Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,933 published records · 23 KEV · 6,933 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,933 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit5588.0%
High2,11831%
Med2,24432%
Low2403.5%
None90.13%
Legacy00.00%
Unscored1,76425%

Matching records by UTC month

May 266,933

Signal coverage

KEV-listed: 23
With a forecast: 6,933
Unknown date: 0
Unscored severity: 1,764

Share of cohort: KEV 0.33% · forecast 100% · unscored 25%.

Showing 1421–1440 of 6,933By severity band: Critical · 9.0–10.0 558, High · 7.0–8.9 2,118, Medium · 4.0–6.9 2,244, Low · 0.1–3.9 240, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 1,764

UnscoredPublished 27 May 2026, 16:24 WIB

CVE-2026-45839

bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

In the Linux kernel, the following vulnerability has been resolved: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() CO-RE accessor strings are colon-separated indices that describe a path from a root BTF type to a target field, e.g. "0:1:2" walks through nested struct members. bpf_core_parse_spec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T09:24:37.855Z. Updated 2026-10-15T01:19:41.412Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:19 WIB

Official record

UnscoredPublished 27 May 2026, 16:24 WIB

CVE-2026-45838

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL -- when the current element is the last entry it wraps to the list head via container_of(). The subsequent NULL check is therefore dead code and get_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1421 to 1440 of 6933.First page Next page

Published 2026-05-27T09:24:36.561Z. Updated 2026-10-15T01:19:40.227Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:19 WIB

Official record

UnscoredPublished 27 May 2026, 16:24 WIB

CVE-2026-45837

bpf: Fix use-after-free in arena_vm_close on fork

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in arena_vm_close on fork arena_vm_open() only bumps vml->mmap_count but never registers the child VMA in arena->vma_list. The vml->vma always points at the parent VMA, so after parent munmap the pointer dangles. If the child …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T09:24:32.833Z. Updated 2026-06-14T17:46:01.781Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jun 2026, 00:46 WIB

Official record

CritPublished 27 May 2026, 16:11 WIB

CVE-2026-48906

Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T09:11:40.231Z. Updated 2026-06-05T07:27:40.844Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated05 Jun 2026, 14:27 WIB

Official record

MedPublished 27 May 2026, 15:48 WIB

CVE-2026-48968

WordPress Master Slider plugin <= 3.10.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows DOM-Based XSS. This issue affects Master Slider: from n/a through 3.10.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:48:52.315Z. Updated 2026-05-27T10:26:43.137Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:26 WIB

Official record

MedPublished 27 May 2026, 15:47 WIB

CVE-2026-48877

WordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBlocks: from n/a through 2.1.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:47:23.577Z. Updated 2026-05-27T10:26:56.731Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:26 WIB

Official record

MedPublished 27 May 2026, 15:44 WIB

CVE-2026-2237

CVE-2026-2237

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local users on Windows to obtain sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:44:29.472Z. Updated 2026-06-02T08:28:36.196Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 15:28 WIB

Official record

MedPublished 27 May 2026, 15:43 WIB

CVE-2025-66593

CVE-2025-66593

An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:43:51.162Z. Updated 2026-06-02T08:21:55.359Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 15:21 WIB

Official record

MedPublished 27 May 2026, 15:43 WIB

CVE-2025-66592

CVE-2025-66592

An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:43:05.069Z. Updated 2026-06-02T08:20:25.069Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 15:20 WIB

Official record

HighPublished 27 May 2026, 15:40 WIB

CVE-2025-30028

CVE-2025-30028

A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:40:46.699Z. Updated 2026-05-27T12:43:49.263Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 19:43 WIB

Official record

HighPublished 27 May 2026, 15:40 WIB

CVE-2025-52747

WordPress Themebox - Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox - Digital Products Ecommerce allows Reflected XSS. This issue affects Themebox - Digital Products Ecommerce: from n/a through 1.4.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:40:21.524Z. Updated 2026-05-27T10:27:09.900Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:27 WIB

Official record

HighPublished 27 May 2026, 15:39 WIB

CVE-2025-14713

CVE-2025-14713

An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain user credentials from the edge server.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:39:35.762Z. Updated 2026-05-27T12:48:14.986Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 19:48 WIB

Official record

MedPublished 27 May 2026, 15:38 WIB

CVE-2025-13593

CVE-2025-13593

Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and conduct denial-of-service during installation.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:38:27.318Z. Updated 2026-06-02T08:18:36.204Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 15:18 WIB

Official record

CritPublished 27 May 2026, 15:37 WIB

CVE-2025-12686

CVE-2025-12686

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:37:03.455Z. Updated 2026-05-27T15:13:20.556Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 22:13 WIB

Official record

HighPublished 27 May 2026, 15:36 WIB

CVE-2025-13392

CVE-2025-13392

Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-69057 is not affected) allows remote attackers to bypass authentication with prior knowledge of the distinguished name (DN).

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:36:06.463Z. Updated 2026-05-27T13:44:34.268Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:44 WIB

Official record

HighPublished 27 May 2026, 15:35 WIB

CVE-2025-22741

WordPress Felan Framework plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Framework allows Reflected XSS. This issue affects Felan Framework: from n/a through 1.1.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:35:03.372Z. Updated 2026-05-27T10:27:23.471Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 17:27 WIB

Official record

MedPublished 27 May 2026, 15:34 WIB

CVE-2025-13167

CVE-2025-13167

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-20659 allows remote authenticated users to read or write specific files containing non-sensitive information via unspecified vectors.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:34:19.095Z. Updated 2026-05-27T13:43:43.777Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:43 WIB

Official record

MedPublished 27 May 2026, 15:32 WIB

CVE-2025-10466

CVE-2025-10466

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive information or conduct limited denial-of-se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:32:02.342Z. Updated 2026-05-27T13:44:57.358Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:44 WIB

Official record

LowPublished 27 May 2026, 15:30 WIB

CVE-2024-47272

CVE-2024-47272

Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to limited file write via unspecified vectors.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:30:22.603Z. Updated 2026-05-27T13:45:34.960Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:45 WIB

Official record

MedPublished 27 May 2026, 15:30 WIB

CVE-2024-47271

CVE-2024-47271

Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator privileges to obtain sensitive information via unspecified vectors.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-05-27T08:30:12.577Z. Updated 2026-05-27T13:45:13.986Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated27 May 2026, 20:45 WIB

Official record