Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,645 published records · 7 KEV · 3,645 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,645 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored3,645100%

Matching records by UTC month

Sep 263,645

Signal coverage

KEV-listed: 7
With a forecast: 3,645
Unknown date: 0
Unscored severity: 3,645

Share of cohort: KEV 0.19% · forecast 100% · unscored 100%.

Showing 1–20 of 3,645By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,645

UnscoredPublished 01 Oct 2026, 03:26 WIB

CVE-2026-92172

CVE-2026-92172

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent including a com.oculus.horizon CallerIdentity to an arbitrary application registering for com.oculus.systemactivities.SCREENSHOT via a broadcast receiver. That would allow the application to impersonate the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T20:26:49.629Z. Updated 2026-10-01T16:14:11.016Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 23:14 WIB

Official record

UnscoredPublished 01 Oct 2026, 03:26 WIB

CVE-2026-92173

CVE-2026-92173

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent including a com.oculus.vrshell CallerIdentity to an arbitrary application listening via NotificationListenerService. That would allow the application to impersonate the com.oculus.vrshell package, as w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 3645.Next page

Published 2026-09-30T20:26:33.293Z. Updated 2026-10-01T18:56:04.855Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Oct 2026, 01:56 WIB

Official record

UnscoredPublished 01 Oct 2026, 00:15 WIB

CVE-2026-103500

Heap buffer overflow opening large email

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T17:15:06.357Z. Updated 2026-10-21T17:24:51.272Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2026, 00:24 WIB

Official record

UnscoredPublished 30 Sep 2026, 22:20 WIB

CVE-2026-80490

Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified

Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, first_match and match_details methods use the T_STD_STRING typemap to translate Perl scalars (SVs) into strings via the std::string constructor, using the SvPV macro to stringify the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T15:20:45.601Z. Updated 2026-09-30T17:07:30.931Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:07 WIB

Official record

UnscoredPublished 30 Sep 2026, 21:31 WIB

CVE-2026-102717

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T14:31:22.786Z. Updated 2026-09-30T20:00:26.657Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:00 WIB

Official record

UnscoredPublished 30 Sep 2026, 19:25 WIB

CVE-2026-95616

Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key reference, before t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T12:25:28.399Z. Updated 2026-09-30T13:17:31.672Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:17 WIB

Official record

UnscoredPublished 30 Sep 2026, 19:02 WIB

CVE-2026-92899

Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce

Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated request could re-sen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T12:02:41.497Z. Updated 2026-09-30T12:49:57.226Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 19:49 WIB

Official record

UnscoredPublished 30 Sep 2026, 19:01 WIB

CVE-2026-92121

Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedElements for the rest of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T12:01:55.697Z. Updated 2026-09-30T19:51:55.272Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:51 WIB

Official record

UnscoredPublished 30 Sep 2026, 18:59 WIB

CVE-2026-89238

Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:59:09.820Z. Updated 2026-09-30T19:50:20.299Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:50 WIB

Official record

UnscoredPublished 30 Sep 2026, 18:58 WIB

CVE-2026-88920

Apache WSS4J: SAML Sender-Vouches Authentication Bypass

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:58:00.040Z. Updated 2026-09-30T19:48:53.545Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:48 WIB

Official record

UnscoredPublished 30 Sep 2026, 18:57 WIB

CVE-2026-87830

Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:57:01.017Z. Updated 2026-09-30T19:47:41.782Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:47 WIB

Official record

UnscoredPublished 30 Sep 2026, 18:55 WIB

CVE-2026-85532

Apache WSS4J: Insufficient Validation of Derived-Key Parameters

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T11:55:53.392Z. Updated 2026-09-30T19:46:00.962Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 02:46 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-97316

Broken Link Notifier 1.3.1 - 2.0.0 - Unauthenticated SSRF via Redirect Bypass

The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass its internal-address filter and make the server send requests to internal services.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:26.188Z. Updated 2026-09-30T20:01:03.198Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2026, 03:01 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-96886

Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:26.004Z. Updated 2026-09-30T13:37:21.125Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-94297

Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation

The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible terms in any taxonomy registered on the site.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:25.833Z. Updated 2026-09-30T13:37:21.257Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-94274

YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:25.663Z. Updated 2026-09-30T13:37:21.390Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-93580

InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook

The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipment status and premature…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:25.490Z. Updated 2026-09-30T13:37:21.520Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-92994

Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API

The Verge3D Publishing and E-Commerce WordPress plugin before 4.13.1 does not validate the contents of files uploaded through its file storage feature and serves them back with an attacker-controlled content type, allowing unauthenticated attackers to store a file containing malicious JavaScript that executes in the br…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:25.268Z. Updated 2026-09-30T13:37:21.649Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-92424

Content Egg < 11.9.0 - Contributor+ Stored XSS via Import Queue

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and above to store arbitrary …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:25.073Z. Updated 2026-09-30T13:37:21.780Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record

UnscoredPublished 30 Sep 2026, 13:00 WIB

CVE-2026-91832

WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output unescaped to every visi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-09-30T06:00:24.880Z. Updated 2026-09-30T13:37:21.907Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2026, 20:37 WIB

Official record