Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 1601–1620 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2021-47713

Hasura GraphQL 1.3.3 Denial of Service via Malicious GraphQL Query

Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with excessive nested fields. Attackers can send repeated requests with extremely long query strings and multiple threads to consume server resources and potentially crash…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:24.561Z. Updated 2026-08-14T16:49:17.118Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 Aug 2026, 23:49 WIB

Official record

HighPublished 23 Dec 2025, 04:35 WIB

CVE-2025-68476

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1601 to 1620 of 5493.First page Next page

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:35:00.480Z. Updated 2025-12-22T21:56:03.904Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 04:56 WIB

Official record

HighPublished 23 Dec 2025, 04:31 WIB

CVE-2025-68475

Fedify has ReDoS Vulnerability in HTML Parsing Regex

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.6.13, 1.7.14, 1.8.15, and 1.9.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Fedify's document loader. The HTML parsing regex at packages/fedify/src/runtime/docloader.ts:259 contains …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:31:20.314Z. Updated 2025-12-22T21:54:45.635Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Dec 2025, 04:54 WIB

Official record

HighPublished 23 Dec 2025, 04:30 WIB

CVE-2025-34457

wb2osz/direwolf <= 1.8.1 Stack-based Buffer Overflow DoS

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to commit 694c954, contain a stack-based buffer overflow vulnerability in the function kiss_rec_byte() located in src/kiss_frame.c. When processing crafted KISS frames that reach the maximum allowed frame length (MAX_KISS_LEN), the function appends a t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:30:29.670Z. Updated 2026-03-23T15:43:55.657Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 22:43 WIB

Official record

HighPublished 23 Dec 2025, 04:29 WIB

CVE-2025-34458

wb2osz/direwolf <= 1.8.1 Reachable Assertion DoS

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:29:46.850Z. Updated 2026-03-23T15:43:56.390Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 22:43 WIB

Official record

MedPublished 23 Dec 2025, 04:20 WIB

CVE-2025-68480

Marshmallow has DoS in Schema.load(many)

Marshmallow is a lightweight library for converting complex objects to and from simple Python datatypes. In versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, Schema.load(data, many=True) is vulnerable to denial of service attacks. A moderately sized request can consume a disproportionate amount of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T21:20:15.958Z. Updated 2025-12-22T21:35:02.469Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated23 Dec 2025, 04:35 WIB

Official record

UnscoredPublished 23 Dec 2025, 01:57 WIB

CVE-2025-15033

WooCommerce - Subscriber/Customer+ Order Data Disclosure

A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it has been fixed in 8.1.3…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T18:57:39.687Z. Updated 2026-03-06T09:09:36.936Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Mar 2026, 16:09 WIB

Official record

HighPublished 22 Dec 2025, 23:14 WIB

CVE-2025-68337

jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted

In the Linux kernel, the following vulnerability has been resolved: jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted There's issue when file system corrupted: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI C…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:14:14.145Z. Updated 2026-10-15T01:09:52.527Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:09 WIB

Official record

HighPublished 22 Dec 2025, 23:14 WIB

CVE-2025-68336

locking/spinlock/debug: Fix data-race in do_raw_write_lock

In the Linux kernel, the following vulnerability has been resolved: locking/spinlock/debug: Fix data-race in do_raw_write_lock KCSAN reports: BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1: do_raw_write_lock+0x120/0x204 _raw_wri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:14:13.425Z. Updated 2026-10-16T15:09:43.012Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 22:09 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:14 WIB

CVE-2025-68335

comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()

In the Linux kernel, the following vulnerability has been resolved: comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:14:12.614Z. Updated 2026-05-11T21:51:12.073Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:14 WIB

CVE-2025-68334

platform/x86/amd/pmc: Add support for Van Gogh SoC

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Add support for Van Gogh SoC The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:14:11.815Z. Updated 2026-05-11T21:51:10.818Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:14 WIB

CVE-2025-68333

sched_ext: Fix possible deadlock in the deferred_irq_workfn()

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix possible deadlock in the deferred_irq_workfn() For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if the rq returned by container_of() is current CPU's rq, the fo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:14:11.081Z. Updated 2026-05-11T21:51:09.677Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:14 WIB

CVE-2025-68332

comedi: c6xdigio: Fix invalid PNP driver unregistration

In the Linux kernel, the following vulnerability has been resolved: comedi: c6xdigio: Fix invalid PNP driver unregistration The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler `c6xdigio_attach()` to configure a Comed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:14:10.146Z. Updated 2026-05-11T21:51:08.512Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:12 WIB

CVE-2025-68331

usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer

In the Linux kernel, the following vulnerability has been resolved: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer When a UAS device is unplugged during data transfer, there is a probability of a system panic occurring. The root cause is an access to an invalid memory add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:12:24.607Z. Updated 2026-05-11T21:51:07.296Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:12 WIB

CVE-2025-68330

iio: accel: bmc150: Fix irq assumption regression

In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: Fix irq assumption regression The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:12:23.864Z. Updated 2026-05-11T21:51:06.153Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:12 WIB

CVE-2025-68329

tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e.g., by partial munmap or MAP_FIXED), the kernel calls vm_ops->close on each portion. For trace buffer mappings, this results in ring_buffer_unmap() being called …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:12:23.133Z. Updated 2026-05-11T21:51:04.994Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:12 WIB

CVE-2025-68328

firmware: stratix10-svc: fix bug in saving controller data

In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: fix bug in saving controller data Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They both are of the same data and overrides each other. This resulted in the rmmod of the svc driver to fail and throw a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:12:22.218Z. Updated 2026-05-11T21:51:03.881Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:12 WIB

CVE-2025-68327

usb: renesas_usbhs: Fix synchronous external abort on unbind

In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Fix synchronous external abort on unbind A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is executed after the configuration sequence described above: modprobe usb_f_ecm modprobe libcomposite modprobe conf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:12:21.402Z. Updated 2026-05-11T21:51:02.064Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

UnscoredPublished 22 Dec 2025, 23:12 WIB

CVE-2025-68326

drm/xe/guc: Fix stack_depot usage

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix stack_depot usage Add missing stack_depot_init() call when CONFIG_DRM_XE_DEBUG_GUC is enabled to fix the following call stack: [] BUG: kernel NULL pointer dereference, address: 0000000000000000 [] Workqueue: drm_sched_run_job_work…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T16:12:15.664Z. Updated 2026-05-11T21:51:00.787Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:51 WIB

Official record

HighPublished 22 Dec 2025, 22:48 WIB

CVE-2025-10021

CVE-2025-10021

A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp theApp` may access `OdString::kEmpty` before its initialization. Due to undefined initialization order of static objects across translation units (Static Initializa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-22T15:48:07.288Z. Updated 2025-12-22T16:07:59.129Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 23:07 WIB

Official record