Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1441–1460 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

CritPublished 19 Jul 2025, 05:15 WIB

CVE-2025-7395

Domain Name Validation Bypass with Apple Native Certificate Validation

A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardless of the hostn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T22:15:59.460Z. Updated 2025-07-21T14:56:52.762Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 21:56 WIB

Official record

MedPublished 19 Jul 2025, 04:44 WIB

CVE-2025-7814

code-projects Food Ordering Review System signup_function.php sql injection

A vulnerability classified as critical was found in code-projects Food Ordering Review System 1.0. This vulnerability affects unknown code of the file /pages/signup_function.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1441 to 1460 of 3774.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T21:44:05.160Z. Updated 2025-07-21T15:19:20.606Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 22:19 WIB

Official record

HighPublished 19 Jul 2025, 03:44 WIB

CVE-2025-7807

Tenda FH451 SafeUrlFilter fromSafeUrlFilter stack-based overflow

A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. This issue affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T20:44:07.510Z. Updated 2025-07-21T15:15:44.725Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 22:15 WIB

Official record

HighPublished 19 Jul 2025, 03:32 WIB

CVE-2025-7806

Tenda FH451 SafeClientFilter fromSafeClientFilter stack-based overflow

A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. The manipulation of the argument Go/page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T20:32:07.733Z. Updated 2025-07-21T15:15:04.681Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 22:15 WIB

Official record

HighPublished 19 Jul 2025, 02:32 WIB

CVE-2025-7805

Tenda FH451 PPTPUserSetting fromPptpUserSetting stack-based overflow

A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserSetting of the file /goform/PPTPUserSetting. The manipulation of the argument delno leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T19:32:08.275Z. Updated 2025-07-22T14:25:05.325Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 21:25 WIB

Official record

MedPublished 19 Jul 2025, 02:14 WIB

CVE-2025-7803

descreekert wx-discuz wx.php validToken cross site scripting

A vulnerability was found in descreekert wx-discuz up to 12bd4745c63ec203cb32119bf77ead4a923bf277. It has been classified as problematic. This affects the function validToken of the file /wx.php. The manipulation of the argument echostr leads to cross site scripting. It is possible to initiate the attack remotely. This…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T19:14:04.761Z. Updated 2025-07-22T14:25:44.298Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 21:25 WIB

Official record

MedPublished 19 Jul 2025, 02:02 WIB

CVE-2025-7802

PHPGurukul Complaint Management System complaint-search.php cross site scripting

A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/complaint-search.php. The manipulation of the argument Search leads to cross site scripting. The attack may be launched remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T19:02:06.832Z. Updated 2025-07-22T14:27:10.503Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 21:27 WIB

Official record

MedPublished 19 Jul 2025, 01:51 WIB

CVE-2025-33014

IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T18:51:05.486Z. Updated 2025-08-18T01:33:59.946Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 08:33 WIB

Official record

MedPublished 19 Jul 2025, 01:44 WIB

CVE-2025-7801

BossSoft CRM HNDCBas_customPrmSearchDtl.jsp sql injection

A vulnerability has been found in BossSoft CRM 6.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /crm/module/HNDCBas_customPrmSearchDtl.jsp. The manipulation of the argument cstid leads to sql injection. The attack can be launched remotely. The exploit has been discl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T18:44:05.284Z. Updated 2025-07-22T14:53:31.229Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 21:53 WIB

Official record

MedPublished 19 Jul 2025, 01:32 WIB

CVE-2025-7800

cgpandey hotelmis HTTP GET Request admin.php cross site scripting

A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown code of the file admin.php of the component HTTP GET Request Handler. The manipulation of the argument Search leads to cross site scripting. The attack can be initi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T18:32:04.603Z. Updated 2025-07-18T18:42:59.191Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated19 Jul 2025, 01:42 WIB

Official record

MedPublished 19 Jul 2025, 01:14 WIB

CVE-2025-7798

Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System companyManage sql injection

A vulnerability classified as critical has been found in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System up to 8.2. This affects an unknown part of the file /admin/system/structure/getdirectorydata/web/baseinfo/companyManage. The manipulation of the argument Struccture_ID leads to sql i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T18:14:06.670Z. Updated 2025-07-18T18:43:01.562Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Jul 2025, 01:43 WIB

Official record

MedPublished 19 Jul 2025, 00:44 WIB

CVE-2025-7797

GPAC dash_client.c gf_dash_download_init_segment null pointer dereference

A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gf_dash_download_init_segment of the file src/media_tools/dash_client.c. The manipulation of the argument base_init_url leads to null pointer dereference. The attack may be launched remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:44:07.920Z. Updated 2025-07-18T18:04:07.333Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated19 Jul 2025, 01:04 WIB

Official record

HighPublished 19 Jul 2025, 00:32 WIB

CVE-2025-7796

Tenda FH451 PPTPDClient fromPptpUserAdd stack-based overflow

A vulnerability, which was classified as critical, was found in Tenda FH451 1.0.0.9. This affects the function fromPptpUserAdd of the file /goform/PPTPDClient. The manipulation of the argument Username leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:32:06.712Z. Updated 2025-07-18T18:17:41.360Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Jul 2025, 01:17 WIB

Official record

HighPublished 19 Jul 2025, 00:14 WIB

CVE-2025-7795

Tenda FH451 P2pListFilter fromP2pListFilter stack-based overflow

A vulnerability, which was classified as critical, has been found in Tenda FH451 1.0.0.9. Affected by this issue is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:14:07.333Z. Updated 2025-07-18T17:32:26.766Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Jul 2025, 00:32 WIB

Official record

LowPublished 19 Jul 2025, 00:10 WIB

CVE-2025-53901

Wasmtime has host panic with `fd_renumber` WASIp1 function

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host (embedder). The specific bug is triggered by calling `path_open` after calling `fd_renumber` with eit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:10:11.815Z. Updated 2025-07-18T17:31:45.514Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated19 Jul 2025, 00:31 WIB

Official record

HighPublished 19 Jul 2025, 00:04 WIB

CVE-2025-53762

Microsoft Purview Elevation of Privilege Vulnerability

Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:04:46.626Z. Updated 2026-02-26T17:50:27.077Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

CritPublished 19 Jul 2025, 00:04 WIB

CVE-2025-47158

Azure DevOps Server Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:04:45.914Z. Updated 2026-02-26T17:50:27.379Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 19 Jul 2025, 00:04 WIB

CVE-2025-47995

Azure Machine Learning Elevation of Privilege Vulnerability

Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:04:45.394Z. Updated 2026-02-26T17:50:27.735Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

CritPublished 19 Jul 2025, 00:04 WIB

CVE-2025-49746

Azure Machine Learning Elevation of Privilege Vulnerability

Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:04:44.617Z. Updated 2026-02-26T17:50:28.125Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

CritPublished 19 Jul 2025, 00:04 WIB

CVE-2025-49747

Azure Machine Learning Elevation of Privilege Vulnerability

Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:04:44.003Z. Updated 2026-02-26T17:50:28.430Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record