public radar

Prioritized Vulnerability Signals for Defenders

Track CVE, KEV, EPSS, and vendor-advisory changes in one read-only radar—so teams can see what changed, why it matters, and what to verify next.

LIVE SIGNAL MAPDEFENSIVE PRIORITY CIRCUITLATEST STATIC SNAPSHOT

PRIORITY ORDER · NOT AN ATTACK PATH

indexable public surfaceread-only datasetpublic-safe sourcesexternal execution disabledauto remediation disabled

Tracked CVEs2020 new in 7d

Critical3canonical CVSS

Known Exploited0KEV observed

High EPSS percentile (≥70)1EPSS percentile observed

Monitored Vendors1from current data

VULNERABILITY TREEMAP

DEFENSIVE PRIORITY SURFACE

Stable CVE grouping for defensive triage. Area changes by display mode; severity remains encoded by color.

LATEST STATIC SNAPSHOT2026-09-25 23:59 UTC / 2026-09-26 08:59 JST

DISPLAY MODEDEFENSIVE PRIORITY

Live Vulnerability Feed READ-ONLY

20 signalsView all signals →

2026-09-25

defensive priority signal

CRITICALEPSS 0.0391 (90)NEW-NVD: The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the up… Handoff

2026-09-25

defensive priority signal

CRITICALEPSS 0.0073 (52)NEW-NVD: The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode… Handoff

2026-09-25

defensive priority signal

CRITICALEPSS 0.0068 (50)NEW-NVD: The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0046 (37)NEW-NVD: The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and incl… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0082 (55)NEW-NVD: SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site s… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0060 (46)NEW-NVD: SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-sit… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0091 (58)NEW-NVD: The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function… Handoff

2026-09-25

defensive priority signal

HIGHEPSS 0.0024 (14)NEW-NVD: The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all ver… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0019 (7)NEW-NVD: The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication b… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0070 (51)NEW-NVD: The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypa… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0046 (38)NEW-NVD: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0022 (11)NEW-NVD: The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via th… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0033 (24)NEW-NVD: The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0038 (29)NEW-NVD: The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and in… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0038 (29)NEW-NVD: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sea… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0056 (44)NEW-NVD: The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposu… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0038 (29)NEW-NVD: SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0021 (10)NEW-NVD: The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0046 (37)NEW-NVD: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to… Handoff

2026-09-25

defensive priority signal

MEDIUMEPSS 0.0020 (8)NEW-NVD: The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. NVD: This is due… Handoff

