Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1681–1700 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 12 Nov 2025, 14:27 WIB

CVE-2025-12633

Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T07:27:40.738Z. Updated 2026-04-08T16:41:40.502Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:41 WIB

Official record

UnscoredPublished 12 Nov 2025, 13:00 WIB

CVE-2025-11560

Team Members Showcase < 3.5.0 - Reflected XSS

The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1681 to 1700 of 3020.First page Next page

Published 2025-11-12T06:00:09.098Z. Updated 2025-12-19T18:42:34.340Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Dec 2025, 01:42 WIB

Official record

MedPublished 12 Nov 2025, 11:29 WIB

CVE-2025-12901

Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update

The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing nonce validation on the set_subscription_level() function. This makes it possible for unauthenticated attackers to modify the subscription settings of authenticated user…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T04:29:09.846Z. Updated 2026-04-08T17:01:20.293Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:01 WIB

Official record

MedPublished 12 Nov 2025, 11:29 WIB

CVE-2025-12833

GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.139 via the 'post_attachment_upload' function due to missing validation on a user controlled key. This makes it possible for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T04:29:09.221Z. Updated 2026-04-08T16:48:26.458Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

MedPublished 12 Nov 2025, 11:29 WIB

CVE-2025-12087

Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion

The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via the 'awwlm_remove_added_wishlist_page' AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T04:29:08.619Z. Updated 2026-04-08T16:37:31.576Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:37 WIB

Official record

MedPublished 12 Nov 2025, 10:07 WIB

CVE-2025-54983

Health check port on ZCC allows tunnel bypass

A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use, allowed traffic to potentially bypass ZCC forwarding controls.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T03:07:39.531Z. Updated 2025-11-12T18:18:36.813Z.

CVSS5.2v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 01:18 WIB

Official record

HighPublished 12 Nov 2025, 08:07 WIB

CVE-2025-40111

drm/vmwgfx: Fix Use-after-free in validation

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are expected to be cleared in vmw_validation_drop_ht but this n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T01:07:25.203Z. Updated 2026-10-15T22:02:38.116Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

UnscoredPublished 12 Nov 2025, 08:07 WIB

CVE-2025-40110

drm/vmwgfx: Fix a null-ptr access in the cursor snooper

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T01:07:24.739Z. Updated 2026-05-11T21:42:50.636Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:42 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:20 WIB

CVE-2025-43205

CVE-2025-43205

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:20:52.053Z. Updated 2026-04-02T18:12:47.787Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:12 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-52331

CVE-2025-52331

Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation in the HTML report, wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-12T21:34:37.883Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:34 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-56385

CVE-2025-56385

A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authentication bypass, d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2026-07-05T16:11:08.867Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:11 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-57310

CVE-2025-57310

A Cross-Site Request Forgery (CSRF) vulnerability in Salmen2/Simple-Faucet-Script v1.07 via crafted POST request to admin.php?p=ads&c=1 allowing attackers to execute arbitrary code.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-13T16:12:25.846Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:12 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-59491

CVE-2025-59491

Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-12T21:36:30.298Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:36 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-60645

CVE-2025-60645

A Cross-Site Request Forgery (CSRF) in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-13T16:06:04.462Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:06 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-60646

CVE-2025-60646

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-12T21:33:01.596Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:33 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-63289

CVE-2025-63289

Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-13T15:08:35.839Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 22:08 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-63353

CVE-2025-63353

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-13T15:55:57.714Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 22:55 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-63396

CVE-2025-63396

An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (DoS).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2026-07-05T01:20:22.567Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:20 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-63419

CVE-2025-63419

Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The Web-Based Server has a feature where users can share files, the feature reflects the filename to an emailbody field with no sanitations leading to HTML Injection.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-12T21:35:39.033Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:35 WIB

Official record

UnscoredPublished 12 Nov 2025, 07:00 WIB

CVE-2025-63645

CVE-2025-63645

A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. Unsanitized message content submitted by one user is persisted by the server and later rendered in another user's Inbox view without appropriate context-aware encoding. As a result, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-12T00:00:00.000Z. Updated 2025-11-13T15:48:25.326Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 22:48 WIB

Official record