Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates
4,319 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.
CVE-2025-54761
An issue was discovered in PPress 0.0.9 allowing attackers to gain escilated privlidges via crafted session cookie.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T20:13:18.490Z.
CVE-2025-54815
Server-side template injection (SSTI) vulnerability in PPress 0.0.9 allows attackers to execute arbitrary code via crafted themes.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T20:05:39.385Z.
CVE-2025-55910
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T16:00:09.920Z.
CVE-2025-56762
Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T20:16:03.567Z.
CVE-2025-56869
Directory traversal vulnerability in Sync In server thru 1.1.1 allowing authenticated attackers to gain read and write access to the system via FilesManager.saveMultipart function in backend/src/applications/files/services/files-manager.service.ts, and FilesManager.compress function in backend/src/applications/files/se…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T17:57:08.429Z.
CVE-2025-57296
Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the sub_ADBC0 helper function concatenates these user-supplied values into nvram set system comman…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T17:58:17.915Z.
CVE-2025-57396
Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escalate their privileges to …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T20:17:08.121Z.
CVE-2025-57528
An issue was discovered in Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01 allowing attackers to cause a denial of service via the funcname, funcpara1, funcpara2 parameters to the formSetCfm function (uri path: SetCfm).
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T14:55:11.080Z.
CVE-2025-57644
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. An authenticated administrative user can execute arbitrary Java code on the server, resulting in remote code execution. In addition, improper input validation allows for arbitrary file write and server-side request …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T15:54:58.327Z.
CVE-2025-59689
Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For ESG 5.5. a fix has been…
Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2026-02-26T17:48:25.122Z.
CVE-2025-59712
Snipe-IT before 8.1.18 allows XSS.
Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T13:49:53.627Z.
CVE-2025-59713
Snipe-IT before 8.1.18 allows unsafe deserialization.
Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T13:49:25.986Z.
CVE-2025-59714
In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T13:48:56.733Z.
CVE-2025-59715
SMSEagle before 6.11 allows reflected XSS via a username or contact phone number.
Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T13:32:40.156Z.
CVE-2025-59717
In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-19T00:00:00.000Z. Updated 2025-09-19T13:32:08.575Z.
CVE-2025-30755
OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revision parameter. The application reflects unsanitized user input into the HTML output.
Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-18T23:32:07.807Z. Updated 2025-09-19T13:10:31.350Z.
Deserialization Vulnerability in GoAnywhere MFT's License Servlet
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.
Published 2025-09-18T22:01:51.337Z. Updated 2026-08-04T03:55:56.207Z.
Cognex In-Sight Explorer and In-Sight Camera Firmware Client-Side Enforcement of Server-Side Security
Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port 1069 to allow the client-side software, such as the In-Sight Explorer tool, to perform management operations such as changing network settings or modifying users' access to the device.
Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-18T21:30:45.520Z. Updated 2025-09-19T13:10:58.750Z.
Windows Bluetooth Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-18T21:28:25.888Z. Updated 2026-02-26T17:48:26.716Z.
Windows Graphics Component Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-09-18T21:28:25.203Z. Updated 2026-02-26T17:48:27.028Z.