K
Vendor security profile
Kit
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs8
Critical0
CISA KEV0
Public exploit0
Patch rate%13
Avg. CVSS6.8
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
7
0
1
CVE KEV
CVE severity distribution
8toplam CVE
High3 (38%)
Medium5 (63%)
Patch and exploitation view
%13
Verified patch
%0
CISA KEV
%0
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
7Unknown
Latest vulnerabilities
6.5
CVE-2026-96653
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
W
Patch status unknownEPSS %0
7.2
CVE-2026-100147
FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
T
Patch status unknownEPSS %0
2.3
CVE-2026-104634
beam_mcp: JSON boolean and null tool arguments reach dispatch as strings
S
Patch verifiedEPSS %0
5.3
CVE-2026-88257
beam_mcp: nested tool argument constraints advertised but not enforced
S
Patch verifiedEPSS %0
5.3
CVE-2026-105421
WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability
K
Patch status unknownEPSS %0
7.2
CVE-2026-96871
Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
KP
Patch status unknownEPSS %0
9.1
CVE-2026-102105
Kiteworks Email Protection Gateway server-side request forgery
K
Patch status unknownEPSS %1
9.1
CVE-2026-102106
Kiteworks Email Protection Gateway improper authentication
K
Patch status unknownEPSS %1
4.6
CVE-2026-102107
Kiteworks Core user impersonation in a file-request feature
K
Patch status unknownEPSS %0
7.2
CVE-2026-102108
Kiteworks Email Protection Gateway deserialization of untrusted data
K
Patch status unknownEPSS %1