Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2026-85200 | geomywp geo_my_wordpress Improper Control of Filename for Include/Require Statement in PHP Program | HIGH | 7.5 | 3.23% | cvelistv5 | 2026-11-04 |
| cve-2026-75807 | Improper Authentication | HIGH | 7.5 | 0.41% | cvelistv5 | 2026-11-04 |
| cve-2026-4162 | Missing Authorization | HIGH | N/A | 0.25% | cvelistv5 | 2026-11-04 |
| cve-2026-24849 | open-emr openemr Improper Limitation of a Pathname to a Restricted Directory | HIGH | N/A | 2.17% | cvelistv5 | 2026-11-04 |
| cve-2026-120422 | Reliance on HTTP instead of HTTPS | HIGH | N/A | N/A | cvelistv5 | 2026-11-04 |
| cve-2026-115732 | Incorrect Comparison | HIGH | N/A | N/A | cvelistv5 | 2026-11-04 |
| cve-2026-11556 | Tenda f451_firmware Improper Neutralization of Special Elements used in a Command | CRITICAL | 9.0 | 1.61% | cvelistv5 | 2026-11-04 |
| cve-2026-109447 | Cozmoslabs profile_builder Improper Privilege Management | HIGH | 8.1 | 0.34% | cvelistv5 | 2026-11-04 |
| cve-2026-102435 | Themefic ultimate_addons_for_contact_form_7 Deserialization of Untrusted Data | CRITICAL | 9.8 | N/A | cvelistv5 | 2026-11-04 |
| cve-2025-49387 | Unrestricted Upload of File with Dangerous Type | CRITICAL | 10.0 | 0.38% | cvelistv5 | 2026-11-04 |
| cve-2024-27834 | EUVD-2024-25027 | MEDIUM | 5.5 | 0.60% | cvelistv5 | Nov 5, 2026, 4:56:43 AM |
| cve-2026-55500 | 9Router is an AI router & token saver | CRITICAL | 9.9 | 0.48% | cvelistv5 | 2026-10-25 |
| cve-2026-4035 | CVE-2026-4035 | HIGH | N/A | 0.52% | cvelistv5 | |
| cve-2026-120534 | Unrestricted Upload of File with Dangerous Type | CRITICAL | 9.8 | N/A | cvelistv5 | 2026-11-03 |
| cve-2026-120203 | showdoc showdoc Improper Control of Generation of Code | HIGH | 8.8 | 0.35% | cvelistv5 | 2026-11-03 |
| cve-2026-112313 | CVE-2026-112313 | HIGH | N/A | 0.19% | cvelistv5 | |
| cve-2026-107441 | cve-2026-107441 | HIGH | 8.8 | N/A | cvelistv5 | unknown |
| cve-2025-41452 | External Control of System or Configuration Setting | MEDIUM | 6.8 | 0.92% | cvelistv5 | 2026-11-03 |
| cve-2025-41451 | Improper Neutralization of Special Elements used in a Command | HIGH | 8.7 | 4.46% | cvelistv5 | 2026-11-03 |
| cve-2024-58351 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig o... | CRITICAL | 9.3 | 0.93% | cvelistv5 | 2026-10-27 |
| cve-2017-7615 | mantis: Arbitrary password reset | CRITICAL | 9.8 | 91.20% | cvelistv5 | 2025-11-21 |
| cve-2015-7857 | Joomla! Joomla! Improper Neutralization of Special Elements used in an SQL Command | HIGH | N/A | 94.47% | cvelistv5 | 2026-11-03 |
| cve-2026-86596 | CLavaque s2Member Improper Control of Generation of Code | HIGH | N/A | N/A | cvelistv5 | 2026-11-02 |
| cve-2026-82244 | budibase budibase Improper Control of Generation of Code | CRITICAL | 9.4 | 0.89% | cvelistv5 | 2026-11-02 |
| cve-2026-81799 | CVE-2026-81799 | HIGH | 7.5 | 0.35% | cvelistv5 | |
| cve-2026-81648 | CVE-2026-81648 | CRITICAL | 10.0 | 0.50% | cvelistv5 | |
| cve-2026-47670 | dbgate dbgate Improper Neutralization of Special Elements used in a Command | HIGH | N/A | 1.76% | cvelistv5 | 2026-11-02 |
| cve-2026-28160 | CVE-2026-28160 | HIGH | N/A | 0.23% | cvelistv5 | |
| cve-2026-19842 | Improper Authentication | HIGH | 8.8 | 0.26% | cvelistv5 | 2026-11-02 |
| cve-2026-116548 | e4jconnect vikrentcar Improper Neutralization of Input During Web Page Generation | HIGH | N/A | N/A | cvelistv5 | 2026-11-02 |