Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1501–1520 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

LowPublished 13 Nov 2025, 05:27 WIB

CVE-2025-64707

Frappe LMS revoking access did not show immediate effect as roles were cached

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, when admins revoked a role from the user, the effect was not immediate because of caching. The issue has been fixed in version 2.41.0 by ensuring the cache is cleared after roles are upd…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:27:54.937Z. Updated 2025-11-13T14:35:20.671Z.

CVSS1.2v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 21:35 WIB

Official record

LowPublished 13 Nov 2025, 05:25 WIB

CVE-2025-64705

Frappe user was able to access the submission of other students

Frappe Learning is a learning system that helps users structure their content. Starting in version 2.0.0 and prior to version 2.41.0, users were able to access the submissions made by other students The issue has been fixed in version 2.41.0 by ensuring proper roles and redirecting if accessed via direct URL.

Excerpt language: en.

Severity low: primary CNA CVSS 1.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1501 to 1520 of 3020.First page Next page

Published 2025-11-12T22:25:49.724Z. Updated 2025-11-13T14:35:25.946Z.

CVSS1.3v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 21:35 WIB

Official record

HighPublished 13 Nov 2025, 05:11 WIB

CVE-2025-64523

FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference (IDOR) vulnerability in the FileBrowser application's share deletion functionality. This vulnerability allo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:11:36.433Z. Updated 2025-11-13T14:35:31.239Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 21:35 WIB

Official record

HighPublished 13 Nov 2025, 05:10 WIB

CVE-2022-4982

DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFI

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers (`frame.html` and `frame.A100.html`) that accept a path parameter (`content` or `sidebar`) which is not properly validated or canonicalized. An attacker can supply d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:10:11.204Z. Updated 2026-04-07T14:06:26.383Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:06 WIB

Official record

HighPublished 13 Nov 2025, 05:09 WIB

CVE-2023-7326

Epson Stylus SX510W Printer Remote Power Off DoS

The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when accessing /PRESENTATION/HTML/TOP/INDEX.HTML. A remote attacker can send a malformed request that triggers improper input parsing or memory handling, resulting in the printer process…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:09:43.255Z. Updated 2026-04-07T14:08:24.790Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

CritPublished 13 Nov 2025, 05:09 WIB

CVE-2021-4464

FIberHome AN5506-04-FA / HG6245D Routers Remote Stack Overflow

FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webs') fails to enforce maximum lengths for Cookie header values. When a cookie longer than 511 bytes is processed, a stack buffer is overrun, leading to a crash o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:09:20.835Z. Updated 2025-11-21T15:36:02.534Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated21 Nov 2025, 22:36 WIB

Official record

MedPublished 13 Nov 2025, 05:08 WIB

CVE-2011-10034

IRAI AUTOMGEN <= 8.0.0.7 Use-After-Free Remote DoS

AUTOMGEN versions up to and including 8.0.0.7 (also referenced as 8.022) contain a vulnerability in that project file handling frees an object and subsequently dereferences the stale pointer when processing certain malformed fields. The dangling-pointer use enables an attacker to influence an indirect call through atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:08:59.474Z. Updated 2026-05-14T02:06:01.191Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:06 WIB

Official record

HighPublished 13 Nov 2025, 05:08 WIB

CVE-2016-15055

JVC VN-T IP-Camera Directory Traversal via check.cgi

JVC VN-T IP-camera models firmware versions up to 2016-08-22 (confirmed on the VN-T216VPRU model) contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote attacker can leverage this vulnerability to read arbitrary files on the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:08:35.468Z. Updated 2026-04-07T14:03:33.391Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

MedPublished 13 Nov 2025, 05:08 WIB

CVE-2025-64517

sudo-rs doesn't record authenticating user properly in timestamp

sudo-rs is a memory safe implementation of sudo and su written in Rust. With `Defaults targetpw` (or `Defaults rootpw`) enabled, the password of the target account (or root account) instead of the invoking user is used for authentication. sudo-rs starting in version 0.2.5 and prior to version 0.2.10 incorrectly record…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:08:29.422Z. Updated 2026-02-12T15:49:17.021Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated12 Feb 2026, 22:49 WIB

