Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 1501–1520 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

HighPublished 24 Dec 2025, 04:04 WIB

CVE-2025-14920

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T21:04:36.809Z. Updated 2025-12-24T16:29:05.697Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 23:29 WIB

Official record

HighPublished 24 Dec 2025, 04:04 WIB

CVE-2025-14926

Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability

Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a malic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1501 to 1520 of 5493.First page Next page

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T21:04:32.162Z. Updated 2025-12-24T16:26:53.253Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 23:26 WIB

Official record

HighPublished 24 Dec 2025, 04:04 WIB

CVE-2025-14927

Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability

Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must convert a mal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T21:04:28.008Z. Updated 2025-12-24T16:26:02.865Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 23:26 WIB

Official record

HighPublished 24 Dec 2025, 04:04 WIB

CVE-2025-14921

Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T21:04:23.187Z. Updated 2025-12-24T16:25:13.340Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 23:25 WIB

Official record

HighPublished 24 Dec 2025, 04:04 WIB

CVE-2025-14929

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T21:04:15.474Z. Updated 2025-12-24T16:24:34.136Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 23:24 WIB

Official record

CritPublished 24 Dec 2025, 04:02 WIB

CVE-2025-15045

Tenda WH450 HTTP Request Natlimit stack-based overflow

A flaw has been found in Tenda WH450 1.0.0.18. The affected element is an unknown function of the file /goform/Natlimit of the component HTTP Request Handler. This manipulation of the argument page causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T21:02:09.441Z. Updated 2026-02-24T06:03:11.840Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:03 WIB

Official record

HighPublished 24 Dec 2025, 03:42 WIB

CVE-2025-11419

Keycloak: keycloak tls client-initiated renegotiation denial of service

A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T20:42:38.699Z. Updated 2026-04-20T17:45:58.307Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Apr 2026, 00:45 WIB

Official record

CritPublished 24 Dec 2025, 03:32 WIB

CVE-2025-15044

Tenda WH450 NatStaticSetting stack-based overflow

A vulnerability was detected in Tenda WH450 1.0.0.18. Impacted is an unknown function of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack may be performed from remote. The exploit is now public and may be used.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T20:32:08.664Z. Updated 2026-02-24T06:02:57.223Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:02 WIB

Official record

MedPublished 24 Dec 2025, 02:35 WIB

CVE-2021-47737

CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard

CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:35:47.888Z. Updated 2026-04-07T14:05:51.762Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:05 WIB

Official record

MedPublished 24 Dec 2025, 02:35 WIB

CVE-2021-47733

CMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding

CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:35:44.454Z. Updated 2026-04-07T14:05:51.179Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:05 WIB

Official record

MedPublished 24 Dec 2025, 02:35 WIB

CVE-2021-47716

Orangescrum 1.8.0 Cross-Site Scripting via Authenticated Endpoints

Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters like 'projid', 'CS_message', and 'name' to execute arbitrary JavaScript code in victim's browsers by submitting craft…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:35:40.507Z. Updated 2026-04-07T14:05:39.773Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:05 WIB

Official record

CritPublished 24 Dec 2025, 02:34 WIB

CVE-2023-53982

PMB 7.4.6 SQL Injection Vulnerability via Unsanitized Storage Parameter

PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information or perform time-based blind SQL injection …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:11.262Z. Updated 2026-03-05T12:03:25.985Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:03 WIB

Official record

HighPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47739

Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation via Unquoted Service Path

Epic Games Easy Anti-Cheat 4.0 contains an unquoted service path vulnerability that allows local non-privileged users to execute arbitrary code with elevated system privileges. Attackers can exploit the service configuration by inserting malicious code in the system root path that would execute with LocalSystem privile…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:10.825Z. Updated 2025-12-23T21:37:45.785Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 04:37 WIB

Official record

MedPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47738

CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:10.399Z. Updated 2026-04-07T14:05:52.492Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:05 WIB

Official record

HighPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47736

CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing

CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitrary command execution o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:09.538Z. Updated 2026-07-15T01:24:34.800Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

HighPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47735

CMSimple 5.4 Authenticated Remote Code Execution via Template Editing

CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:09.077Z. Updated 2026-03-05T12:02:27.210Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

HighPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47734

CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution

CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:08.612Z. Updated 2026-03-17T16:23:20.378Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated17 Mar 2026, 23:23 WIB

Official record

MedPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47732

CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input

CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:07.775Z. Updated 2026-04-07T14:05:50.486Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:05 WIB

Official record

MedPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47722

Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery

Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings without user interaction. Attackers can craft malicious web pages with hidden forms to disable or modify access control parameters by tricking authenticated users int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:07.307Z. Updated 2026-04-07T14:05:43.976Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:05 WIB

Official record

HighPublished 24 Dec 2025, 02:34 WIB

CVE-2021-47721

Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation

Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-23T19:34:06.849Z. Updated 2026-03-05T12:02:23.926Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record