Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1461–1480 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

HighPublished 19 Jul 2025, 00:02 WIB

CVE-2025-7794

Tenda FH451 NatStaticSetting fromNatStaticSetting stack-based overflow

A vulnerability classified as critical was found in Tenda FH451 1.0.0.9. Affected by this vulnerability is the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T17:02:07.410Z. Updated 2025-07-18T17:52:20.428Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Jul 2025, 00:52 WIB

Official record

CritPublished 18 Jul 2025, 23:34 WIB

CVE-2025-7783

Usage of unsafe random function in form-data for choosing boundary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T16:34:44.889Z. Updated 2025-11-03T20:07:41.307Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:07 WIB

Official record

HighPublished 18 Jul 2025, 23:32 WIB

CVE-2025-7793

Tenda FH451 webtypelibrary formWebTypeLibrary stack-based overflow

A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary. The manipulation of the argument webSiteId leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T16:32:06.924Z. Updated 2025-07-22T15:12:00.445Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:12 WIB

Official record

HighPublished 18 Jul 2025, 23:14 WIB

CVE-2025-7792

Tenda FH451 SafeEmailFilter formSafeEmailFilter stack-based overflow

A vulnerability was found in Tenda FH451 1.0.0.9. It has been rated as critical. This issue affects the function formSafeEmailFilter of the file /goform/SafeEmailFilter. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T16:14:07.229Z. Updated 2025-07-22T15:13:06.030Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:13 WIB

Official record

CritPublished 18 Jul 2025, 22:56 WIB

CVE-2025-54079

WeGIA vulnerable to SQL Injection (Blind Time-Based) in endpoint 'Profile_Atendido.php' parameter 'idatendido'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the endpoint `/html/atendido/Profile_Atendido.php`, in the `idatendido` parameter. This vulnerability allow an authorized attacker to execut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:56:58.077Z. Updated 2025-07-18T16:19:04.939Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 23:19 WIB

Official record

MedPublished 18 Jul 2025, 22:55 WIB

CVE-2025-54078

WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao_imagem.php' parameter 'err'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.4.6 in the `personalizacao_imagem.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject mali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:55:59.064Z. Updated 2025-07-18T16:14:01.157Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 23:14 WIB

Official record

MedPublished 18 Jul 2025, 22:53 WIB

CVE-2025-54077

WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao.php' parameter 'err'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.4.6 in the `personalizacao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:53:12.103Z. Updated 2025-07-22T15:13:46.583Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:13 WIB

Official record

MedPublished 18 Jul 2025, 22:50 WIB

CVE-2025-54076

WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'pre_cadastro_atendido.php' parameter 'msg_e'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.4.6 in the `pre_cadastro_atendido.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject mali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:50:56.868Z. Updated 2025-07-22T15:14:21.268Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:14 WIB

Official record

HighPublished 18 Jul 2025, 22:47 WIB

CVE-2025-54075

mdc vulnerable to XSS in markdown rendering bypassing HTML filter. (N°4)

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to version 0.17.2, a remote script-inclusion / stored cross-site scripting vulnerability in @nuxtjs/mdc lets a Markdown author inject a `<base href="https://attacker.tld">` element. The `<base>` tag rewrites how al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:47:38.236Z. Updated 2025-07-22T15:14:53.051Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:14 WIB

Official record

HighPublished 18 Jul 2025, 22:45 WIB

CVE-2025-54073

mcp-package-docs vulnerable to command injection in several tools

mcp-package-docs is an MCP (Model Context Protocol) server that provides LLMs with efficient access to package documentation across multiple programming languages and language server protocol (LSP) capabilities. A command injection vulnerability exists in the `mcp-package-docs` MCP Server prior to the fix in commit cb4…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:45:09.114Z. Updated 2025-07-22T18:31:13.962Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Jul 2025, 01:31 WIB

Official record

MedPublished 18 Jul 2025, 22:44 WIB

CVE-2025-7791

PHPGurukul Online Security Guards Hiring System search.php cross site scripting

A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack can be initiated remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:44:06.774Z. Updated 2025-07-22T15:04:27.442Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:04 WIB

Official record

MedPublished 18 Jul 2025, 22:40 WIB

CVE-2025-54059

melange creates SBOM files in APKs with world-writable permissions

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:40:43.277Z. Updated 2025-07-18T16:04:30.154Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 23:04 WIB

Official record

HighPublished 18 Jul 2025, 22:35 WIB

CVE-2025-53945

apko has incorrect permission (0666) in /etc/ld.so.cache and other files

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:35:17.325Z. Updated 2025-07-22T15:03:42.966Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:03 WIB

Official record

MedPublished 18 Jul 2025, 22:32 WIB

CVE-2025-53888

RIOT-OS has an ineffective size check that can lead to buffer overflow in link layer address filter /sys/net/link_layer/l2filter/l2filter.c

RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in versions up to and including 2025.04. Assertions are usually compiled out in production builds. If assertions are the only defense against untrusted inputs, the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:32:15.856Z. Updated 2025-07-18T15:47:07.789Z.

CVSS6.6v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 22:47 WIB

Official record

HighPublished 18 Jul 2025, 22:32 WIB

CVE-2025-7790

D-Link DI-8100 HTTP Request menu_nat.asp stack-based overflow

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been classified as critical. This affects an unknown part of the file /menu_nat.asp of the component HTTP Request Handler. The manipulation of the argument out_addr/in_addr/out_port/proto leads to stack-based buffer overflow. It is possible to initiate the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:32:06.709Z. Updated 2025-07-22T15:02:15.795Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:02 WIB

Official record

MedPublished 18 Jul 2025, 22:14 WIB

CVE-2025-7789

Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insufficient computational …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:14:05.920Z. Updated 2025-07-18T15:28:47.143Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 22:28 WIB

Official record

MedPublished 18 Jul 2025, 22:05 WIB

CVE-2025-46732

OpenCTI's GraphQL IDOR enables authenticated users to modify or delete notifications of other users

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQL `NotificationLineNotificationMarkReadMutation` and `NotificationLineNotificationDeleteMutation` mutations of OpenCTI allows an authenticated user to change the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:05:11.435Z. Updated 2025-07-18T15:24:49.537Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 22:24 WIB

Official record

MedPublished 18 Jul 2025, 22:02 WIB

CVE-2025-7788

Xuxueli xxl-job SampleXxlJob.java commandJobHandler os command injection

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to os command injection. The attack can be launched remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T15:02:05.770Z. Updated 2025-07-18T16:57:40.388Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 23:57 WIB

Official record

MedPublished 18 Jul 2025, 21:14 WIB

CVE-2025-7787

Xuxueli xxl-job SampleXxlJob.java httpJobHandler server-side request forgery

A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T14:14:05.692Z. Updated 2025-07-18T14:55:54.873Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 21:55 WIB

Official record

MedPublished 18 Jul 2025, 21:01 WIB

CVE-2024-13175

IDOR in Vidco Software's VOC TESTER

Authorization Bypass Through User-Controlled Key vulnerability in Vidco Software VOC TESTER allows Forceful Browsing. This issue affects VOC TESTER: before 12.41.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T14:01:13.242Z. Updated 2026-06-01T12:32:50.127Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:32 WIB

Official record

Showing 1461 to 1480 of 3774.First page Next page