Public-safe defensive signals

CVE-2026-84434 CRITICAL CVSS 9.8 -
NVD: The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. NVD: This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where hidden file upload fields bypass extension validation and a rejected file's intact upload state is later passed to upload_file() without re-validation. NVD: This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
A remote attacker may be able to run code or commands on affected systems; CVSS 9.8 (CRITICAL); EPSS percentile 90; sources: NVD.
CVE-2026-92229 CRITICAL CVSS 9.1 -
NVD: The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. NVD: This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. NVD: This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 9.1 (CRITICAL); EPSS percentile 52; sources: NVD.
CVE-2026-89274 CRITICAL CVSS 9.1 -
NVD: The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. NVD: The vulnerability exists because WPRM_Metadata::sanitize_metadata() recursively calls do_shortcode() on every scalar field of the recipe's structured metadata array — including the reviewBody field, which is populated verbatim from the comment_content of... NVD: This makes it possible for unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on every recipe page render, causing shortcode output — such as attachment captions, private post fields, or other data exposed by installed...
This critical severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 9.1 (CRITICAL); EPSS percentile 50; sources: NVD.
CVE-2026-92807 HIGH CVSS 8.8 -
NVD: The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the pdf_created_callback shortcode attribute. NVD: The eval_shortcode() function copies any non-button_/non-email_ shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and create_button() AES-encrypts that array — including the... NVD: This makes it possible for authenticated attackers, with Contributor-level access and above, to invoke arbitrary PHP functions or static class methods with plugin option data as the sole argument, enabling disclosure of the site's stored PDFCrowd API key and...
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 8.8 (HIGH); EPSS percentile 37; sources: NVD.
CVE-2026-93922 HIGH CVSS 8.6 -
NVD: SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. NVD: Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution. OSV: SiYuan through 3.8.4 Stored XSS via notebook names
An attacker may be able to run code or commands on affected systems; CVSS 8.6 (HIGH); EPSS percentile 55; sources: NVD, OSV.
CVE-2026-93923 HIGH CVSS 8.6 -
NVD: SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. NVD: Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access. OSV: SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk; CVSS 8.6 (HIGH); EPSS percentile 46; sources: NVD, OSV.
CVE-2026-87909 HIGH CVSS 7.5 -
NVD: The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. NVD: This is due to insufficient sanitization of the multipart upload filename before concatenation into an ImageMagick command string executed via exec(), with only escapeshellcmd() applied to the whole command rather than quoting individual arguments. NVD: This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.
An attacker may be able to run code or commands on affected systems; CVSS 7.5 (HIGH); EPSS percentile 58; sources: NVD.
CVE-2026-13354 HIGH CVSS 7.2 -
NVD: The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. NVD: This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NVD: This is only exploitable on instances where combine_loaded_css has been enabled.
This high severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure · authenticated boundary; CVSS 7.2 (HIGH); EPSS percentile 14; sources: NVD.
CVE-2026-77875 MEDIUM CVSS 6.8 -
NVD: The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. NVD: A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 6.8 (MEDIUM); EPSS percentile 7; sources: NVD.
CVE-2026-89334 MEDIUM CVSS 6.5 -
NVD: The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. NVD: This is due to the plugin not properly verifying that a user is authorized to perform an action. NVD: This makes it possible for authenticated attackers, with custom-level access and above, to access the full message transcript, thread metadata, and user data of any chat-room thread without authentication.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 6.5 (MEDIUM); EPSS percentile 51; sources: NVD.
CVE-2026-89333 MEDIUM CVSS 6.5 -
NVD: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. NVD: This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 6.5 (MEDIUM); EPSS percentile 38; sources: NVD.
CVE-2026-15760 MEDIUM CVSS 6.5 -
NVD: The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. NVD: The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting the parameter) and never call current_user_can() or otherwise enforce a capability. NVD: This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed...
An attacker may be able to access information that should not be exposed; CVSS 6.5 (MEDIUM); EPSS percentile 11; sources: NVD.
CVE-2026-77820 MEDIUM CVSS 6.4 -
NVD: The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. NVD: This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NVD: This requires the premium version of the software in order to exploit.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · authenticated boundary; CVSS 6.4 (MEDIUM); EPSS percentile 24; sources: NVD.
CVE-2026-92967 MEDIUM CVSS 6.1 -
NVD: The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. NVD: This is due to insufficient output escaping , which reads $_GET['keyword'], applies only sanitize_text_field() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP... NVD: This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with upload_files capability (Author or above) into performing an action such as clicking on a specially crafted...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure · authenticated boundary; CVSS 6.1 (MEDIUM); EPSS percentile 29; sources: NVD.
CVE-2026-89081 MEDIUM CVSS 6.1 -
NVD: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. NVD: This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · remote exposure · authenticated boundary; CVSS 6.1 (MEDIUM); EPSS percentile 29; sources: NVD.
CVE-2026-89093 MEDIUM CVSS 5.3 -
NVD: The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Information Exposure by Spoofing in all versions up to, and including, 2.15.33. NVD: This is due to the is_ai_bot_user() function identifying privileged internal AI bot accounts by performing a prefix check for 'ai-chat-bot-' against a guest record's stored IP address, which is populated verbatim from the client-controlled X-Real-IP request... NVD: This makes it possible for unauthenticated attackers to register a guest identity that the plugin treats as its own internal AI bot, bypassing the per-room role allowlist, draft-status check, and join filters — which are all short-circuited by the bot check...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for remote exposure · authenticated boundary; CVSS 5.3 (MEDIUM); EPSS percentile 44; sources: NVD.
CVE-2026-93921 MEDIUM CVSS 5.3 -
NVD: SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. NVD: Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection. OSV: SiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for defensive exposure review; CVSS 5.3 (MEDIUM); EPSS percentile 29; sources: NVD, OSV.
CVE-2026-12042 MEDIUM CVSS 4.4 -
NVD: The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.12 due to insufficient input sanitization and output escaping. NVD: This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NVD: This only affects multi-site installations and installations where unfiltered_html has been disabled.
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for XSS risk · authenticated boundary; CVSS 4.4 (MEDIUM); EPSS percentile 10; sources: NVD.
CVE-2026-88944 MEDIUM CVSS 4.3 -
NVD: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. NVD: This is due to the plugin not properly verifying that a user is authorized to perform an action. NVD: This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ).
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 4.3 (MEDIUM); EPSS percentile 37; sources: NVD.
CVE-2026-15660 MEDIUM CVSS 4.3 -
NVD: The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. NVD: This is due to a missing capability check on the handle_oauth_callback() function which is hooked to admin_init and processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. NVD: This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted...
This medium severity issue needs human triage to confirm exposure, affected versions, and vendor guidance for authenticated boundary; CVSS 4.3 (MEDIUM); EPSS percentile 8; sources: NVD.

