Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 141–160 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

HighPublished 31 Jul 2025, 00:55 WIB

CVE-2025-26332

CVE-2025-26332

TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. The attacker may be able to use the exposed credentials t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T17:55:55.248Z. Updated 2026-02-26T17:50:01.657Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 31 Jul 2025, 00:50 WIB

CVE-2025-30105

CVE-2025-30105

Dell XtremIO, version(s) 6.4.0-22, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. The attacker may be able to use the exposed credentials to access the vulnerable app…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 141 to 160 of 3774.First page Next page

Published 2025-07-30T17:50:38.998Z. Updated 2026-02-26T17:50:02.728Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 31 Jul 2025, 00:32 WIB

CVE-2025-8327

code-projects Exam Form Submission delete_s8.php sql injection

A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/delete_s8.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T17:32:05.052Z. Updated 2025-07-30T17:42:25.165Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 00:42 WIB

Official record

HighPublished 30 Jul 2025, 23:18 WIB

CVE-2025-36611

CVE-2025-36611

Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Link Following') Vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T16:18:09.720Z. Updated 2026-02-26T17:50:03.439Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

UnscoredPublished 30 Jul 2025, 23:10 WIB

CVE-2025-8312

CVE-2025-8312

Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following version(s) : * Devolutions Server 2025.2.2.0 through 2025.2.5.0 * Devolutions …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T16:10:05.322Z. Updated 2025-08-19T12:18:26.409Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Aug 2025, 19:18 WIB

Official record

UnscoredPublished 30 Jul 2025, 23:06 WIB

CVE-2025-8353

CVE-2025-8353

UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T16:06:46.196Z. Updated 2025-07-30T16:17:38.655Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Jul 2025, 23:17 WIB

Official record

UnscoredPublished 30 Jul 2025, 22:58 WIB

CVE-2025-54656

Apache Struts Extras: Improper Output Neutralization for Logs

** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts. This issue affects Apache Struts Extras: before 2. When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T15:58:02.362Z. Updated 2025-11-04T21:12:51.678Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:12 WIB

Official record

MedPublished 30 Jul 2025, 22:15 WIB

CVE-2023-2593

Kernel: ksmbd memory exhaustion denial-of-service vulnerability

A flaw exists within the Linux kernel's handling of new TCP connections. The issue results from the lack of memory release after its effective lifetime. This vulnerability allows an unauthenticated attacker to create a denial of service condition on the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T15:15:53.952Z. Updated 2026-06-29T23:09:47.126Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 06:09 WIB

Official record

MedPublished 30 Jul 2025, 21:32 WIB

CVE-2025-54573

CVAT vulnerable to email verification bypass by use of basic authentication

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified users. Additionally, the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:32:03.675Z. Updated 2025-07-30T14:45:10.490Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated30 Jul 2025, 21:45 WIB

Official record

MedPublished 30 Jul 2025, 21:31 WIB

CVE-2025-43018

Certain HP LaserJet Pro Printers – Potential Information Disclosure

Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:31:18.650Z. Updated 2025-07-30T14:45:36.382Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Jul 2025, 21:45 WIB

Official record

HighPublished 30 Jul 2025, 21:29 WIB

CVE-2025-54433

Bugsink is vulnerable to Path Traversal attacks via event_id in ingestion

Bugsink is a self-hosted error tracking service. In versions 1.4.2 and below, 1.5.0 through 1.5.4, 1.6.0 through 1.6.3, and 1.7.0 through 1.7.3, ingestion paths construct file locations directly from untrusted event_id input without validation. A specially crafted event_id can result in paths outside the intended dire…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:29:03.510Z. Updated 2025-07-30T14:46:51.691Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Jul 2025, 21:46 WIB

Official record

HighPublished 30 Jul 2025, 21:28 WIB

CVE-2025-53944

AutoGPT Platform Exposes Graph Execution Results via Authorization Gap

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_graph_execution_results endpoint has an authorization bypass vulnerability. While it correctly validates user access to the graph_id, it fails to verify ownership…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:28:36.168Z. Updated 2025-07-30T14:47:36.847Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated30 Jul 2025, 21:47 WIB

Official record

CritPublished 30 Jul 2025, 21:20 WIB

CVE-2025-46811

SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint

A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Serve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:20:53.828Z. Updated 2026-02-26T17:50:03.837Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 30 Jul 2025, 21:17 WIB

CVE-2025-53357

GLPI permits reservation modification by unauthorized users

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.78 through 10.0.18, a connected user can alter the reservations of another user. This is fixed in version 1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:17:58.803Z. Updated 2025-07-30T19:31:11.425Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:31 WIB

Official record

LowPublished 30 Jul 2025, 21:16 WIB

CVE-2025-53113

GLPI technicians can access unauthorized information through external links

GLPI, which stands for Gestionnaire Libre de Parc Informatique, is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 0.65 through 10.0.18, a technician can use the external links feature to fetch information on items they do n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:16:36.631Z. Updated 2025-07-30T19:30:40.525Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:30 WIB

Official record

MedPublished 30 Jul 2025, 21:15 WIB

CVE-2025-53112

GLPI's incomprehensive permission checks can lead to data removal from allowed users

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.1.0 through 10.0.18, a lack of permission checks can result in unauthorized removal of some specific resources. This is fixed in version 10.0.19.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:15:22.000Z. Updated 2025-07-30T19:29:35.826Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:29 WIB

Official record

MedPublished 30 Jul 2025, 21:14 WIB

CVE-2025-53111

GLPI exposes data to non-allowed users

GLPI is a Free Asset and IT Management Software package. In versions 0.80 through 10.0.18, a lack of permission checks can result in unauthorized access to some resources. This is fixed in version 10.0.19.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:14:25.821Z. Updated 2025-07-30T19:29:10.968Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:29 WIB

Official record

MedPublished 30 Jul 2025, 21:09 WIB

CVE-2025-53008

GLPI's MailCollector Receiver is vulnerable to credential exfiltration

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions 9.3.1 through 10.0.19, a connected user can use a malicious payload to steal mail receiver credentials. This is fixed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:09:58.592Z. Updated 2025-07-30T19:28:38.917Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:28 WIB

Official record

MedPublished 30 Jul 2025, 21:07 WIB

CVE-2025-52897

GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:07:58.830Z. Updated 2025-07-30T19:28:12.527Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:28 WIB

Official record

LowPublished 30 Jul 2025, 21:07 WIB

CVE-2025-52567

GLPI has overly permissive URL verification

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 0.84 through 10.0.18, usage of RSS feeds or external calendars when planning is subject to SSRF exploit. The previous security patches provided since GLPI 10.0.4 were …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T14:07:14.643Z. Updated 2025-07-30T19:27:34.141Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:27 WIB

Official record