Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1561–1580 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 13 Nov 2025, 02:57 WIB

CVE-2025-46428

CVE-2025-46428

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:57:04.843Z. Updated 2026-02-26T16:57:08.864Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

MedPublished 13 Nov 2025, 02:50 WIB

CVE-2024-48829

CVE-2024-48829

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:50:02.934Z. Updated 2026-02-26T16:57:09.412Z.

Showing 1561 to 1580 of 3020.First page Next page

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

MedPublished 13 Nov 2025, 02:32 WIB

CVE-2025-13058

soerennb eXtplorer Filename cross site scripting

A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. The affected element is an unknown function of the component Filename Handler. The manipulation results in cross site scripting. The attack may be launched remotely. The patch is identified as 002def70b985f7012586df2c44368845bf405ab3. Applying a pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:32:06.630Z. Updated 2026-02-24T06:26:50.944Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:26 WIB

Official record

HighPublished 13 Nov 2025, 02:19 WIB

CVE-2025-12048

CVE-2025-12048

An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the affected system.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:19:05.108Z. Updated 2025-11-12T21:03:22.396Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:03 WIB

Official record

MedPublished 13 Nov 2025, 02:18 WIB

CVE-2025-12047

CVE-2025-12047

A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to disclose sensitive user files from the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:18:57.396Z. Updated 2025-11-12T21:03:27.695Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:03 WIB

Official record

HighPublished 13 Nov 2025, 02:18 WIB

CVE-2025-10495

CVE-2025-10495

A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker on the same logical network to execute arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:18:44.859Z. Updated 2026-02-26T16:57:09.944Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

HighPublished 13 Nov 2025, 02:18 WIB

CVE-2025-8485

CVE-2025-8485

An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:18:28.696Z. Updated 2025-11-12T21:03:39.691Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:03 WIB

Official record

MedPublished 13 Nov 2025, 02:17 WIB

CVE-2025-8421

CVE-2025-8421

An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with elevated privileges.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:17:59.562Z. Updated 2025-11-12T21:03:45.571Z.

CVSS5.2v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:03 WIB

Official record

MedPublished 13 Nov 2025, 02:12 WIB

CVE-2025-64117

Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of SVN commit rules and im…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:12:42.405Z. Updated 2025-11-12T21:36:36.884Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:36 WIB

Official record

MedPublished 13 Nov 2025, 02:11 WIB

CVE-2025-27368

IBM OpenPages Information Disclosure

IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond what the user is inten…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T19:11:10.308Z. Updated 2025-11-12T21:03:57.566Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:03 WIB

Official record

HighPublished 13 Nov 2025, 01:57 WIB

CVE-2025-64099

OpenAM allows use of arbitrary OIDC requested claims values in id_token and user_info

Open Access Management (OpenAM) is an access management solution. In versions prior to 16.0.0, if the "claims_parameter_supported" parameter is activated, it is possible, thanks to the "oidc-claims-extension.groovy" script, to inject the value of one's choice into a claim contained in the id_token or in the user_info. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T18:57:34.036Z. Updated 2025-11-12T21:04:04.048Z.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:04 WIB

Official record

HighPublished 13 Nov 2025, 01:50 WIB

CVE-2025-61667

Datadog Linux Host Agent affected by local privilege escalation due to insufficient pycache permissions

The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this direct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T18:50:02.940Z. Updated 2025-11-12T21:04:11.852Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:04 WIB

Official record

LowPublished 13 Nov 2025, 01:46 WIB

CVE-2025-57812

[BIGSLEEP-434612419] CUPS-Filters has heap-buffer-overflow write in `cfImageLut()`

CUPS is a standards-based, open-source printing system, and `libcupsfilters` contains the code of the filters of the former `cups-filters` package as library functions to be used for the data format conversion tasks needed in Printer Applications. In CUPS-Filters versions up to and including 1.28.17 and libscupsfilters…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T18:46:52.801Z. Updated 2025-11-12T21:04:17.490Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:04 WIB

Official record

MedPublished 13 Nov 2025, 01:32 WIB

CVE-2025-13057

Campcodes School Fees Payment Management System ajax.php sql injection

A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_student. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T18:32:06.466Z. Updated 2026-02-24T06:26:35.835Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:26 WIB

Official record

HighPublished 13 Nov 2025, 01:28 WIB

CVE-2024-47866

RGW DoS attack with empty HTTP header in S3 object copy

Ceph is a distributed object, block, and file storage platform. In versions up to and including 19.2.3, using the argument `x-amz-copy-source` to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack. As of time of publication, no known patched versions …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T18:28:18.545Z. Updated 2025-12-11T15:35:30.968Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated11 Dec 2025, 22:35 WIB

Official record

MedPublished 13 Nov 2025, 01:26 WIB

CVE-2024-45301

ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability

Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a file in a specific path. It is triggered by simply printing them out on bash. An attacker can specify an arbitrary network path, negotiate an ntlm hash out of the v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T18:26:34.904Z. Updated 2025-11-12T21:04:28.538Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:04 WIB

Official record

MedPublished 13 Nov 2025, 00:41 WIB

CVE-2025-25236

CVE-2025-25236

Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. A malicious actor may be able to enumerate sensitive information such as tenant ID and user accounts that could facilitate brute-force, password-spraying or credential-stuffing attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T17:41:57.042Z. Updated 2025-11-12T21:04:33.914Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:04 WIB

Official record

LowPublished 13 Nov 2025, 00:23 WIB

CVE-2025-20379

Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using the permissions of a high…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T17:23:00.819Z. Updated 2025-11-12T21:04:40.810Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:04 WIB

Official record

LowPublished 13 Nov 2025, 00:22 WIB

CVE-2025-20378

Open Redirect on Web Login endpoint in Splunk Enterprise

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the `return_to` parameter of the Splunk Web login endpoint. When an authenticated user visits the malicious…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T17:22:56.630Z. Updated 2025-11-12T21:04:48.103Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:04 WIB

Official record

UnscoredPublished 12 Nov 2025, 23:48 WIB

CVE-2025-13042

CVE-2025-13042

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T16:48:43.925Z. Updated 2026-02-26T16:57:10.473Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record