Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1581–1600 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

HighPublished 18 Jul 2025, 02:11 WIB

CVE-2024-39289

Unsafe use of eval() method in rosparam tool

A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T19:11:07.080Z. Updated 2025-07-18T08:04:04.631Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 15:04 WIB

Official record

HighPublished 18 Jul 2025, 02:10 WIB

CVE-2025-7433

CVE-2025-7433

A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T19:10:27.251Z. Updated 2025-07-17T20:35:32.913Z.

Showing 1581 to 1600 of 3774.First page Next page

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:35 WIB

Official record

CritPublished 18 Jul 2025, 02:08 WIB

CVE-2025-23266

CVE-2025-23266

NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary code with elevated permissions. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and den…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T19:08:21.352Z. Updated 2026-02-26T17:50:29.124Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 18 Jul 2025, 02:02 WIB

CVE-2024-13972

CVE-2024-13972

A vulnerability related to registry permissions in the Intercept X for Windows updater prior to Core Agent version 2024.3.2 can lead to a local user gaining SYSTEM level privileges during a product upgrade.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T19:02:36.400Z. Updated 2025-08-03T08:58:17.751Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated03 Aug 2025, 15:58 WIB

Official record

MedPublished 18 Jul 2025, 02:02 WIB

CVE-2025-7750

code-projects Online Appointment Booking System adddoctorclinic.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the file /admin/adddoctorclinic.php. The manipulation of the argument clinic leads to sql injection. It is possible to launch the attack remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T19:02:05.827Z. Updated 2025-07-17T20:30:06.506Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:30 WIB

Official record

HighPublished 18 Jul 2025, 01:53 WIB

CVE-2025-7472

CVE-2025-7472

A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges, if the installer is run as SYSTEM.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T18:53:29.947Z. Updated 2025-07-17T20:29:02.189Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:29 WIB

Official record

MedPublished 18 Jul 2025, 01:25 WIB

CVE-2025-54070

OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the `lastIndexOf(bytes,byte,uint256)` function of the `Bytes.sol` library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T18:25:02.492Z. Updated 2025-07-17T20:28:13.310Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:28 WIB

Official record

CritKEVPublished 18 Jul 2025, 01:16 WIB

CVE-2025-54068

Livewire vulnerable to remote command execution during property update hydration

Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote command execution in specific scenarios. The issue stems from how certain component property updates are hydrated. This vulnerability is unique to Livewire v3 and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-07-17T18:16:56.099Z. Updated 2026-03-23T13:04:50.156Z.

CVSS9.2v4.0KEVListedEPSSPresentUpdated23 Mar 2026, 20:04 WIB

Official record

MedPublished 18 Jul 2025, 01:12 WIB

CVE-2025-53817

GHSL-2025-059 - 7-Zip - Null pointer array write attempt in NArchive::NCom::CHandler::GetStream

7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference in the Compound handler may lead to denial of service. Version 25.0.0 contains a fix cor the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T18:12:24.553Z. Updated 2025-11-04T21:12:38.546Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:12 WIB

Official record

MedPublished 18 Jul 2025, 01:09 WIB

CVE-2025-53816

GHSL-2025-058 - 7-Zip Multi-byte write heap buffer overflow in NCompress::NRar5::CDecoder

7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service in versions of 7-Zip prior to 25.0.0. Version 25.0.0 contains a fix for the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T18:09:58.480Z. Updated 2026-05-11T16:53:20.506Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated11 May 2026, 23:53 WIB

Official record

MedPublished 18 Jul 2025, 01:02 WIB

CVE-2025-7749

code-projects Online Appointment Booking System getmanagerregion.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Online Appointment Booking System 1.0. This issue affects some unknown processing of the file /admin/getmanagerregion.php. The manipulation of the argument city leads to sql injection. The attack may be initiated remotely. The exploit ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T18:02:05.938Z. Updated 2025-07-17T20:23:58.963Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:23 WIB

Official record

MedPublished 18 Jul 2025, 00:58 WIB

CVE-2025-53644

OpenCV contains a use after free buffer write due to an uninitialized pointer

OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T17:58:26.493Z. Updated 2025-09-26T21:56:54.102Z.

CVSS6.6v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 04:56 WIB

Official record

MedPublished 18 Jul 2025, 00:54 WIB

CVE-2025-53638

Solady lacks extcodesize validation on implementation in ERC4337Factory

Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy, using regular Solidity to call its initialization function may result in a silent failure, if the initialization function does not return a `bool` or some other…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T17:54:40.666Z. Updated 2025-07-17T20:22:29.683Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:22 WIB

Official record

MedPublished 18 Jul 2025, 00:32 WIB

CVE-2025-7748

ZCMS Create Article Page cross site scripting

A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article Page. The manipulation of the argument Title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T17:32:06.646Z. Updated 2025-07-17T19:13:58.471Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 02:13 WIB

Official record

HighPublished 18 Jul 2025, 00:19 WIB

CVE-2025-23263

CVE-2025-23263

NVIDIA DOCA-Host and Mellanox OFED contain a vulnerability in the VGT+ feature, where an attacker on a VM might cause escalation of privileges and denial of service on the VLAN.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T17:19:50.542Z. Updated 2025-07-24T20:08:57.395Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated25 Jul 2025, 03:08 WIB

Official record

HighPublished 18 Jul 2025, 00:14 WIB

CVE-2025-7747

Tenda FH451 POST Request WizardHandle fromWizardHandle buffer overflow

A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. The manipulation of the argument PPW leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T17:14:09.386Z. Updated 2025-07-17T19:14:07.071Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Jul 2025, 02:14 WIB

Official record

LowPublished 17 Jul 2025, 22:47 WIB

CVE-2025-7339

on-headers vulnerable to http response header manipulation

on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`. Users should upgrade to version 1.1.0 to receive a patch. Uses are strongly encouraged …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T15:47:39.680Z. Updated 2025-07-17T20:24:47.447Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:24 WIB

Official record

HighPublished 17 Jul 2025, 22:26 WIB

CVE-2025-7338

Multer vulnerable to Denial of Service via unhandled exception from malformed request

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T15:26:45.427Z. Updated 2025-07-17T16:48:43.154Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Jul 2025, 23:48 WIB

Official record

CritKEVPublished 17 Jul 2025, 22:10 WIB

CVE-2025-25257

CVE-2025-25257

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-07-17T15:10:04.532Z. Updated 2026-02-26T17:50:29.556Z.

CVSS9.6v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 17 Jul 2025, 21:44 WIB

CVE-2025-54066

DiracX-Web login page has Open Redirect vulnerability

DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a `redirect` field which is the location where …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-17T14:44:27.982Z. Updated 2025-07-17T20:03:49.445Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated18 Jul 2025, 03:03 WIB

Official record