Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 1,455 published records · 10 KEV · 1,455 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

1,455 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,455100%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Aug 261,455

Signal coverage

KEV-listed: 10
With a forecast: 1,455
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.69% · forecast 100% · unscored 0.00%.

Showing 1–20 of 1,455By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

CritPublished 01 Sep 2026, 05:45 WIB

CVE-2026-83524

RedPort Optimizer wXa-223 System Clock datetime.php exec command injection

A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be initiated remotely. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T22:45:37.776Z. Updated 2026-09-01T16:03:40.615Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 23:03 WIB

Official record

CritPublished 01 Sep 2026, 05:15 WIB

CVE-2026-82971

QVidium Opera11 CGI Script net_tr.cgi command injection

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 1455.Next page

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T22:15:39.929Z. Updated 2026-09-01T18:10:36.300Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:10 WIB

Official record

CritPublished 01 Sep 2026, 04:45 WIB

CVE-2026-82954

Dokploy Settings application.ts writeTraefikConfigInPath path traversal

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T21:45:06.958Z. Updated 2026-09-02T17:40:29.774Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:40 WIB

Official record

CritPublished 01 Sep 2026, 03:42 WIB

CVE-2026-81779

WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:42:27.262Z. Updated 2026-09-01T13:48:21.018Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:48 WIB

Official record

CritPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82226

WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:54.958Z. Updated 2026-09-01T13:51:19.582Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:51 WIB

Official record

CritPublished 01 Sep 2026, 03:30 WIB

CVE-2026-81780

WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:52.324Z. Updated 2026-09-01T18:11:04.583Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:11 WIB

Official record

CritPublished 01 Sep 2026, 03:30 WIB

CVE-2026-81763

WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability

Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:49.036Z. Updated 2026-09-01T18:12:24.672Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:12 WIB

Official record

CritPublished 01 Sep 2026, 03:30 WIB

CVE-2026-81756

WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability

Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:47.073Z. Updated 2026-09-02T14:19:08.224Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 21:19 WIB

Official record

CritPublished 01 Sep 2026, 03:30 WIB

CVE-2026-81293

WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:44.373Z. Updated 2026-09-01T14:58:50.742Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

CritPublished 01 Sep 2026, 03:15 WIB

CVE-2026-82908

MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local appro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:15:09.231Z. Updated 2026-09-01T13:57:31.239Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:57 WIB

Official record

CritPublished 01 Sep 2026, 01:46 WIB

CVE-2026-53552

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the call…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T18:46:41.957Z. Updated 2026-09-01T14:59:24.165Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:59 WIB

Official record

CritPublished 01 Sep 2026, 00:55 WIB

CVE-2026-79748

MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations and then immediately spa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T17:55:08.740Z. Updated 2026-08-31T18:40:47.698Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:40 WIB

Official record

CritPublished 31 Aug 2026, 23:00 WIB

CVE-2026-82807

ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management

A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the library URDSCSI.sys of the component Kernel Driver. This manipulation causes improper privilege management. The attack needs to be launched locally. The exploit has been publicly disclosed and may be ut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T16:00:08.780Z. Updated 2026-09-01T18:10:50.983Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:10 WIB

Official record

CritPublished 31 Aug 2026, 22:30 WIB

CVE-2026-76133

Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm

The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:30:38.351Z. Updated 2026-10-05T19:26:19.802Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Oct 2026, 02:26 WIB

Official record

CritPublished 31 Aug 2026, 22:28 WIB

CVE-2026-73819

Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:28:32.047Z. Updated 2026-10-05T19:26:52.632Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Oct 2026, 02:26 WIB

Official record

CritPublished 31 Aug 2026, 21:46 WIB

CVE-2026-66047

ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:46:41.174Z. Updated 2026-10-01T15:20:16.267Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:20 WIB

Official record

CritPublished 31 Aug 2026, 21:43 WIB

CVE-2026-82970

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:43:38.358Z. Updated 2026-08-31T18:51:27.733Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:51 WIB

Official record

CritPublished 31 Aug 2026, 21:43 WIB

CVE-2026-59111

Command Injection vulnerability in eObčanka-Identifikace

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:43:02.777Z. Updated 2026-08-31T15:53:35.691Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:53 WIB

Official record

CritPublished 31 Aug 2026, 19:45 WIB

CVE-2026-82695

Tenda AC18 Telnet telnet missing authentication

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T12:45:09.596Z. Updated 2026-08-31T14:29:57.559Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:29 WIB

Official record

CritPublished 31 Aug 2026, 19:30 WIB

CVE-2026-82694

Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication

A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T12:30:10.652Z. Updated 2026-08-31T17:44:30.348Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:44 WIB

Official record