Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1461–1480 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9187

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:57.516Z. Updated 2026-04-13T14:29:49.002Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:29 WIB

Official record

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9183

Spoofing issue in the Address Bar component

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:57.019Z. Updated 2026-04-13T14:28:39.668Z.

CVSS—

Showing 1461 to 1480 of 3629.First page Next page

KEVNot listed

EPSSPresent

Updated13 Apr 2026, 21:28 WIB

Official record

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9182

Denial-of-service due to out-of-memory in the Graphics: WebRender component

Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:56.512Z. Updated 2026-04-13T14:28:37.915Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:28 WIB

Official record

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9186

Spoofing issue in the Address Bar component of Firefox Focus for Android

Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:56.025Z. Updated 2026-04-13T14:29:47.345Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:29 WIB

Official record

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9185

Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:55.556Z. Updated 2026-04-13T14:25:52.926Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:25 WIB

Official record

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9181

Uninitialized memory in the JavaScript Engine component

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:55.063Z. Updated 2026-04-13T14:25:51.187Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:25 WIB

Official record

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9180

Same-origin policy bypass in the Graphics: Canvas2D component

Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:54.532Z. Updated 2026-04-13T14:25:49.457Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:25 WIB

Official record

UnscoredPublished 20 Aug 2025, 03:33 WIB

CVE-2025-9179

Sandbox escape due to invalid pointer in the Audio/Video: GMP component

An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:33:53.949Z. Updated 2026-04-13T14:25:47.601Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Apr 2026, 21:25 WIB

Official record

MedPublished 20 Aug 2025, 03:32 WIB

CVE-2025-9167

SolidInvoice Recurring Invoice recurring cross site scripting

A vulnerability has been found in SolidInvoice up to 2.4.0. This vulnerability affects unknown code of the file /invoice/recurring of the component Recurring Invoice Module. The manipulation of the argument client name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:32:06.486Z. Updated 2025-08-20T15:19:05.039Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:19 WIB

Official record

LowPublished 20 Aug 2025, 03:02 WIB

CVE-2025-9165

LibTIFF tiffcmp tiffcmp.c InitCCITTFax3 memory leak

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. This attack is characterized by high complexi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:02:13.694Z. Updated 2025-10-01T15:25:44.426Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2025, 22:25 WIB

Official record

MedPublished 20 Aug 2025, 03:02 WIB

CVE-2025-9157

appneta tcpreplay tcprewrite edit_packet.c untrunc_packet use after free

A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_packet of the file src/tcpedit/edit_packet.c of the component tcprewrite. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T20:02:08.552Z. Updated 2025-08-19T20:32:45.294Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 03:32 WIB

Official record

MedPublished 20 Aug 2025, 02:52 WIB

CVE-2025-55740

Default Credentials in nginx-defender Configuration Files

nginx-defender is a high-performance, enterprise-grade Web Application Firewall (WAF) and threat detection system engineered for modern web infrastructure. This is a configuration vulnerability affecting nginx-defender deployments. Example configuration files config.yaml and docker-compose.yml contain default credentia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:52:25.777Z. Updated 2025-08-19T20:05:46.786Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 03:05 WIB

Official record

MedPublished 20 Aug 2025, 02:34 WIB

CVE-2025-43744

CVE-2025-43744

A stored DOM-based Cross-Site Scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and 7.4 GA through updat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:34:31.861Z. Updated 2025-08-20T14:14:39.334Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 21:14 WIB

Official record

MedPublished 20 Aug 2025, 02:32 WIB

CVE-2025-9156

itsourcecode Sports Management System sports.php sql injection

A vulnerability was found in itsourcecode Sports Management System 1.0. The affected element is an unknown function of the file /Admin/sports.php. Performing manipulation of the argument code results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:32:10.183Z. Updated 2025-08-19T19:50:57.648Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:50 WIB

Official record

MedPublished 20 Aug 2025, 02:32 WIB

CVE-2025-9155

itsourcecode Online Tour and Travel Management System forget_password.php sql injection

A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Impacted is an unknown function of the file /user/forget_password.php. Such manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:32:07.042Z. Updated 2025-08-19T19:45:32.987Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:45 WIB

Official record

LowPublished 20 Aug 2025, 02:15 WIB

CVE-2025-2988

IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.4, and 6.2.1.0 could disclose sensitive server information to an unauthorized user that could aid in further attacks against the system.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:15:58.525Z. Updated 2025-08-19T19:35:55.065Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:35 WIB

Official record

MedPublished 20 Aug 2025, 02:13 WIB

CVE-2025-43743

CVE-2025-43743

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by allowing them to enumera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:13:39.205Z. Updated 2025-08-19T19:31:07.596Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:31 WIB

Official record

MedPublished 20 Aug 2025, 02:06 WIB

CVE-2025-55737

flaskBlog arbitrary comment delete

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:06:15.195Z. Updated 2025-08-19T19:27:18.828Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:27 WIB

Official record

CritPublished 20 Aug 2025, 02:04 WIB

CVE-2025-55736

flaskBlog allows arbitrary privilege escalation

flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:04:00.564Z. Updated 2025-08-19T19:29:09.500Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:29 WIB

Official record

MedPublished 20 Aug 2025, 02:03 WIB

CVE-2025-33008

IBM Sterling B2B Integrator and IBM Sterling File Gateway cross-site scripting

IBM Sterling B2B Integrator 6.2.1.0 and IBM Sterling File Gateway 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T19:03:36.978Z. Updated 2025-08-19T19:48:02.651Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:48 WIB

Official record