Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1981–2000 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

MedPublished 14 Aug 2025, 23:15 WIB

CVE-2025-9039

Information Disclosure in Amazon ECS Container Agent

We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is hosted. This issue does …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T16:15:19.103Z. Updated 2025-08-14T19:22:07.557Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Aug 2025, 02:22 WIB

Official record

HighPublished 14 Aug 2025, 23:08 WIB

CVE-2025-54867

Youki Symlink Following Vulnerability

Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1981 to 2000 of 3629.First page Next page

Published 2025-08-14T16:08:00.622Z. Updated 2025-08-14T19:26:11.541Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated15 Aug 2025, 02:26 WIB

Official record

MedPublished 14 Aug 2025, 23:02 WIB

CVE-2025-8967

itsourcecode Online Tour and Travel Management System packages.php sql injection

A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/packages.php. The manipulation of the argument pname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T16:02:06.735Z. Updated 2025-08-14T18:24:53.166Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Aug 2025, 01:24 WIB

Official record

MedPublished 14 Aug 2025, 22:53 WIB

CVE-2025-54389

AIDE improper output neutralization vulnerability

AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:53:42.393Z. Updated 2025-11-04T21:12:45.162Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:12 WIB

Official record

MedPublished 14 Aug 2025, 22:52 WIB

CVE-2025-54409

AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS)

AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:52:24.069Z. Updated 2025-11-04T21:12:46.467Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:12 WIB

Official record

MedPublished 14 Aug 2025, 22:41 WIB

CVE-2025-33142

IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:41:59.719Z. Updated 2025-08-14T19:55:56.651Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated15 Aug 2025, 02:55 WIB

Official record

MedPublished 14 Aug 2025, 22:38 WIB

CVE-2025-36047

IBM WebSphere Application Server Liberty denial of service

IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:38:11.020Z. Updated 2025-11-03T19:54:04.049Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:54 WIB

Official record

MedPublished 14 Aug 2025, 22:32 WIB

CVE-2025-8966

itsourcecode Online Tour and Travel Management System tax.php sql injection

A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/tax.php. The manipulation of the argument tname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:32:08.404Z. Updated 2025-08-14T17:49:53.051Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Aug 2025, 00:49 WIB

Official record

MedPublished 14 Aug 2025, 22:32 WIB

CVE-2025-8965

linlinjava litemall Endpoint AdminStorageController.java create unrestricted upload

A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipulation of the argument File leads to unrestricted upload. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:32:06.048Z. Updated 2025-08-14T17:38:41.755Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Aug 2025, 00:38 WIB

Official record

MedPublished 14 Aug 2025, 22:26 WIB

CVE-2025-53631

flaskBlog XSS Vulnerability in postContent

flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution (XSS) on all pages the post is reflected on including /, /post/[ID], /admin/posts, and /user/[ID] of the user that made the pos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:26:32.758Z. Updated 2025-08-14T15:43:29.962Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Aug 2025, 22:43 WIB

Official record

HighPublished 14 Aug 2025, 22:06 WIB

CVE-2025-40758

CVE-2025-40758

A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding chec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:06:31.691Z. Updated 2025-08-14T15:18:47.716Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated14 Aug 2025, 22:18 WIB

Official record

MedPublished 14 Aug 2025, 22:02 WIB

CVE-2025-8964

code-projects Hostel Management System Login hostel_manage.exe improper authentication

A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login. The manipulation leads to improper authentication. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:02:10.449Z. Updated 2025-08-14T19:43:03.974Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated15 Aug 2025, 02:43 WIB

Official record

HighPublished 14 Aug 2025, 22:02 WIB

CVE-2025-7971

Studio 5000 Logix Designer® – Arbitrary Code Execution Vulnerability

A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T15:02:05.287Z. Updated 2025-08-14T19:50:28.826Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated15 Aug 2025, 02:50 WIB

Official record

CritKEVPublished 14 Aug 2025, 21:56 WIB

CVE-2025-8875

Insecure Deserialization Vulnerability

Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-08-14T14:56:11.884Z. Updated 2025-10-21T22:45:20.745Z.

CVSS9.4v4.0KEVListedEPSSPresentUpdated22 Oct 2025, 05:45 WIB

Official record

CritKEVPublished 14 Aug 2025, 21:53 WIB

CVE-2025-8876

Command Injection Vulnerability

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-08-14T14:53:55.176Z. Updated 2025-10-21T22:45:20.929Z.

CVSS9.4v4.0KEVListedEPSSPresentUpdated22 Oct 2025, 05:45 WIB

Official record

HighPublished 14 Aug 2025, 21:47 WIB

CVE-2025-7972

Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability

A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T14:47:46.316Z. Updated 2025-08-14T15:08:22.952Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated14 Aug 2025, 22:08 WIB

Official record

LowPublished 14 Aug 2025, 21:46 WIB

CVE-2025-36613

CVE-2025-36613

SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

Excerpt language: en.

Severity low: primary CNA CVSS 2.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T14:46:53.032Z. Updated 2025-08-14T15:08:29.811Z.

CVSS2.8v3.1KEVNot listedEPSSPresentUpdated14 Aug 2025, 22:08 WIB

Official record

MedPublished 14 Aug 2025, 21:42 WIB

CVE-2025-36612

CVE-2025-36612

SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T14:42:06.384Z. Updated 2026-02-26T17:48:35.305Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

MedPublished 14 Aug 2025, 21:36 WIB

CVE-2025-38738

CVE-2025-38738

SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the Installer. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T14:36:41.268Z. Updated 2026-02-26T17:48:35.668Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

MedPublished 14 Aug 2025, 21:32 WIB

CVE-2025-8962

code-projects Hostel Management System Login Form hostel_manage.exe stack-based overflow

A vulnerability was found in code-projects Hostel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file hostel_manage.exe of the component Login Form. The manipulation of the argument uname leads to stack-based buffer overflow. Local access is required to approach this attack. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-14T14:32:09.995Z. Updated 2025-08-14T14:43:03.978Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:43 WIB

Official record