Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1541–1560 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38569

benet: fix BUG when creating VFs

In the Linux kernel, the following vulnerability has been resolved: benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:49.987Z. Updated 2026-05-23T16:00:06.338Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:00 WIB

Official record

HighPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38568

net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing

In the Linux kernel, the following vulnerability has been resolved: net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack wr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1541 to 1560 of 3629.First page Next page

Published 2025-08-19T17:02:49.278Z. Updated 2026-08-05T12:02:57.480Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:02 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38567

nfsd: avoid ref leak in nfsd_open_local_fh()

In the Linux kernel, the following vulnerability has been resolved: nfsd: avoid ref leak in nfsd_open_local_fh() If two calls to nfsd_open_local_fh() race and both successfully call nfsd_file_acquire_local(), they will both get an extra reference to the net to accompany the file reference stored in *pnf. One of them…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:48.306Z. Updated 2026-05-23T16:00:02.280Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 23:00 WIB

Official record

CritPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38566

sunrpc: fix handling of server side tls alerts

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payloa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:42.506Z. Updated 2026-10-15T21:52:19.466Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38565

perf/core: Exit early on perf_mmap() fail

In the Linux kernel, the following vulnerability has been resolved: perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_rdpmc_allowed reference counter. But nothing undoes this as …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:41.700Z. Updated 2026-05-11T21:30:33.286Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:30 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38564

perf/core: Handle buffer mapping fail correctly in perf_mmap()

In the Linux kernel, the following vulnerability has been resolved: perf/core: Handle buffer mapping fail correctly in perf_mmap() After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:40.942Z. Updated 2026-05-11T21:30:32.112Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:30 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38563

perf/core: Prevent VMA split of buffer mappings

In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:40.249Z. Updated 2026-05-11T21:30:30.978Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:30 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38562

ksmbd: fix null pointer dereference error in generate_encryptionkey

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference error in generate_encryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey could happen. sess->Preauth_HashValue is set to NULL if se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:39.450Z. Updated 2026-05-11T21:30:29.850Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:30 WIB

Official record

CritPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38561

ksmbd: fix Preauh_HashValue race condition

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:38.719Z. Updated 2026-08-05T12:02:55.275Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:02 WIB

Official record

CritPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38560

x86/sev: Evict cache lines during SNP memory validation

In the Linux kernel, the following vulnerability has been resolved: x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:37.792Z. Updated 2026-10-15T21:52:19.327Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38559

platform/x86/intel/pmt: fix a crashlog NULL pointer access

In the Linux kernel, the following vulnerability has been resolved: platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage. Without the ep, the crashlog usage causes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:37.020Z. Updated 2026-05-11T21:30:26.261Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:30 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38558

usb: gadget: uvc: Initialize frame-based format color matching descriptor

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca ("usb: gadget: uvc: …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:36.355Z. Updated 2026-05-11T21:30:25.157Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:30 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38557

HID: apple: validate feature-report field count to prevent NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent to the device in ap…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:35.641Z. Updated 2026-05-11T21:30:23.955Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:30 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38556

HID: core: Harden s32ton() against conversion to 0 bits

In the Linux kernel, the following vulnerability has been resolved: HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:34.929Z. Updated 2026-06-11T18:44:17.332Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Jun 2026, 01:44 WIB

Official record

HighPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38555

usb: gadget : fix use-after-free in composite_dev_cleanup()

In the Linux kernel, the following vulnerability has been resolved: usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set to NULL. Then it will return a failure to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:34.110Z. Updated 2026-08-05T12:02:53.142Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:02 WIB

Official record

HighPublished 20 Aug 2025, 00:02 WIB

CVE-2025-38554

mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped

In the Linux kernel, the following vulnerability has been resolved: mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible after VMAs were allowed to be recycled by adding SLAB_TYPESAF…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:33.315Z. Updated 2026-08-05T12:02:52.067Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:02 WIB

Official record

MedPublished 20 Aug 2025, 00:02 WIB

CVE-2025-9148

CodePhiliaX Chat2DB JDBC Connection DataSourceController.java sql injection

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects an unknown function of the file ai/chat2db/server/web/api/controller/data/source/DataSourceController.java of the component JDBC Connection Handler. The manipulation results in sql injection. The attack can be executed remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:02:06.237Z. Updated 2025-08-19T20:01:27.018Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 03:01 WIB

Official record

MedPublished 19 Aug 2025, 23:58 WIB

CVE-2025-54880

Mermaid does not properly sanitize architecture diagram iconText leading to XSS

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html() method, creating a sink…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T16:58:41.120Z. Updated 2025-08-19T17:09:32.759Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 00:09 WIB

Official record

LowPublished 19 Aug 2025, 23:41 WIB

CVE-2025-54411

Discourse welcome banner user name XSS

Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T16:41:40.362Z. Updated 2025-08-19T19:17:28.269Z.

CVSS2.4v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:17 WIB

Official record

HighPublished 19 Aug 2025, 23:32 WIB

CVE-2025-52478

Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source

n8n is a workflow automation platform. From 1.77.0 to before 1.98.2, a stored Cross-Site Scripting (XSS) vulnerability was identified in n8n, specifically in the Form Trigger node's HTML form element. An authenticated attacker can inject malicious HTML via an <iframe> with a srcdoc payload that includes arbitrary JavaS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T16:32:34.949Z. Updated 2025-08-19T19:18:13.300Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 02:18 WIB

Official record