Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1641–1660 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

CritPublished 18 Aug 2025, 23:28 WIB

CVE-2025-55205

Capsule tenant owners with "patch namespace" permission can hijack system namespaces label

Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authenticated tenant users to inject arbitrary labels into system namespaces (kube-system, default, capsule-system), bypassing multi-tenant isolation and potentially acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T16:28:51.317Z. Updated 2025-08-18T17:39:07.476Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated19 Aug 2025, 00:39 WIB

Official record

HighPublished 18 Aug 2025, 23:21 WIB

CVE-2025-55201

Copier safe template has arbitrary filesystem read/write access

Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes a few pathlib.Path objects in the Jinja context which have unconstrained I/O methods. This effectively renders the security model w.r.t. filesystem access usele…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1641 to 1660 of 3629.First page Next page

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T16:21:25.576Z. Updated 2025-08-18T17:37:53.420Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated19 Aug 2025, 00:37 WIB

Official record

CritPublished 18 Aug 2025, 23:02 WIB

CVE-2025-54117

NamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editor

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows remote authenticated attackers to inject arbitrary web script or HTML via the dashboard text editor component. This vulnerability is fixed in 2.2.4.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T16:02:48.176Z. Updated 2025-08-18T17:37:06.341Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated19 Aug 2025, 00:37 WIB

Official record

HighPublished 18 Aug 2025, 23:01 WIB

CVE-2025-54421

NamelessMC allows Stored Cross Site Scripting (XSS) in SEO component

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.4 allows remote authenticated attackers to inject arbitrary web script or HTML via the default_keywords crafted parameter. This vulnerability is fixed in 2.2.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T16:01:30.994Z. Updated 2025-08-18T17:36:09.856Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated19 Aug 2025, 00:36 WIB

Official record

MedPublished 18 Aug 2025, 22:59 WIB

CVE-2025-54118

NamelessMC allows sensitive information disclosure in member list component

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Sensitive information disclosure in NamelessMC before 2.2.4 allows unauthenticated remote attacker to gain sensitive information such as absolute path of the source code via list parameter. This vulnerability is fixed in 2.2.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T15:59:15.837Z. Updated 2025-08-18T17:34:51.775Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated19 Aug 2025, 00:34 WIB

Official record

MedPublished 18 Aug 2025, 21:02 WIB

CVE-2025-33100

IBM Concert Software information disclosure

IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T14:02:24.726Z. Updated 2025-08-18T14:33:23.105Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 21:33 WIB

Official record

HighPublished 18 Aug 2025, 21:01 WIB

CVE-2025-33090

IBM Concert Software denial of service

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T14:01:32.418Z. Updated 2025-08-18T14:09:20.940Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 21:09 WIB

Official record

MedPublished 18 Aug 2025, 21:00 WIB

CVE-2025-27909

IBM Concert Software cross-origin resource sharing

IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T14:00:31.751Z. Updated 2025-08-18T14:12:36.834Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 21:12 WIB

Official record

MedPublished 18 Aug 2025, 20:58 WIB

CVE-2025-1759

IBM Concert Software information disclosure

IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T13:58:39.964Z. Updated 2025-08-18T14:13:46.976Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 21:13 WIB

Official record

LowPublished 18 Aug 2025, 20:43 WIB

CVE-2024-49827

IBM Concert Software information disclosure

IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to excessive data exposure, allowing attackers to access sensitive information without proper filtering.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T13:43:51.852Z. Updated 2025-08-18T13:54:50.490Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 20:54 WIB

Official record

HighPublished 18 Aug 2025, 20:39 WIB

CVE-2025-36120

IBM Storage Virtualize privilege escalation

IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization checks to access resources.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T13:39:41.381Z. Updated 2026-02-26T17:48:30.436Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

HighPublished 18 Aug 2025, 20:27 WIB

CVE-2025-4962

IDOR Vulnerability in Template Creation via `projectId` Manipulation in lunary-ai/lunary

An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the `projectId` query parameter. The root cause of this …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T13:27:49.397Z. Updated 2025-08-18T14:00:49.792Z.

CVSS7.7v3.0KEVNot listedEPSSPresentUpdated18 Aug 2025, 21:00 WIB

Official record

MedPublished 18 Aug 2025, 20:20 WIB

CVE-2025-43732

CVE-2025-43732

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference (IDOR) in the groupId parameter of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T13:20:46.217Z. Updated 2025-08-18T18:59:36.168Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated19 Aug 2025, 01:59 WIB

Official record

LowPublished 18 Aug 2025, 19:06 WIB

CVE-2025-43733

CVE-2025-43733

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated attacker to inject JavaScript code via the content page's name field. This malicious payload is then reflected and executed within the user's browser when viewi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T12:06:07.560Z. Updated 2025-08-18T18:59:43.029Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated19 Aug 2025, 01:59 WIB

Official record

MedPublished 18 Aug 2025, 15:47 WIB

CVE-2025-41242

CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T08:47:07.427Z. Updated 2025-08-25T18:14:59.837Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated26 Aug 2025, 01:14 WIB

Official record

HighPublished 18 Aug 2025, 15:27 WIB

CVE-2025-47206

File Station 5

An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify or corrupt memory. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.4933 and later

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T08:27:55.068Z. Updated 2025-08-26T09:35:35.833Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated26 Aug 2025, 16:35 WIB

Official record

HighPublished 18 Aug 2025, 14:22 WIB

CVE-2025-5296

CVE-2025-5296

CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruption, exposure of application and system information or persistent denial of service wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T07:22:05.013Z. Updated 2025-08-18T12:22:22.123Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2025, 19:22 WIB

Official record

HighPublished 18 Aug 2025, 13:58 WIB

CVE-2025-6625

CVE-2025-6625

CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T06:58:15.222Z. Updated 2025-08-18T12:22:54.996Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Aug 2025, 19:22 WIB

Official record

MedPublished 18 Aug 2025, 13:42 WIB

CVE-2025-57703

Reflected Cross-site Scripting in DIAEnergie

DIAEnergie - Reflected Cross-site Scripting

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T06:42:48.812Z. Updated 2025-08-19T00:17:52.143Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2025, 07:17 WIB

Official record

MedPublished 18 Aug 2025, 13:42 WIB

CVE-2025-57702

Reflected Cross-site Scripting in DIAEnergie

DIAEnergie - Reflected Cross-site Scripting

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-18T06:42:24.921Z. Updated 2025-08-19T00:17:38.206Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated19 Aug 2025, 07:17 WIB

Official record