public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

LIVE SIGNAL MAPDEFENSIVE PRIORITY CIRCUITLATEST STATIC SNAPSHOT

PRIORITY ORDER · NOT AN ATTACK PATH

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

Tracked CVEs2020 new in 7d

Critical1canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)0EPSS percentile observed

Monitored Vendors1from current data

VULNERABILITY TREEMAP

DEFENSIVE PRIORITY SURFACE

Stable CVE grouping for defensive triage. Area changes by display mode; severity remains encoded by color.

LATEST STATIC SNAPSHOT2026-07-30 11:26 UTC / 2026-07-30 20:26 JST

DISPLAY MODEDEFENSIVE PRIORITY

Live Vulnerability Feed READ-ONLY

20 signalsView all signals →

2026-07-30

defensive priority signal

CRITICALEPSS 0.0028 (20)NEW-NVD: Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. Handoff

2026-07-30

defensive priority signal

HIGHEPSS 0.0021 (12)NEW-NVD: Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions. Handoff

2026-07-30

defensive priority signal

HIGHEPSS 0.0021 (12)NEW-NVD: Contributor SQL Injection in eRoom <= 1.7.1 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0027 (19)NEW-NVD: Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0027 (19)NEW-NVD: Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0016 (6)NEW-NVD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Sto… Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0017 (7)NEW-NVD: Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0017 (7)NEW-NVD: Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0027 (20)NEW-NVD: Subscriber Broken Access Control in uListing <= 2.2.0 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0027 (20)NEW-NVD: Subscriber Broken Access Control in eRoom <= 1.7.1 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0028 (20)NEW-NVD: Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0023 (14)NEW-NVD: Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0021 (12)NEW-NVD: Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0021 (12)NEW-NVD: Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0021 (12)NEW-NVD: Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0016 (6)NEW-NVD: Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0024 (16)NEW-NVD: Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0019 (8)NEW-NVD: Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0019 (8)NEW-NVD: Contributor Broken Access Control in uListing <= 2.2.0 versions. Handoff

2026-07-30

defensive priority signal

MEDIUMEPSS 0.0011 (1)NEW-NVD: Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions. Handoff

Public-safe defensive signals

CVE-2026-27064 CRITICAL CVSS 9.1 -
NVD: Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for critical severity review; CVSS 9.1 (CRITICAL); EPSS percentile 20; sources: NVD.
CVE-2026-24552 HIGH CVSS 8.5 -
NVD: Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.
An attacker may be able to read or change database-backed application data; CVSS 8.5 (HIGH); EPSS percentile 12; sources: NVD.
CVE-2026-25405 HIGH CVSS 8.5 -
NVD: Contributor SQL Injection in eRoom <= 1.7.1 versions.
An attacker may be able to read or change database-backed application data; CVSS 8.5 (HIGH); EPSS percentile 12; sources: NVD.
CVE-2026-27377 MEDIUM CVSS 6.7 -
NVD: Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.7 (MEDIUM); EPSS percentile 19; sources: NVD.
CVE-2026-27372 MEDIUM CVSS 6.5 -
NVD: Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.5 (MEDIUM); EPSS percentile 19; sources: NVD.
CVE-2026-27403 MEDIUM CVSS 6.5 -
NVD: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. NVD: This issue affects Hubbub Lite: from n/a through 1.36.3.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 6.5 (MEDIUM); EPSS percentile 6; sources: NVD.
CVE-2026-24628 MEDIUM CVSS 5.9 -
NVD: Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 5.9 (MEDIUM); EPSS percentile 7; sources: NVD.
CVE-2025-68081 MEDIUM CVSS 5.9 -
NVD: Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 5.9 (MEDIUM); EPSS percentile 7; sources: NVD.
CVE-2026-27391 MEDIUM CVSS 5.4 -
NVD: Subscriber Broken Access Control in uListing <= 2.2.0 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.4 (MEDIUM); EPSS percentile 20; sources: NVD.
CVE-2026-25427 MEDIUM CVSS 5.4 -
NVD: Subscriber Broken Access Control in eRoom <= 1.7.1 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.4 (MEDIUM); EPSS percentile 20; sources: NVD.
CVE-2026-27355 MEDIUM CVSS 5.3 -
NVD: Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.3 (MEDIUM); EPSS percentile 20; sources: NVD.
CVE-2026-25466 MEDIUM CVSS 5.3 -
NVD: Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.3 (MEDIUM); EPSS percentile 14; sources: NVD.
CVE-2026-27418 MEDIUM CVSS 5.3 -
NVD: Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.3 (MEDIUM); EPSS percentile 12; sources: NVD.
CVE-2026-27422 MEDIUM CVSS 5.3 -
NVD: Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.3 (MEDIUM); EPSS percentile 12; sources: NVD.
CVE-2026-27399 MEDIUM CVSS 5.3 -
NVD: Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.3 (MEDIUM); EPSS percentile 12; sources: NVD.
CVE-2026-24639 MEDIUM CVSS 4.4 -
NVD: Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 4.4 (MEDIUM); EPSS percentile 6; sources: NVD.
CVE-2026-27423 MEDIUM CVSS 4.3 -
NVD: Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 4.3 (MEDIUM); EPSS percentile 16; sources: NVD.
CVE-2026-25424 MEDIUM CVSS 4.3 -
NVD: Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 4.3 (MEDIUM); EPSS percentile 8; sources: NVD.
CVE-2026-27392 MEDIUM CVSS 4.3 -
NVD: Contributor Broken Access Control in uListing <= 2.2.0 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 4.3 (MEDIUM); EPSS percentile 8; sources: NVD.
CVE-2026-24537 MEDIUM CVSS 4.3 -
NVD: Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 4.3 (MEDIUM); EPSS percentile 1; sources: NVD.

Critical High Medium Low KEVKnown Exploited NEWNewly ObservedJ / K Move · ↑ / ↓ Move · Enter Open · Esc Close

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-07-30 11:26 UTC / 2026-07-30 20:26 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

40 public-safe changes since the previous successful snapshot.

Added20

Changed0

Removed20

What changed

CVE-2025-68081: newly added to the public-safe set.
CVE-2026-24537: newly added to the public-safe set.
CVE-2026-24552: newly added to the public-safe set.
37 more public-safe changes in the JSON feed.

Previous snapshot2026-07-30 06:05 UTC / 2026-07-30 15:05 JST

Items compared20 -> 20

Feed generated2026-07-30 11:26 UTC / 2026-07-30 20:26 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV0

CISA KEV0

Affected products0partial

CPE0partial

PURL0partial

Canonical vendor/product0partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-07-3020

Severity Distribution

CRITICAL 1
HIGH 2
MEDIUM 17
LOW 0
NONE 0
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2026-27064

Critical / High1 / 2

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 1,
    "HIGH": 2,
    "LOW": 0,
    "MEDIUM": 17,
    "NONE": 0,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2026-27064"
}

Source Status

NVD20 signalsLast observed: 2026-07-30Status: healthy

EPSS20 signalsLast observed: 2026-07-30Status: healthy

OSV0 signalsLast observed: 2026-07-30Status: not observed

CISA KEV0 signalsLast observed: 2026-07-30Status: not observed

Vendor Advisory20 signalsLast observed: 2026-07-30Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled