderator permissions,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-28T21:47:36.466Z. Updated 2026-05-11T23:11:36.493Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 01 Mar 2026, 04:47 WIB

CVE-2026-28555

wpForo Forum 2.4.14 Missing Authorization via Topic Close AJAX Handler

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-28T21:47:35.544Z. Updated 2026-05-11T23:11:35.765Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 01 Mar 2026, 04:47 WIB

CVE-2026-28554

wpForo Forum 2.4.14 Missing Authorization via Post Approval AJAX Handler

wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-28T21:47:34.336Z. Updated 2026-05-11T23:11:35.058Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 28 Feb 2026, 05:17 WIB

CVE-2026-27759

Featured Image from Content < 1.7 Authenticated SSRF via save_post

Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery vulnerability that allows Author-level users to fetch internal HTTP resources. Attackers can exploit insecure URL fetching and file write operations to retrieve sensitive…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:17:11.669Z. Updated 2026-05-11T23:11:29.923Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 May 2026, 06:11 WIB

Official record

MedPublished 28 Feb 2026, 05:14 WIB

CVE-2026-28424

Statamic's missing authorization allows access to email addresses

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses from the user fieldtype’s data endpoint for control panel users who did not have the "view users" permission. This has been fixed in 5.73.11 and 6.4.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:14:01.779Z. Updated 2026-03-02T19:36:06.660Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 02:36 WIB

Official record

MedPublished 28 Feb 2026, 05:11 WIB

CVE-2026-28423

Statamic Vulnerable to Server-Side Request Forgery via Glide

Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, when Glide image manipulation is used in insecure mode (which is not the default), the image proxy can be abused by an unauthenticated user to make the server send HTTP requests to arbitrary URLs—either via the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:11:55.802Z. Updated 2026-03-02T21:48:43.597Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:48 WIB

Official record

MedPublished 28 Feb 2026, 05:06 WIB

CVE-2026-28421

Vim has a heap-buffer-overflow and a segmentation fault

Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:06:34.312Z. Updated 2026-05-28T13:27:22.600Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:27 WIB

Official record

MedPublished 28 Feb 2026, 05:04 WIB

CVE-2026-28420

Vim has Heap-based Buffer Overflow and OOB Read in :terminal

Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes. Version 9.2.0076 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:04:36.189Z. Updated 2026-03-02T21:55:05.724Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:55 WIB

Official record

MedPublished 28 Feb 2026, 05:02 WIB

CVE-2026-28419

Vim has Heap-based Buffer Underflow in Emacs tags parsing

Vim is an open source, command line text editor. Prior to version 9.2.0075, a heap-based buffer underflow exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file where a delimiter appears at the start of a line, Vim attempts to read memory immediately preceding the allocated buffer. V…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T22:02:55.952Z. Updated 2026-03-02T21:54:29.733Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:54 WIB

Official record

MedPublished 28 Feb 2026, 04:58 WIB

CVE-2026-28418

Vim has Heap-based Buffer Overflow in Emacs tags parsing

Vim is an open source, command line text editor. Prior to version 9.2.0074, a heap-based buffer overflow out-of-bounds read exists in Vim's Emacs-style tags file parsing logic. When processing a malformed tags file, Vim can be tricked into reading up to 7 bytes beyond the allocated memory boundary. Version 9.2.0074 fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:58:37.277Z. Updated 2026-03-02T21:52:42.959Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:52 WIB

Official record

MedPublished 28 Feb 2026, 04:54 WIB

CVE-2026-28417

Vim has OS Command Injection in netrw

Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the `netrw` standard plugin bundled with Vim. By inducing a user to open a crafted URL (e.g., using the `scp://` protocol handler), an attacker can execute arbitrary shell commands with the privil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:54:35.196Z. Updated 2026-05-28T13:27:36.137Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated28 May 2026, 20:27 WIB

Official record

MedPublished 28 Feb 2026, 04:44 WIB

CVE-2026-28415

Gradio has Open Redirect in OAuth Flow

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio's OAuth flow accepts an unvalidated _target_url query parameter, allowing redirection to arbitrary external URLs. This affects the /logout and /login/callback endpoints on Gradio …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:44:51.956Z. Updated 2026-03-02T21:55:38.664Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated03 Mar 2026, 04:55 WIB

Official record

MedPublished 28 Feb 2026, 04:28 WIB

CVE-2026-28407

malcontent's nested archive extraction failure can drop content from scan inputs

malcontent is software for discovering supply-chain compromises through context, differential analysis, and YARA. Prior to version 1.21.0, malcontent would remove nested archives which failed to extract which could potentially leave malicious content. A better approach is to preserve these archives so that malcontent c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:28:06.258Z. Updated 2026-03-02T22:01:48.514Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Mar 2026, 05:01 WIB

Official record

MedPublished 28 Feb 2026, 04:01 WIB

CVE-2026-28352

Indico missing access check in event series management API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11, the API endpoint used to manage event series is missing an access check, allowing unauthenticated/unauthorized access to this endpoint. The impact of this is limited to getting t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T21:01:45.740Z. Updated 2026-03-03T20:29:18.718Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:29 WIB

Official record

MedPublished 28 Feb 2026, 03:59 WIB

CVE-2026-28351

Manipulated RunLengthDecode streams can exhaust RAM

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream using the RunLengthDecode filter. This has been fixed in pypdf 6.7.4. As a workaround, consider applying th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:59:16.839Z. Updated 2026-03-03T20:28:45.592Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:28 WIB

Official record

MedPublished 28 Feb 2026, 03:28 WIB

CVE-2026-28338

PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains executable JavaScr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-02-27T20:28:05.739Z. Updated 2026-03-03T20:26:01.369Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated04 Mar 2026, 03:26 WIB

Official record