Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1101–1120 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

MedPublished 21 Aug 2025, 23:02 WIB

CVE-2025-9307

PHPGurukul Online Course Registration session.php sql injection

A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This manipulation of the argument sesssion causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T16:02:09.594Z. Updated 2025-08-21T17:32:21.777Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 00:32 WIB

Official record

MedPublished 21 Aug 2025, 22:51 WIB

CVE-2025-55744

UnoPim vulnerable to CSRF on Product edit feature and creation of other types

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, some of the endpoints of the application is vulnerable to Cross site Request forgery (CSRF). This vulnerability is fixed in 0.2.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:51:43.126Z. Updated 2025-08-21T20:00:56.409Z.

Showing 1101 to 1120 of 3629.First page Next page

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 03:00 WIB

Official record

HighPublished 21 Aug 2025, 22:45 WIB

CVE-2025-55743

UnoPim vulnerable to remote code execution through Arbitrary File upload

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, the image upload at the user creation feature performs only client side file type validation. A user can capture the request by uploading an image, capture the request through a Proxy like Burp suite. Make…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:45:32.296Z. Updated 2025-08-21T20:00:06.996Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 03:00 WIB

Official record

MedPublished 21 Aug 2025, 22:40 WIB

CVE-2025-9162

Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are processed. An attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:40:25.136Z. Updated 2025-12-19T21:46:23.680Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated20 Dec 2025, 04:46 WIB

Official record

HighPublished 21 Aug 2025, 22:36 WIB

CVE-2025-55742

UnoPim Stored XSS via SVG MIME/Sanitizer Bypass

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:36:07.475Z. Updated 2025-08-21T19:58:34.442Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated22 Aug 2025, 02:58 WIB

Official record

MedPublished 21 Aug 2025, 22:32 WIB

CVE-2025-9306

SourceCodester Advanced School Management System addNotice cross site scripting

A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice/addNotice. The manipulation of the argument noticeSubject results in cross site scripting. It is possible to launch the attack remotely. The exploit is now publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:32:08.960Z. Updated 2025-08-22T11:31:39.259Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 18:31 WIB

Official record

MedPublished 21 Aug 2025, 22:05 WIB

CVE-2025-55297

ESF-IDF BluFi Example Memory Overflow Vulnerability

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. The BluFi example bundled in ESP-IDF was vulnerable to memory overflows in two areas: Wi-Fi credential handling and Diffie–Hellman key exchange. This vulnerability is fixed in 5.4.1, 5.3.3, 5.1.6, and 5.0.9.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:05:06.805Z. Updated 2025-08-22T11:32:48.470Z.

CVSS5.2v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 18:32 WIB

Official record

MedPublished 21 Aug 2025, 22:02 WIB

CVE-2025-9305

SourceCodester Online Bank Management System mnotice.php sql injection

A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is an unknown function of the file /bank/mnotice.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:02:10.930Z. Updated 2025-08-21T15:55:42.336Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 22:55 WIB

Official record

MedPublished 21 Aug 2025, 22:02 WIB

CVE-2025-9304

SourceCodester Online Bank Management System show.php sql injection

A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of the file /bank/show.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from a remote location. The exploit has been made available to the public and c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T15:02:07.374Z. Updated 2025-08-21T19:57:41.321Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Aug 2025, 02:57 WIB

Official record

CritPublished 21 Aug 2025, 21:43 WIB

CVE-2025-53251

WordPress Pin WP theme < 7.2 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in An-Themes Pin WP pin-wp allows Upload a Web Shell to a Web Server.This issue affects Pin WP: from n/a through < 7.2.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T14:43:32.778Z. Updated 2026-04-28T16:13:21.888Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 21 Aug 2025, 21:41 WIB

CVE-2025-48956

vLLM API endpoints vulnerable to Denial of Service Attacks

vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.10.1.1, a Denial of Service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a cr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T14:41:03.889Z. Updated 2025-08-21T15:02:09.023Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Aug 2025, 22:02 WIB

Official record

HighPublished 21 Aug 2025, 21:32 WIB

CVE-2025-9303

TOTOLINK A720R cstecgi.cgi setParentalRules buffer overflow

A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument desc results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T14:32:07.463Z. Updated 2025-08-21T14:51:50.721Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 21:51 WIB

Official record

MedPublished 21 Aug 2025, 21:02 WIB

CVE-2025-9302

PHPGurukul User Management System signup.php sql injection

A vulnerability was identified in PHPGurukul User Management System 1.0. This vulnerability affects unknown code of the file /signup.php. Such manipulation of the argument emailid leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T14:02:06.977Z. Updated 2025-08-21T14:24:04.582Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 21:24 WIB

Official record

HighPublished 21 Aug 2025, 20:43 WIB

CVE-2025-34158

CVE-2025-34158

Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T13:43:30.032Z. Updated 2026-01-02T15:56:59.792Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated02 Jan 2026, 22:56 WIB

Official record

MedPublished 21 Aug 2025, 20:32 WIB

CVE-2025-9301

cmake cmForEachCommand.cxx ReplayItems assertion

A vulnerability was determined in cmake 4.1.20250725-gb5cce23. This affects the function cmForEachFunctionBlocker::ReplayItems of the file cmForEachCommand.cxx. This manipulation causes reachable assertion. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Patch name:…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T13:32:08.995Z. Updated 2025-08-21T13:49:58.107Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 20:49 WIB

Official record

MedPublished 21 Aug 2025, 20:02 WIB

CVE-2025-9300

saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflow

A vulnerability was found in saitoha libsixel up to 1.10.3. Affected by this issue is the function sixel_debug_print_palette of the file src/encoder.c of the component img2sixel. The manipulation results in stack-based buffer overflow. The attack must be initiated from a local position. The exploit has been made public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T13:02:08.108Z. Updated 2025-08-21T14:46:37.782Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 21:46 WIB

Official record

HighPublished 21 Aug 2025, 19:32 WIB

CVE-2025-9299

Tenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflow

A vulnerability has been found in Tenda M3 1.0.0.12. Affected by this vulnerability is the function formGetMasterPassengerAnalyseData of the file /goform/getMasterPassengerAnalyseData. The manipulation of the argument Time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T12:32:12.049Z. Updated 2025-08-21T13:22:06.848Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 20:22 WIB

Official record

HighPublished 21 Aug 2025, 19:32 WIB

CVE-2025-9298

Tenda M3 QuickIndex formQuickIndex stack-based overflow

A flaw has been found in Tenda M3 1.0.0.12. Affected is the function formQuickIndex of the file /goform/QuickIndex. Executing manipulation of the argument PPPOEPassword can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T12:32:08.707Z. Updated 2025-08-21T13:23:24.023Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 20:23 WIB

Official record

HighPublished 21 Aug 2025, 19:02 WIB

CVE-2025-9297

Tenda i22 wxportalauth formWeixinAuthInfoGet stack-based overflow

A vulnerability was detected in Tenda i22 1.0.0.3(4687). This impacts the function formWeixinAuthInfoGet of the file /goform/wxportalauth. Performing manipulation of the argument Type results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T12:02:11.484Z. Updated 2025-08-21T13:24:53.066Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 20:24 WIB

Official record

MedPublished 21 Aug 2025, 18:32 WIB

CVE-2025-9296

Emlog Pro blogger.php unrestricted upload

A security vulnerability has been detected in Emlog Pro up to 2.5.18. This affects an unknown function of the file /admin/blogger.php?action=update_avatar. Such manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T11:32:06.019Z. Updated 2025-08-21T13:43:32.800Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 20:43 WIB

Official record