Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,274 published records · 10 KEV · 4,274 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,274 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2606.1%
High1,18528%
Med1,72740%
Low1373.2%
None20.05%
Legacy00.00%
Unscored96323%

Matching records by UTC month

Oct 254,274

Signal coverage

KEV-listed: 10
With a forecast: 4,274
Unknown date: 0
Unscored severity: 963

Share of cohort: KEV 0.23% · forecast 100% · unscored 23%.

Showing 101–120 of 4,274By severity band: Critical · 9.0–10.0 260, High · 7.0–8.9 1,185, Medium · 4.0–6.9 1,727, Low · 0.1–3.9 137, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 963

MedPublished 31 Oct 2025, 07:00 WIB

CVE-2025-63562

CVE-2025-63562

Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id).

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-31T00:00:00.000Z. Updated 2025-10-31T19:59:16.652Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated01 Nov 2025, 02:59 WIB

Official record

UnscoredPublished 31 Oct 2025, 07:00 WIB

CVE-2025-63563

CVE-2025-63563

Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-31T00:00:00.000Z. Updated 2025-11-03T20:44:50.827Z.

Showing 101 to 120 of 4274.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:44 WIB

Official record

MedPublished 31 Oct 2025, 07:00 WIB

CVE-2025-63675

CVE-2025-63675

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-31T00:00:00.000Z. Updated 2025-10-31T16:44:37.610Z.

CVSS6.9v3.1KEVNot listedEPSSPresentUpdated31 Oct 2025, 23:44 WIB

Official record

MedPublished 31 Oct 2025, 06:42 WIB

CVE-2025-8849

Denial of Service in danny-avila/librechat

LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:42:41.552Z. Updated 2025-10-31T15:09:34.057Z.

CVSS5.4v3.0KEVNot listedEPSSPresentUpdated31 Oct 2025, 22:09 WIB

Official record

CritPublished 31 Oct 2025, 06:33 WIB

CVE-2025-48983

CVE-2025-48983

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:33:01.993Z. Updated 2026-02-26T16:56:45.241Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:56 WIB

Official record

HighPublished 31 Oct 2025, 06:33 WIB

CVE-2025-48982

CVE-2025-48982

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:33:01.695Z. Updated 2026-02-26T16:56:45.748Z.

CVSS7.3v3.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:56 WIB

Official record

MedPublished 31 Oct 2025, 06:32 WIB

CVE-2025-27208

CVE-2025-27208

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browse…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:32:11.103Z. Updated 2025-12-01T19:12:38.766Z.

CVSS6.3v3.0KEVNot listedEPSSPresentUpdated02 Dec 2025, 02:12 WIB

Official record

UnscoredPublished 31 Oct 2025, 06:31 WIB

CVE-2025-48984

CVE-2025-48984

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:31:34.218Z. Updated 2026-02-26T16:56:46.096Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:56 WIB

Official record

UnscoredPublished 31 Oct 2025, 06:30 WIB

CVE-2025-52665

CVE-2025-52665

A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. This vulnerability was introduced in Version 3.3.22 and was fixed in Version 4.0.21 and later. Affected Products: Uni…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:30:28.329Z. Updated 2025-10-31T14:07:27.850Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Oct 2025, 21:07 WIB

Official record

UnscoredPublished 31 Oct 2025, 06:30 WIB

CVE-2025-52663

CVE-2025-52663

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products: UniFi Talk Touch …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:30:28.298Z. Updated 2025-12-02T18:30:25.465Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Dec 2025, 01:30 WIB

Official record

MedPublished 31 Oct 2025, 06:29 WIB

CVE-2025-48980

CVE-2025-48980

In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split View" context menu item did not respect the SameSite cookie attribute. Therefore SameSite=Strict cookies would be sent on a cross-site navigation using this method.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:29:44.075Z. Updated 2025-12-01T20:22:29.067Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated02 Dec 2025, 03:22 WIB

Official record

HighPublished 31 Oct 2025, 06:29 WIB

CVE-2025-52664

CVE-2025-52664

SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T23:29:22.906Z. Updated 2025-12-01T20:03:14.842Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated02 Dec 2025, 03:03 WIB

Official record

MedPublished 31 Oct 2025, 04:57 WIB

CVE-2011-10037

Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks

Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the handling of xiwindow variables used to build permalinks in the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's bro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:57:27.150Z. Updated 2025-12-22T17:24:04.578Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated23 Dec 2025, 00:24 WIB

Official record

MedPublished 31 Oct 2025, 04:57 WIB

CVE-2021-47697

Nagios XI < 5.8.0 XSS via Views URL Handling

Nagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:57:03.111Z. Updated 2025-11-17T18:21:43.156Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:56 WIB

CVE-2018-25121

Nagios XI < 5.4.13 XSS via Views Page

Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:56:43.433Z. Updated 2025-11-17T18:21:38.867Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:56 WIB

CVE-2013-10074

Nagios XI < 2012R2.6 XSS via Tools Menu

Nagios XI versions prior to 2012R2.6 are vulnerable to cross-site scripting (XSS) via the Tools Menu of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:56:22.290Z. Updated 2025-11-17T18:21:37.954Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:55 WIB

CVE-2011-10040

Nagios XI < 2011R1.9 XSS via Status/Report Page Link Functions

Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the link-handling functions used by status and report pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:55:55.168Z. Updated 2025-11-17T18:21:36.760Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:55 WIB

CVE-2016-15051

Nagios XI < 5.2.4 XSS via Report startdate/enddate Fields

Nagios XI versions prior to 5.2.4 are vulnerable to cross-site scripting (XSS) via the Reports interface through values from the startdate and enddate fields. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:55:32.598Z. Updated 2025-11-17T18:21:38.334Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:55 WIB

CVE-2011-10038

Nagios XI < 2011R1.9 XSS via Recurring Downtime Script

Nagios XI versions prior to 2011R1.9 are vulnerable to cross-site scripting (XSS) via the recurring downtime script of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:55:10.682Z. Updated 2025-11-17T18:21:36.418Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:54 WIB

CVE-2021-47695

Nagios XI < 5.8.0 XSS via My Tools Page

Nagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:54:48.701Z. Updated 2025-11-17T18:21:42.710Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record