Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 161–180 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

MedPublished 29 Aug 2025, 23:02 WIB

CVE-2025-9658

O2OA Personal Profile dict cross site scripting

A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Profile Page. This manipulation of the argument name/alias/description causes cross site scripting. Remote exploitation of the attack is possible. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T16:02:06.156Z. Updated 2025-08-29T17:00:59.021Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 00:00 WIB

Official record

UnscoredPublished 29 Aug 2025, 22:55 WIB

CVE-2025-47909

Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 161 to 180 of 3629.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:55:08.936Z. Updated 2025-08-29T18:23:11.763Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:23 WIB

Official record

MedPublished 29 Aug 2025, 22:53 WIB

CVE-2025-55750

Gitpod Classic Affected by Bitbucket OAuth Token Exposure via Redirect Fragment

Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to expose a valid Bitbucket access token via the URL fragment when clicked by an authe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:53:51.123Z. Updated 2025-08-29T16:03:08.245Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 23:03 WIB

Official record

MedKEVPublished 29 Aug 2025, 22:50 WIB

CVE-2025-55177

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-08-29T15:50:28.578Z. Updated 2026-10-07T17:57:35.015Z.

CVSS5.4v3.1KEVListedEPSSPresentUpdated08 Oct 2026, 00:57 WIB

Official record

HighPublished 29 Aug 2025, 22:38 WIB

CVE-2025-5808

Authentication Bypass vulnerability discovered in the OpenText™ Self-Service Password Reset

Improper Input Validation vulnerability in OpenText Self Service Password Reset allows Authentication Bypass.This issue affects Self Service Password Reset from before 4.8 patch 3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:38:49.847Z. Updated 2025-08-29T15:59:44.852Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 22:59 WIB

Official record

LowPublished 29 Aug 2025, 22:35 WIB

CVE-2025-55202

Opencast has a partial path traversal vulnerability in UI config

Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:35:35.338Z. Updated 2025-08-29T16:00:31.047Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 23:00 WIB

Official record

MedPublished 29 Aug 2025, 22:32 WIB

CVE-2025-9657

O2OA Personal Profile script cross site scripting

A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack may be launched remotely. The exploit is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:32:09.592Z. Updated 2025-08-29T16:01:16.334Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 23:01 WIB

Official record

MedPublished 29 Aug 2025, 22:32 WIB

CVE-2025-9656

PHPGurukul Directory Management System add-directory.php cross site scripting

A security vulnerability has been detected in PHPGurukul Directory Management System 2.0. This vulnerability affects unknown code of the file /admin/add-directory.php. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:32:07.263Z. Updated 2025-08-29T16:01:57.874Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 23:01 WIB

Official record

MedPublished 29 Aug 2025, 22:07 WIB

CVE-2025-54877

Tuleap's special and always there fields permissions are not verified in cross-tracker search

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition versions before 16.10.99.1754050155 and Tuleap Enterprise Edition versions before 16.9-8 and before 16.10-5, an attacker can access to the content of the special and always there fields…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:07:54.950Z. Updated 2025-08-29T15:23:44.584Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2025, 22:23 WIB

Official record

MedPublished 29 Aug 2025, 22:02 WIB

CVE-2025-9655

O2OA Personal Profile person cross site scripting

A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component Personal Profile Page. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be launched remotely. The vendor repl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:02:10.777Z. Updated 2025-08-29T15:29:57.181Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 22:29 WIB

Official record

MedPublished 29 Aug 2025, 22:02 WIB

CVE-2025-9654

AiondaDotCom mcp-ssh server-simple.mjs command injection

A security flaw has been discovered in AiondaDotCom mcp-ssh up to 1.0.3. Affected by this issue is some unknown functionality of the file server-simple.mjs. Performing manipulation results in command injection. The attack can be initiated remotely. Upgrading to version 1.0.4 and 1.1.0 can resolve this issue. The patch …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:02:08.254Z. Updated 2025-08-29T15:31:42.932Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 22:31 WIB

Official record

LowPublished 29 Aug 2025, 22:00 WIB

CVE-2025-55304

Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. A denial-of-service was found in Exiv2 version 0.28.5: a quadratic algorithm in the ICC profile parsing code in jpegBase::readMetadata() can cause Exiv2 to run for a long time. The denial-of-servi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T15:00:05.975Z. Updated 2025-08-29T15:27:17.130Z.

CVSS1.8v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 22:27 WIB

Official record

LowPublished 29 Aug 2025, 21:50 WIB

CVE-2025-54080

Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds read was found in Exiv2 versions 0.28.5 and earlier. The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T14:50:17.623Z. Updated 2025-08-29T14:58:23.574Z.

CVSS1.8v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 21:58 WIB

Official record

MedPublished 29 Aug 2025, 21:32 WIB

CVE-2025-9653

Portabilis i-Educar Cadastrar projeto educar_projeto_cad.php cross site scripting

A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_projeto_cad.php of the component Cadastrar projeto Page. Such manipulation of the argument nome/observacao leads to cross site scripting. It is possible to launch the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T14:32:08.649Z. Updated 2025-08-29T21:04:29.224Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 04:04 WIB

Official record

MedPublished 29 Aug 2025, 21:32 WIB

CVE-2025-9652

Portabilis i-Educar Cadastrar tipo de transferência educar_transferencia_tipo_cad.php cross site scripting

A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of the component Cadastrar tipo de transferência Page. This manipulation of the argument nm_tipo/desc_tipo causes cross site scripting. It is possible to initiate the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T14:32:06.507Z. Updated 2025-08-29T21:04:14.746Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 04:04 WIB

Official record

MedPublished 29 Aug 2025, 21:02 WIB

CVE-2025-9651

shafhasan chatbox chat.php sql injection

A vulnerability was found in shafhasan chatbox up to 156a39cde62f78532c3265a70eda12c70907e56f. This impacts an unknown function of the file /chat.php. The manipulation of the argument user_id results in sql injection. The attack may be performed from a remote location. The exploit has been made public and could be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T14:02:09.556Z. Updated 2025-08-29T14:27:30.942Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 21:27 WIB

Official record

MedPublished 29 Aug 2025, 21:02 WIB

CVE-2025-9650

yeqifu carRental AppFileUtils.java removeFileByPath path traversal

A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This affects the function removeFileByPath of the file src/main/java/com/yeqifu/sys/utils/AppFileUtils.java. The manipulation of the argument carimg leads to path traversal. The attack is possible to be carried out remote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T14:02:06.833Z. Updated 2025-08-29T14:31:45.163Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 21:31 WIB

Official record

MedPublished 29 Aug 2025, 20:32 WIB

CVE-2025-9649

appneta tcpreplay send_packets.c calc_sleep_time divide by zero

A security vulnerability has been detected in appneta tcpreplay 4.5.1. Impacted is the function calc_sleep_time of the file send_packets.c. Such manipulation leads to divide by zero. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 4.5.3-beta3 is reco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T13:32:07.505Z. Updated 2025-08-29T13:48:02.248Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 20:48 WIB

Official record

MedPublished 29 Aug 2025, 20:02 WIB

CVE-2025-9647

mtons mblog list cross site scripting

A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T13:02:13.543Z. Updated 2025-08-29T13:45:48.076Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 20:45 WIB

Official record

MedPublished 29 Aug 2025, 20:02 WIB

CVE-2025-9646

O2OA calendarConfig cross site scripting

A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. The manipulation of the argument toMonthViewName results in cross site scripting. The attack can be launched remotely. The exploit has been r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T13:02:06.803Z. Updated 2025-08-29T13:45:03.471Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Aug 2025, 20:45 WIB

Official record