Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates
3,629 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.
CVE-2024-57155
Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T13:33:38.839Z.
CVE-2024-57157
Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T14:49:04.333Z.
CVE-2024-57491
Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API without any token via the preHandle function.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T15:32:05.946Z.
CVE-2025-28041
Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentication.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T13:37:17.188Z.
CVE-2025-50503
A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password mechanism. By manipulating the reset process, an unauthorized user may be able to reset the password and gain access to the account without needing to provide a legitimate authentica…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T13:51:51.934Z.
CVE-2025-50864
An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking if it is a substring of any domain in the site's CORS policy, rather than performing an exact match. For exampl…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2026-07-05T01:27:35.684Z.
CVE-2025-50901
JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbitrary file reading.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T14:48:49.900Z.
CVE-2025-50902
Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat_applet__open_source) thru 1.0.0 allows attackers to gain sensitive information via crafted HTTP Post message.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T13:39:14.877Z.
CVE-2025-50904
There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). An attacker can exploit this vulnerability to access /admin/ API without any token.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T13:45:59.141Z.
CVE-2025-51990
XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation section of the Global Preferences panel. An authenticated administrator can inject arbitrary JavaScript payloads into the HTTP Meta Info, Footer Cop…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T15:53:53.689Z.
CVE-2025-51991
XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global Preferences Presentation section. An authenticated administrator can inject crafted Apache Velocity template code, which is rendered on the serv…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T15:43:26.008Z.
CVE-2025-54363
Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. extract_full_summary_from_signature employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing …
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T15:37:24.848Z.
CVE-2025-54364
Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. option_descriptions employs an inefficient regular expression pattern: "\s(:param)\s+(.+?)\s:(.*)" that is susceptible to catastrophic backtracking when processing crafted docstrings containing a large volume o…
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-26T13:42:50.158Z.
CVE-2025-55444
A SQL injection vulnerability exists in the id2 parameter of the cancel_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. A remote attacker can inject arbitrary SQL queries, leading to database enumeration and potential remote code execution.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-21T13:47:10.395Z.
CVE-2025-55482
Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the formSetCfm function.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T15:04:40.896Z.
CVE-2025-55483
Tenda AC6 V15.03.06.23_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and deviceList.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T15:03:42.138Z.
CVE-2025-55498
Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T15:06:42.757Z.
CVE-2025-55499
Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T14:20:34.911Z.
CVE-2025-55503
Tenda AC6 V15.03.06.23_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-08-20T13:58:49.804Z.
Unauthorized API Access Risk
A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-08-20T00:00:00.000Z. Updated 2025-09-11T14:02:30.986Z.