Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 1581–1600 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

MedPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53978

myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Announcements

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum announcement system that allows authenticated administrators to inject malicious scripts when creating announcements. Attackers can exploit this vulnerability by inserting script payloads in the announcement title field when adding ann…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:35.555Z. Updated 2026-04-07T14:08:18.521Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

MedPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53977

myBB Forums 1.8.26 Stored Cross-Site Scripting via Forum Management

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malicious scripts when creating new forums. Attackers can exploit this vulnerability by inserting script payloads in the forum title field when adding new forums thro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1581 to 1600 of 5493.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:35.141Z. Updated 2026-04-07T14:08:17.679Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

MedPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53976

myBB Forums 1.8.26 Stored Cross-Site Scripting via Template Management

myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject malicious scripts when creating new templates. Attackers can exploit this vulnerability by inserting script payloads in the template title field when adding new te…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:34.716Z. Updated 2026-04-07T14:08:16.479Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

CritPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53975

Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page

Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:34.245Z. Updated 2026-07-15T01:24:57.038Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:24 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53974

D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request

D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing sensitive network creden…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:33.805Z. Updated 2026-10-01T15:19:43.975Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53973

Zillya Total Security 3.0.2367.0 Local Privilege Escalation via Quarantine Module

Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorized system locations using the quarantine module. Attackers can leverage symbolic link techniques to restore quarantined files to restricted directories, potentially enabling system-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:33.394Z. Updated 2026-01-03T20:46:28.195Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated04 Jan 2026, 03:46 WIB

Official record

CritPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53972

WebTareas 2.4 Unauthenticated SQL Injection via Session Cookie Parameter

WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and potentially access sensitive system data.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:32.960Z. Updated 2026-04-07T14:08:15.099Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53971

WebTareas 2.4 Authenticated Remote Code Execution via File Upload

WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file path.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:32.504Z. Updated 2026-04-07T14:08:14.143Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:08 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53970

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Reset Board Config

Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API endpoint to reset device configurations by sending crafted POST requests with ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:32.122Z. Updated 2025-12-22T22:04:57.904Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:04 WIB

Official record

CritPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53969

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Password Change

Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:31.672Z. Updated 2025-12-22T22:05:05.322Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:05 WIB

Official record

CritPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53968

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Erase Account

Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authenti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:31.256Z. Updated 2025-12-22T22:05:10.626Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:05 WIB

Official record

CritPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53967

Screen SFT DAB 600/C Firmware 1.9.3 Authentication Bypass Admin Password Change

Screen SFT DAB 600/C firmware 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without requiring the current credentials. Attackers can exploit the userManager.cgx API endpoint by sending a crafted POST request with a new MD5-hashed password to directly modify the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:30.837Z. Updated 2025-12-22T22:05:16.450Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:05 WIB

Official record

CritPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53966

SOUND4 LinkAndShare Transmitter 1.1.2 Format String Stack Buffer Overflow

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory stack overflows through maliciously crafted environment variables. Attackers can manipulate the username environment variable with format string payloads to potentially execute arbitrary code and crash t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:30.413Z. Updated 2025-12-22T22:05:21.596Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:05 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2023-53965

SOUND4 Server Service 4.1.102 Local Privilege Escalation via Unquoted Service Path

SOUND4 Server Service 4.1.102 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privile…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:29.980Z. Updated 2025-12-22T22:05:26.914Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:05 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2022-50690

Wondershare MirrorGo 2.0.11.346 Local Privilege Escalation via Insecure File Permissions

Wondershare MirrorGo 2.0.11.346 contains a local privilege escalation vulnerability due to incorrect file permissions on executable files. Unprivileged local users can replace the ElevationService.exe with a malicious file to execute arbitrary code with LocalSystem privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:27.192Z. Updated 2025-12-22T22:05:32.037Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:05 WIB

Official record

MedPublished 23 Dec 2025, 04:35 WIB

CVE-2022-50689

Cobian Reflector 0.9.93 RC1 Local Denial of Service via Password Field

Cobian Reflector 0.9.93 RC1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the password input field. Attackers can paste a large 8000-byte buffer into the password field to trigger an application crash during SFTP task configuration.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:26.757Z. Updated 2025-12-22T22:05:37.321Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 05:05 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2022-50688

Cobian Backup Gravity 11.2.0.582 Unquoted Service Path Privilege Escalation

Cobian Backup Gravity 11.2.0.582 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path in the CobianBackup11 service to inject malicious code that would execute with LocalSystem privi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:26.326Z. Updated 2026-03-05T12:02:31.270Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

MedPublished 23 Dec 2025, 04:35 WIB

CVE-2022-50687

Cobian Backup 11 Gravity 11.2.0.582 Local Denial of Service via Password Field

Cobian Backup 11 Gravity 11.2.0.582 contains a denial of service vulnerability in the FTP password input field that allows attackers to crash the application. Attackers can generate a specially crafted 800-byte buffer and paste it into the password field to trigger an application crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:25.934Z. Updated 2026-03-05T12:02:30.465Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

MedPublished 23 Dec 2025, 04:35 WIB

CVE-2021-47715

Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_schema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL definitions to potentially …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:25.534Z. Updated 2026-08-14T16:49:18.458Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

MedPublished 23 Dec 2025, 04:35 WIB

CVE-2021-47714

Hasura GraphQL 1.3.3 Local File Read via SQL Injection

Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:25.094Z. Updated 2026-08-14T16:49:17.771Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record