Critical High Medium Low KEVKnown Exploited NEWNewly ObservedJ / K Move · ↑ / ↓ Move · Enter Open · Esc Close

Agent Access Agent Data Surface

Read-only static JSON for humans and AI agents. This is a data contract, not an execution surface.

Human Archive Priority Queue JSON Latest Diff Feed Knowledge Graph Trust Layer Proof Metadata Canonical Policy Canonical Envelope Envelope Index EAS Typed Payload Attestation Ledger Signal Item JSON Remediation Handoff Agent Manifest Static Manifest Schema

Knowledge Graph / JSON-LDlinks CVE signals, sources, affected products, and provenanceLocal-first Vaultbrowser-only personal review context; import/export/clear supportedRirastaFab Trust Layerhash-only integrity metadata, canonical envelopes, and proof endpointsCanonical Envelopeattestation-ready preflight metadata without onchain submission

Agents should start with /agent.json, validate the signal item schema, use the JSON-LD graph for provenance, and treat the Local Vault as private browser state that is never uploaded.

WebMCP read-only toolsEnabledRuntime server endpointsNoneStatic agent JSONEnabled

Allowedsearch / list / get / summarize / prioritize

Disabledscan / patch / exploit / external execution / auto remediation

Last generated: 2026-09-25 23:59 UTC / 2026-09-26 08:59 JST. Observed dates are per-source signal timestamps.

Latest Changes Diff Feed

previous successful latestpublic snapshot comparison

40 public-safe changes since the previous successful snapshot.

Added20

Changed0

Removed20

What changed

CVE-2026-12042: newly added to the public-safe set.
CVE-2026-13354: newly added to the public-safe set.
CVE-2026-15660: newly added to the public-safe set.
37 more public-safe changes in the JSON feed.

Previous snapshot2026-09-25 19:19 UTC / 2026-09-26 04:19 JST

Items compared20 -> 20

Feed generated2026-09-25 23:59 UTC / 2026-09-26 08:59 JST

Open latest diff feed

Enrichment Coverage partial

Coverage is shown from the current public dataset. CPE, PURL, and canonical vendor/product are partial and may be unknown.

NVD20

Vendor Advisory20

OSV3

Affected products0partial

CPE0partial

PURL0partial

Canonical vendor/product0partial

Observed Buckets (current snapshot)

Current snapshot only. Historical trend appears after multiple generated runs.

2026-09-2520

Severity Distribution

CRITICAL 3
HIGH 5
MEDIUM 12
LOW 0
NONE 0
UNKNOWN 0

Source Distribution (current snapshot)

NVD20

Vendor Advisory20

OSV3

Monitored Vendors

View all vendors →

Vendor distribution from the current public snapshot. Neutral badges are not official vendor logos.

Local-first Personal Data Vault

A browser-only vault for human review context. It stores vendor / product / package / CPE prefix / saved signals / muted signals / preferences in localStorage, supports import/export/clear, validates shape on import, and never uploads data.

Import Vault JSON

No watched signals yet. Use the heart control on a signal row to add one.

Saved Views

Save and reapply local filter sets. Nothing is uploaded.

No saved views. Enter a name and save the current filters.

Read-only Triage Report Preview

Generated from the current filters. Defensive checklist only; no exploit or scanning detail.

Filtered signals20

Top priority candidateCVE-2026-84434

Critical / High3 / 5

Safety moderead-only, public indexable, public-safe

Raw JSON details

{
  "count": 20,
  "defensive_checklist": [
    "Confirm affected products",
    "Review official source references",
    "Prioritize KEV, critical CVSS, and high EPSS percentile items",
    "Record human confirmation"
  ],
  "mode": "read_only_public_beta_dashboard",
  "safety": {
    "procedural_detail": false,
    "public_launch": true,
    "scanner_execution": false
  },
  "severity_distribution": {
    "CRITICAL": 3,
    "HIGH": 5,
    "LOW": 0,
    "MEDIUM": 12,
    "NONE": 0,
    "UNKNOWN": 0
  },
  "top_risk": "CVE-2026-84434"
}

Source Status

NVD20 signalsLast observed: 2026-09-25Status: healthy

EPSS20 signalsLast observed: 2026-09-25Status: healthy

OSV3 signalsLast observed: 2026-09-25Status: healthy

Vendor Advisory20 signalsLast observed: 2026-09-25Status: observed

Safety Guardrails

Public indexingEnabled

Read-only surfaceEnabled

Deploy controlsCodex managed deploy only

External notificationDisabled

Auto remediationDisabled

Runtime server endpointsNone

WebMCP read-only toolsEnabled

Static agent JSONEnabled