Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1581–1600 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

MedPublished 12 Nov 2025, 23:40 WIB

CVE-2025-59089

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T16:40:50.725Z. Updated 2026-06-30T03:11:05.238Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 10:11 WIB

Official record

HighPublished 12 Nov 2025, 23:36 WIB

CVE-2025-2843

Observability-operator: observability operator privilege escalation

A flaw was found in the Observability Operator. The Operator creates a ServiceAccount with *ClusterRole* upon deployment of the *Namespace-Scoped* Custom Resource MonitorStack. This issue allows an adversarial Kubernetes Account with only namespaced-level roles, for example, a tenant controlling a namespace, to create …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1581 to 1600 of 3020.First page Next page

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T16:36:04.735Z. Updated 2026-09-21T16:03:43.822Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Sep 2026, 23:03 WIB

Official record

HighPublished 12 Nov 2025, 23:35 WIB

CVE-2025-59088

Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a D…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T16:35:27.877Z. Updated 2026-06-30T00:30:18.385Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 07:30 WIB

Official record

HighPublished 12 Nov 2025, 23:24 WIB

CVE-2025-11797

DWG File Parsing Use-After-Free Vulnerability

A maliciously crafted DWG file, when parsed through Autodesk 3ds Max, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T16:24:50.645Z. Updated 2026-02-26T16:57:11.072Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

HighPublished 12 Nov 2025, 23:24 WIB

CVE-2025-11795

JPG File Parsing Out-of-Bounds Write Vulnerability

A maliciously crafted JPG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T16:24:30.301Z. Updated 2026-02-26T16:57:11.530Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

HighPublished 12 Nov 2025, 22:52 WIB

CVE-2025-64293

WordPress 0 Day Analytics plugin <= 4.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Injection.This issue affects 0 Day Analytics: from n/a through <= 4.0.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T15:52:49.026Z. Updated 2026-05-13T10:39:20.539Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 17:39 WIB

Official record

CritPublished 12 Nov 2025, 22:34 WIB

CVE-2025-11367

N-central windows software probe Remote Code Execution

The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T15:34:54.446Z. Updated 2026-02-26T16:57:12.021Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

CritPublished 12 Nov 2025, 22:33 WIB

CVE-2025-11366

N-central Authentication bypass via path traversal

N-central < 2025.4 is vulnerable to authentication bypass via path traversal

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T15:33:25.113Z. Updated 2025-11-12T17:24:27.076Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 00:24 WIB

Official record

HighPublished 12 Nov 2025, 22:30 WIB

CVE-2025-11700

N-central Multiple XXE Injection Vulnerabilities

N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T15:30:38.691Z. Updated 2025-12-15T14:22:02.364Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated15 Dec 2025, 21:22 WIB

Official record

MedPublished 12 Nov 2025, 22:27 WIB

CVE-2025-9316

N-central unauthenticated sessionID generation

N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T15:27:25.206Z. Updated 2025-11-12T18:26:46.799Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 01:26 WIB

Official record

HighPublished 12 Nov 2025, 20:27 WIB

CVE-2025-11567

CVE-2025-11567

CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T13:27:56.004Z. Updated 2025-11-12T18:50:03.699Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 01:50 WIB

Official record

MedPublished 12 Nov 2025, 20:26 WIB

CVE-2025-11566

CVE-2025-11566

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T13:26:14.702Z. Updated 2025-11-12T18:46:45.992Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 01:46 WIB

Official record

HighPublished 12 Nov 2025, 20:19 WIB

CVE-2025-11565

CVE-2025-11565

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T13:19:55.722Z. Updated 2025-11-12T18:45:10.615Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 01:45 WIB

Official record

MedPublished 12 Nov 2025, 19:57 WIB

CVE-2025-62876

CVE-2025-62876

A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-greeter. before 6.0.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T12:57:54.078Z. Updated 2026-02-26T16:57:12.510Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:57 WIB

Official record

HighPublished 12 Nov 2025, 18:16 WIB

CVE-2025-12998

Broken Authentication in extension “Modules” (modules)

Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T11:16:59.384Z. Updated 2025-11-12T14:13:55.382Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated12 Nov 2025, 21:13 WIB

Official record

HighPublished 12 Nov 2025, 18:05 WIB

CVE-2025-11994

Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting

The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T11:05:39.391Z. Updated 2026-04-08T17:17:16.000Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record

MedPublished 12 Nov 2025, 18:05 WIB

CVE-2025-11454

Specific Content For Mobile – Customize the mobile version without redirections <= 0.5.5 - Authenticated (Contributor+) SQL Injection

The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplicate_post_as_draft() function in all versions up to, and including, 0.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T11:05:38.743Z. Updated 2026-04-08T16:59:49.160Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:59 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:53 WIB

CVE-2025-40177

accel/qaic: Fix bootlog initialization ordering

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix bootlog initialization ordering As soon as we queue MHI buffers to receive the bootlog from the device, we could be receiving data. Therefore all the resources needed to process that data need to be setup prior to queuing the buffers.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:53:50.737Z. Updated 2026-05-11T21:44:15.142Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:44 WIB

Official record

CritPublished 12 Nov 2025, 17:53 WIB

CVE-2025-40176

tls: wait for pending async decryptions if tls_strp_msg_hold fails

In the Linux kernel, the following vulnerability has been resolved: tls: wait for pending async decryptions if tls_strp_msg_hold fails Async decryption calls tls_strp_msg_hold to create a clone of the input skb to hold references to the memory it uses. If we fail to allocate that clone, proceeding with async decrypti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:53:50.443Z. Updated 2026-10-15T22:02:39.716Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 12 Nov 2025, 17:53 WIB

CVE-2025-40175

idpf: cleanup remaining SKBs in PTP flows

In the Linux kernel, the following vulnerability has been resolved: idpf: cleanup remaining SKBs in PTP flows When the driver requests Tx timestamp value, one of the first steps is to clone SKB using skb_get. It increases the reference counter for that SKB to prevent unexpected freeing by another component. However, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T10:53:50.166Z. Updated 2026-05-11T21:44:12.865Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:44 WIB

Official record