Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1401–1420 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

MedPublished 13 Nov 2025, 22:02 WIB

CVE-2025-13118

macrozheng mall-swarm paySuccess improper authorization

A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T15:02:05.419Z. Updated 2026-05-23T14:07:07.382Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 May 2026, 21:07 WIB

Official record

MedPublished 13 Nov 2025, 21:56 WIB

CVE-2025-62482

Zoom Workplace for Windows - Cross-site Scripting

Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:56:25.642Z. Updated 2025-11-13T15:38:29.563Z.

Showing 1401 to 1420 of 3020.First page Next page

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 22:38 WIB

Official record

MedPublished 13 Nov 2025, 21:53 WIB

CVE-2025-30662

Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following

Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:53:09.801Z. Updated 2026-02-26T16:57:05.216Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

MedPublished 13 Nov 2025, 21:49 WIB

CVE-2025-30669

Zoom Workplace Clients - Improper Certificate Validation

Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:49:54.870Z. Updated 2025-11-13T15:17:54.292Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 22:17 WIB

Official record

HighPublished 13 Nov 2025, 21:46 WIB

CVE-2025-64741

Zoom Workplace for Android - Improper Authorization Handling

Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:46:59.205Z. Updated 2026-02-26T16:57:05.705Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

HighPublished 13 Nov 2025, 21:35 WIB

CVE-2025-64740

Zoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:35:39.025Z. Updated 2026-02-26T16:57:06.217Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

MedPublished 13 Nov 2025, 21:32 WIB

CVE-2025-13117

macrozheng mall-swarm/mall cancelOrder improper authorization

A security vulnerability has been detected in macrozheng mall-swarm and mall up to 1.0.3. Affected by this vulnerability is the function cancelOrder of the file /order/cancelOrder. The manipulation of the argument orderId leads to improper authorization. The attack can be initiated remotely. The exploit has been disclo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:32:06.265Z. Updated 2025-11-15T06:19:29.104Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Nov 2025, 13:19 WIB

Official record

MedPublished 13 Nov 2025, 21:28 WIB

CVE-2025-64739

Zoom Clients - External Control of File Name or Path

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:28:58.527Z. Updated 2025-11-14T16:51:41.747Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated14 Nov 2025, 23:51 WIB

Official record

MedPublished 13 Nov 2025, 21:23 WIB

CVE-2025-64738

Zoom Workplace for macOS - External Control of File Name or Path

External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.

Excerpt language: en.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:23:00.704Z. Updated 2025-11-14T16:52:02.952Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated14 Nov 2025, 23:52 WIB

Official record

MedPublished 13 Nov 2025, 21:02 WIB

CVE-2025-13116

macrozheng mall-swarm/mall cancelUserOrder improper authorization

A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T14:02:05.516Z. Updated 2025-12-19T19:20:13.791Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Dec 2025, 02:20 WIB

Official record

MedPublished 13 Nov 2025, 20:32 WIB

CVE-2025-13115

macrozheng mall-swarm/mall Order Details detail improper authorization

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:32:09.111Z. Updated 2025-11-15T06:19:23.088Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Nov 2025, 13:19 WIB

Official record

MedPublished 13 Nov 2025, 20:32 WIB

CVE-2025-13114

macrozheng mall-swarm attr updateAttr improper authorization

A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:32:06.750Z. Updated 2025-11-13T13:56:17.637Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 20:56 WIB

Official record

MedPublished 13 Nov 2025, 20:23 WIB

CVE-2025-41069

Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite

Insecure Direct Object Reference (IDOR) vulnerability in DeporSite of T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in ‘/ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos’, which could l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:23:18.794Z. Updated 2025-11-13T13:57:22.144Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 20:57 WIB

Official record

MedPublished 13 Nov 2025, 20:00 WIB

CVE-2025-12818

PostgreSQL libpq undersizes allocations, via integer wraparound

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:00:12.911Z. Updated 2025-11-13T13:59:33.436Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 20:59 WIB

Official record

LowPublished 13 Nov 2025, 20:00 WIB

CVE-2025-12817

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:00:12.160Z. Updated 2025-11-13T13:59:54.599Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 20:59 WIB

Official record

HighPublished 13 Nov 2025, 20:00 WIB

CVE-2025-12765

pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.

pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:00:11.448Z. Updated 2025-11-13T14:00:56.314Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 21:00 WIB

Official record

HighPublished 13 Nov 2025, 20:00 WIB

CVE-2025-12764

pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:00:10.595Z. Updated 2025-11-13T14:02:00.502Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 21:02 WIB

Official record

MedPublished 13 Nov 2025, 20:00 WIB

CVE-2025-12763

Command injection vulnerability allowing arbitrary command execution on Windows

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:00:08.048Z. Updated 2026-02-26T16:57:06.806Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

CritPublished 13 Nov 2025, 20:00 WIB

CVE-2025-12762

Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T13:00:02.005Z. Updated 2026-02-26T16:57:07.296Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

MedPublished 13 Nov 2025, 19:57 WIB

CVE-2025-40681

Cross-Site Scripting (XSS) in xCally Omnichannel

Cross-site Scripting (XSS) vulnerability reflected in xCally's Omnichannel v3.30.1. This vulnerability allowsan attacker to executed JavaScript code in the victim's browser by sending them a malicious URL using the 'failureMessage' parameter in '/login'. This vulnerability can be exploited to steal sentitive user data,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T12:57:00.745Z. Updated 2025-11-13T20:22:57.206Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated14 Nov 2025, 03:22 WIB

Official record