Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,980 published records · 19 KEV · 3,980 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,980 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2446.1%
High95724%
Med1,53639%
Low1193.0%
None00.00%
Legacy00.00%
Unscored1,12428%

Matching records by UTC month

May 253,980

Signal coverage

KEV-listed: 19
With a forecast: 3,980
Unknown date: 0
Unscored severity: 1,124

Share of cohort: KEV 0.48% · forecast 100% · unscored 28%.

Showing 141–160 of 3,980By severity band: Critical · 9.0–10.0 244, High · 7.0–8.9 957, Medium · 4.0–6.9 1,536, Low · 0.1–3.9 119, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,124

UnscoredPublished 30 May 2025, 07:50 WIB

CVE-2020-36846

IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:50:28.582Z. Updated 2025-05-30T22:01:41.998Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44612

CVE-2025-44612

Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-the-middle attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:02:19.532Z.

Showing 141 to 160 of 3980.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:02 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44614

CVE-2025-44614

Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:02:12.898Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:02 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44619

CVE-2025-44619

Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2026-07-05T17:01:58.404Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Jul 2026, 00:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44904

CVE-2025-44904

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:01:59.619Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44905

CVE-2025-44905

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:01:54.071Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44906

CVE-2025-44906

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:01:48.645Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

CritPublished 30 May 2025, 07:00 WIB

CVE-2025-48757

CVE-2025-48757

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protect…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-08-21T02:28:45.607Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated21 Aug 2025, 09:28 WIB

Official record

CritPublished 30 May 2025, 06:18 WIB

CVE-2025-46352

Consilium Safety CS5000 Fire Panel Use of Hard-coded Credentials

The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running VNC. This password cannot be altered, allowing anyone with knowledge of it to gain remote access to the panel. Such access could enable an attacker to operate t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T23:18:33.934Z. Updated 2025-05-30T12:49:31.802Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 19:49 WIB

Official record

CritPublished 30 May 2025, 06:17 WIB

CVE-2025-41438

Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely impact the device's …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T23:17:18.012Z. Updated 2025-05-30T12:50:16.987Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 19:50 WIB

Official record

CritPublished 30 May 2025, 06:12 WIB

CVE-2025-1907

Instantel Micromate Missing Authentication for Critical Function

Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T23:12:12.540Z. Updated 2025-05-30T12:50:37.021Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 19:50 WIB

Official record

MedPublished 30 May 2025, 05:31 WIB

CVE-2025-5332

1000 Projects Online Notice Board index.php sql injection

A vulnerability was found in 1000 Projects Online Notice Board 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T22:31:04.158Z. Updated 2025-05-30T12:51:07.194Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 19:51 WIB

Official record

HighPublished 30 May 2025, 05:11 WIB

CVE-2025-5307

Santesoft Sante DICOM Viewer Pro Out-of-bounds Read

Santesoft Sante DICOM Viewer Pro contains a memory corruption vulnerability. A local attacker could exploit this issue to potentially disclose information and to execute arbitrary code on affected installations of Sante DICOM Viewer Pro.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T22:11:12.769Z. Updated 2025-05-30T12:51:50.096Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 19:51 WIB

Official record

MedPublished 30 May 2025, 05:00 WIB

CVE-2025-5331

PCMan FTP Server NLST Command buffer overflow

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T22:00:07.544Z. Updated 2025-05-30T13:41:27.680Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 20:41 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-30466

CVE-2025-30466

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:27.244Z. Updated 2026-04-02T18:27:10.218Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:27 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31261

CVE-2025-31261

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:26.860Z. Updated 2026-04-02T18:26:56.443Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:26 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31231

CVE-2025-31231

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read sensitive location information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:26.498Z. Updated 2026-04-02T18:19:30.119Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:19 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31199

CVE-2025-31199

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS 2.4. An app may be able to access sensitive user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:26.147Z. Updated 2026-04-02T18:15:55.345Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:15 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31264

CVE-2025-31264

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive user information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:25.786Z. Updated 2026-04-02T18:14:40.829Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:14 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31198

CVE-2025-31198

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A path handling issue was addressed with improved validation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:25.428Z. Updated 2026-04-02T18:14:00.520Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:14 WIB

Official record