Official record

HighPublished 13 Nov 2025, 05:07 WIB

CVE-2021-4463

Longjing Technology BEMS API <= 1.21 Remote Arbitrary File Download

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the intended directory.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:07:30.512Z. Updated 2026-05-14T02:06:50.957Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:06 WIB

Official record

HighPublished 13 Nov 2025, 05:07 WIB

CVE-2023-7327

Ozeki SMS Gateway <= 10.3.208 Unauthenticated Arbitrary File Read

Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenticated attacker to use URL-encoded traversal sequences to read arbitrary files from the underlying filesystem with the privileges of the gateway service, leading to disclosure of se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:07:07.320Z. Updated 2026-04-07T14:08:25.490Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

MedPublished 13 Nov 2025, 05:06 WIB

CVE-2022-4983

TEC-IT TBarCode SDK 11.15 Remote File Create

TEC-IT TBarCode version 11.15 contains a vulnerability in the TBarCode11.ocx ActiveX/OCX control's licensing handling (INI-file based) that can be abused to cause remote creation of files on the host filesystem. Depending on where files can be created and which filenames are allowed, this can allow attackers to write f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:06:46.276Z. Updated 2025-11-13T17:02:08.347Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Nov 2025, 00:02 WIB

Official record

HighPublished 13 Nov 2025, 05:06 WIB

CVE-2023-7329

Tinycontrol LAN Controller v3 (LK3) Remote DoS

Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. A remote, unauthenticated attacker can send crafted requests to forcibly reboot the device or restore factory settings, leading to a denial of service and configurati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:06:26.619Z. Updated 2026-04-07T14:08:27.034Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

HighPublished 13 Nov 2025, 05:05 WIB

CVE-2017-20211

UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE

UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it exposes a RotateShape method that dereferences a user-supplied pointer without sufficient validation. A crafted input may cause the control to dere…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:05:57.840Z. Updated 2026-07-28T01:46:35.568Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

MedPublished 13 Nov 2025, 05:04 WIB

CVE-2025-64503

[BIGSLEEP-434615384] cups-filters 1.x: out of bounds write in pdftoraster

cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. In cups-filters prior to 1.28.18, by crafting a PDF file with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s `pdftoraster` tool to write beyond the boun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T22:04:03.750Z. Updated 2025-11-13T16:56:18.053Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:56 WIB

Official record

UnscoredPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40208

media: iris: fix module removal if firmware download failed

In the Linux kernel, the following vulnerability has been resolved: media: iris: fix module removal if firmware download failed Fix remove if firmware failed to load: qcom-iris aa00000.video-codec: Direct firmware load for qcom/vpu/vpu33_p4.mbn failed with error -2 qcom-iris aa00000.video-codec: firmware download fai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:36.261Z. Updated 2026-05-11T21:44:51.235Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:44 WIB

Official record

UnscoredPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40207

media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try() v4l2_subdev_call_state_try() macro allocates a subdev state with __v4l2_subdev_state_alloc(), but does not check the returned value. If __v4l2_subdev_state_alloc fails, it re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:35.988Z. Updated 2026-05-11T21:44:50.064Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:44 WIB

Official record

HighPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40206

netfilter: nft_objref: validate objref and objrefmap expressions

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:35.675Z. Updated 2026-10-15T22:02:40.982Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40205

btrfs: avoid potential out-of-bounds in btrfs_encode_fh()

In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the function only returns to the user BTRFS_FID_SIZE_NON_CONNE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:35.403Z. Updated 2026-10-15T22:02:40.845Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40204

sctp: Fix MAC comparison to be constant-time

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:35.110Z. Updated 2026-10-15T22:02:40.705Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record