Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1481–1500 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 18 Jul 2025, 20:48 WIB

CVE-2025-7784

Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)

A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T13:48:45.713Z. Updated 2026-05-06T16:48:58.281Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated06 May 2026, 23:48 WIB

Official record

MedPublished 18 Jul 2025, 20:14 WIB

CVE-2025-7786

Gnuboard g6 Post Reply qa cross site scripting

A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/scrap_popin_update/qa/ of the component Post Reply Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1481 to 1500 of 3774.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T13:14:05.648Z. Updated 2025-07-18T13:39:57.109Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 20:39 WIB

Official record

MedPublished 18 Jul 2025, 18:44 WIB

CVE-2025-7785

thinkgem JeeSite SsoController.java sso redirect

A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com/jeesite/modules/sys/web/SsoController.java. The manipulation of the argument redirect leads to open redirect. The attack can be initiated remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T11:44:07.100Z. Updated 2025-07-18T13:43:05.675Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 20:43 WIB

Official record

LowPublished 18 Jul 2025, 18:39 WIB

CVE-2025-6227

Invite token is used as part of the secure communication

Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T11:39:46.005Z. Updated 2025-07-18T13:44:00.998Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 20:44 WIB

Official record

HighPublished 18 Jul 2025, 16:51 WIB

CVE-2025-49484

Extension - joomsky.com - SQL injection in JS jobs component version 1.1.5 - 1.4.1 for Joomla

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:51:44.430Z. Updated 2025-09-30T04:36:47.498Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 11:36 WIB

Official record

MedPublished 18 Jul 2025, 16:51 WIB

CVE-2025-50126

Extension - rsjoomla.com - Stored XSS vulnerability RSBlog! component 1.11.6-1.14.5 for Joomla

A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jform[tags_text] parameter.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:51:40.624Z. Updated 2025-07-23T11:15:47.083Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Jul 2025, 18:15 WIB

Official record

MedPublished 18 Jul 2025, 16:51 WIB

CVE-2025-50058

Extension - rsjoomla.com - Stored XSS vulnerability in RSDirectory! component 1.16.3-1.17.7 for Joomla

A stored XSS vulnerability in the RSDirectory! component 1.0.0-2.2.8 Joomla was discovered. The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the review reply component.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:51:29.223Z. Updated 2025-07-20T08:53:01.792Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Jul 2025, 15:53 WIB

Official record

MedPublished 18 Jul 2025, 16:51 WIB

CVE-2025-50057

Extension - rsjoomla.com - DOS vulnerability RSFiles! component 1.16.3-1.17.7 for Joomla

A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered. The issue allows unauthenticated remote attackers to deny access to service via the search feature.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:51:13.428Z. Updated 2025-07-20T08:52:57.388Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Jul 2025, 15:52 WIB

Official record

MedPublished 18 Jul 2025, 16:51 WIB

CVE-2025-50056

Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.28 for Joomla

A reflected XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 28 Joomla was discovered. The issue allows remote attackers to inject arbitrary web script or HTML via the crafted parameter.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:51:05.217Z. Updated 2025-07-20T08:52:55.141Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Jul 2025, 15:52 WIB

Official record

HighPublished 18 Jul 2025, 16:51 WIB

CVE-2025-49485

Extension - balbooa.com - SQL injection in Balbooa Forms component version 1.0.0 - 2.3.1.1 for Joomla

A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' parameter.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:51:01.943Z. Updated 2025-07-20T08:52:54.225Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated20 Jul 2025, 15:52 WIB

Official record

HighPublished 18 Jul 2025, 16:50 WIB

CVE-2025-49486

Extension - balbooa.com - Stored XSS in Balbooa Gallery component version 1.0.0 - 2.4.0 for Joomla

A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:50:54.958Z. Updated 2025-07-20T08:52:51.440Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated20 Jul 2025, 15:52 WIB

Official record

MedPublished 18 Jul 2025, 16:20 WIB

CVE-2025-2425

TOCTOU race condition vulnerability in ESET products on Windows

Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of an arbitrary file on the file system.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:20:52.051Z. Updated 2025-07-18T11:37:03.044Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 18:37 WIB

Official record

MedPublished 18 Jul 2025, 16:09 WIB

CVE-2025-6233

Arbitrary file read by system admin via path traversal

Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T09:09:22.809Z. Updated 2025-07-18T12:30:35.494Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 19:30 WIB

Official record

MedPublished 18 Jul 2025, 15:48 WIB

CVE-2025-6226

IDOR in CreatePost API allows for timeboxed message disclosure

Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels they don't have access to via guessing the PendingPostID of recently created posts.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T08:48:02.717Z. Updated 2025-08-07T09:53:06.698Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated07 Aug 2025, 16:53 WIB

Official record

CritPublished 18 Jul 2025, 15:22 WIB

CVE-2025-7444

LoginPress Pro <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T08:22:39.012Z. Updated 2026-04-08T17:03:40.061Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:03 WIB

Official record

MedPublished 18 Jul 2025, 15:08 WIB

CVE-2024-32124

CVE-2024-32124

An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authenticated read-only attacker to alter logs via a crafted HTTP request.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T08:08:21.544Z. Updated 2025-07-18T13:45:22.747Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 20:45 WIB

Official record

MedPublished 18 Jul 2025, 14:58 WIB

CVE-2024-27779

CVE-2024-27779

An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T07:58:23.943Z. Updated 2026-02-26T17:50:28.774Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 18 Jul 2025, 14:53 WIB

CVE-2025-38349

eventpoll: don't decrement ep refcount while still holding the ep mutex

In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. That's very wrong, because it can lead to a use-after-f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T07:53:16.434Z. Updated 2026-10-03T10:55:26.241Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated03 Oct 2026, 17:55 WIB

Official record

MedPublished 18 Jul 2025, 14:48 WIB

CVE-2025-6197

CVE-2025-6197

An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL

Excerpt language: en.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T07:48:22.523Z. Updated 2025-07-18T13:46:01.307Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 20:46 WIB

Official record

HighPublished 18 Jul 2025, 14:48 WIB

CVE-2025-6023

CVE-2025-6023

An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+sec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-18T07:48:15.972Z. Updated 2025-07-18T13:46:45.354Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 20:46 WIB

Official record