Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1541–1560 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40183

bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6}

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} Cilium has a BPF egress gateway feature which forces outgoing K8s Pod traffic to pass through dedicated egress gateways which then SNAT the traffic in order to interact with stable IPs outside th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:27.429Z. Updated 2026-10-15T22:02:39.850Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40182

crypto: skcipher - Fix reqsize handling

In the Linux kernel, the following vulnerability has been resolved: crypto: skcipher - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to crypto_alg") introduced cra_reqsize field in crypto_alg struct to replace type specific reqsize fields. It looks like this was introduced specifically for aha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1541 to 1560 of 3020.First page Next page

Published 2025-11-12T21:56:26.699Z. Updated 2026-08-05T12:08:22.418Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record

UnscoredPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40181

x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forced variable MTRR rang…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:25.930Z. Updated 2026-05-11T21:44:19.679Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:44 WIB

Official record

UnscoredPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40180

mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

In the Linux kernel, the following vulnerability has been resolved: mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop The cleanup loop was starting at the wrong array index, causing out-of-bounds access. Start the loop at the correct index for zero-indexed arrays to prevent accessing memory beyond…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:25.395Z. Updated 2026-10-21T12:37:52.756Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

UnscoredPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40179

ext4: verify orphan file size is not too big

In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan files can lead to bi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:24.882Z. Updated 2026-05-11T21:44:17.422Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:44 WIB

Official record

UnscoredPublished 13 Nov 2025, 04:56 WIB

CVE-2025-40178

pid: Add a judgment for ns null in pid_nr_ns

In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current); pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) { Sometimes null is return…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:56:24.051Z. Updated 2026-05-11T21:44:16.295Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:44 WIB

Official record

HighPublished 13 Nov 2025, 04:40 WIB

CVE-2025-64500

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Starting in version 2.0.0 and prior to version 5.4.50, 6.4.29, and 7.3.7, the `Request` class improperly interprets some `PATH…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:40:57.738Z. Updated 2025-11-13T16:50:55.341Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:50 WIB

Official record

MedPublished 13 Nov 2025, 04:37 WIB

CVE-2025-64482

Tuleap missing CSRF protections in the File Release System

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 don't have cross-site request forgery protections in the file release system. An att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:37:25.220Z. Updated 2025-11-13T16:47:39.188Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:47 WIB

Official record

MedPublished 13 Nov 2025, 04:32 WIB

CVE-2025-64429

DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or IVs. When clearing ke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:32:45.663Z. Updated 2025-11-13T16:45:43.375Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:45 WIB

Official record

LowPublished 13 Nov 2025, 04:25 WIB

CVE-2025-64345

Wasmtime provides unsound API access to a WebAssembly shared linear memory

Wasmtime is a runtime for WebAssembly. Prior to version 38.0.4, 37.0.3, 36.0.3, and 24.0.5, Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host (Rust) to the contents of the linear memory. This is not soun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:25:50.832Z. Updated 2025-11-12T21:40:37.909Z.

CVSS1.8v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:40 WIB

Official record

MedPublished 13 Nov 2025, 04:19 WIB

CVE-2025-33119

IBM QRadar SIEM Information Disclosure

IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:19:55.966Z. Updated 2025-11-13T15:03:22.671Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 22:03 WIB

Official record

MedPublished 13 Nov 2025, 04:04 WIB

CVE-2025-36223

IBM OpenPages Host Header Injection

IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:04:45.915Z. Updated 2025-11-13T15:03:56.553Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 22:03 WIB

Official record

MedPublished 13 Nov 2025, 04:02 WIB

CVE-2025-13063

DinukaNavaratna Dee Store authorization

A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack may be performed from remote. The exploit has been published and may be used. Multiple endpoints are affected.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T21:02:07.581Z. Updated 2025-11-13T14:18:20.215Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 21:18 WIB

Official record

HighPublished 13 Nov 2025, 03:34 WIB

CVE-2025-64186

Evervault Go SDK: Incomplete PCR Validation in Enclave Attestation for non-Evervault hosted Enclaves

Evervault is a payment security solution. A vulnerability was identified in the `evervault-go` SDK’s attestation verification logic in versions of `evervault-go` prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not meet expected inte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T20:34:04.321Z. Updated 2025-11-14T17:40:17.728Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated15 Nov 2025, 00:40 WIB

Official record

MedPublished 13 Nov 2025, 03:32 WIB

CVE-2025-13061

itsourcecode Online Voting System index.php unrestricted upload

A vulnerability was detected in itsourcecode Online Voting System 1.0. This impacts an unknown function of the file /index.php?page=manage_voting. Performing manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T20:32:07.008Z. Updated 2025-11-14T16:54:35.124Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Nov 2025, 23:54 WIB

Official record

LowPublished 13 Nov 2025, 03:30 WIB

CVE-2025-64170

sudo-rs: Partial password reveal is possible after timeout

sudo-rs is a memory safe implementation of sudo and su written in Rust. Starting in version 0.2.7 and prior to version 0.2.10, if a user begins entering a password but does not press return for an extended period, a password timeout may occur. When this happens, the keystrokes that were entered are echoed back to the c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T20:30:14.961Z. Updated 2025-11-14T17:34:21.165Z.

CVSS3.8v3.1KEVNot listedEPSSPresentUpdated15 Nov 2025, 00:34 WIB

Official record

CritPublished 13 Nov 2025, 03:12 WIB

CVE-2025-46608

CVE-2025-46608

Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability is considered Critical, as it may result in unauthorized access with ele…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T20:12:59.795Z. Updated 2025-11-13T21:23:27.791Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Nov 2025, 04:23 WIB

Official record

MedPublished 13 Nov 2025, 03:02 WIB

CVE-2025-13060

SourceCodester Survey Application System view_survey.php sql injection

A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /view_survey.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T20:02:09.533Z. Updated 2025-11-14T17:31:19.516Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Nov 2025, 00:31 WIB

Official record

MedPublished 13 Nov 2025, 03:02 WIB

CVE-2025-13059

SourceCodester Alumni Management System manage_career.php sql injection

A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T20:02:06.864Z. Updated 2025-11-14T17:33:12.976Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Nov 2025, 00:33 WIB

Official record

HighPublished 13 Nov 2025, 03:01 WIB

CVE-2025-46427

CVE-2025-46427

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T20:01:32.594Z. Updated 2026-02-26T16:57:08.324Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record