Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 1,978 published records · 2 KEV · 1,978 with a forecast · 0 unknown dates
1,978 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.10% · forecast 100% · unscored 100%.
VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T15:19:42.435Z. Updated 2026-08-03T17:18:24.554Z.
VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities
Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T15:18:33.052Z. Updated 2026-08-03T17:13:26.182Z.
Path traversal in NotebookRepo note and folder path composition
Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into filesystem paths using th…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T11:05:07.878Z. Updated 2026-07-31T16:20:12.350Z.
Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue a…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T10:12:18.035Z. Updated 2026-08-13T16:18:20.395Z.
Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases
The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. Users are recommended to …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T09:58:15.033Z. Updated 2026-07-31T16:29:28.224Z.
ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute
The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-res…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:12.218Z. Updated 2026-07-31T16:38:27.612Z.
Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization
The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:12.039Z. Updated 2026-07-31T16:41:08.252Z.
Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output with…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:11.859Z. Updated 2026-07-31T16:44:13.155Z.
wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:11.681Z. Updated 2026-07-31T16:47:17.952Z.
miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access t…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:11.504Z. Updated 2026-07-31T17:42:33.859Z.
Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint
The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, n…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:11.328Z. Updated 2026-07-31T17:43:31.961Z.
ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:11.152Z. Updated 2026-07-31T17:45:29.200Z.
ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)
The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbi…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:10.969Z. Updated 2026-07-31T16:49:52.762Z.
Kirki < 6.0.13 - Unauthenticated SQL Injection
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:10.742Z. Updated 2026-07-31T16:52:19.507Z.
Kirki < 6.0.13 - Unauthenticated PHP Object Injection
The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via anoth…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:10.525Z. Updated 2026-07-31T16:53:55.130Z.
Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field
The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role tha…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:10.354Z. Updated 2026-07-31T16:55:03.841Z.
BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR
The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:10.175Z. Updated 2026-07-31T17:46:16.024Z.
WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter
The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:09.998Z. Updated 2026-07-31T17:47:20.807Z.
Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter
The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:09.816Z. Updated 2026-07-31T19:44:02.517Z.
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2026-07-31T06:00:09.640Z. Updated 2026-07-31T19:45:10.724Z.