Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 1141–1160 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-32879

CVE-2025-32879

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to connect with the device via BLE if no other device is connected. While connected, none of the BLE services and characteristics of the device require any authenticat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-24T13:47:58.072Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jun 2025, 20:47 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-32880

CVE-2025-32880

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and machine-in-the-middle attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-24T15:27:48.896Z.

Showing 1141 to 1160 of 3682.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated24 Jun 2025, 22:27 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-44203

CVE-2025-44203

In HotelDruid 3.0.0 and 3.0.7, the unauthenticated database-setup endpoint creadb.php can be reached before setup is completed and performs database creation without locking. By sending many concurrent requests, an attacker can trigger a race condition during which verbose SQL error messages disclose the administrator …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2026-07-09T13:55:44.468Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jul 2026, 20:55 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-44635

CVE-2025-44635

There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W series routers before ERG2AW-MNW100-R1117; H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers before ERHMG2-MNW100-R1126; GR3200, GR52…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-24T15:53:02.071Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jun 2025, 22:53 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-45331

CVE-2025-45331

brplot v420.69.1 contains a Null Pointer Dereference (NPD) vulnerability in the br_dagens_handle_once function of its data processing module, leading to unpredictable program behavior, causing segmentation faults, and program crashes.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-24T15:29:25.265Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jun 2025, 22:29 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-45890

CVE-2025-45890

Directory Traversal vulnerability in novel plus before v.5.1.0 allows a remote attacker to execute arbitrary code via the filePath parameter

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-24T15:31:42.522Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jun 2025, 22:31 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-46158

CVE-2025-46158

An issue in redoxOS kernel before commit 5d41cd7c allows a local attacker to cause a denial of service via the `setitimer` syscall

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-26T15:17:42.787Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Jun 2025, 22:17 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-46179

CVE-2025-46179

A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. The squeryx parameter accepts unsanitized input, which is passed directly into backend SQL queries.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-24T15:28:32.237Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jun 2025, 22:28 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-48705

CVE-2025-48705

An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message forces the device to reboot.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-23T14:08:18.836Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Jun 2025, 21:08 WIB

Official record

UnscoredPublished 20 Jun 2025, 07:00 WIB

CVE-2025-48706

CVE-2025-48706

An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-20T00:00:00.000Z. Updated 2025-06-23T15:44:40.058Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Jun 2025, 22:44 WIB

Official record

HighPublished 20 Jun 2025, 06:41 WIB

CVE-2025-47771

PowSyBl Core allows deserialization of untrusted SparseMatrix data

PowSyBl (Power System Blocks) is a framework to build power system oriented software. In versions 6.3.0 to 6.7.1, there is a deserialization issue in the read method of the SparseMatrix class that can lead to a wide range of privilege escalations depending on the circumstances. This method takes in an InputStream and r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T23:41:41.357Z. Updated 2025-06-20T15:55:29.328Z.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated20 Jun 2025, 22:55 WIB

Official record

MedPublished 20 Jun 2025, 06:31 WIB

CVE-2025-6287

PHPGurukul COVID19 Testing Management System Take Action test-details.php cross site scripting

A vulnerability classified as problematic was found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /test-details.php of the component Take Action. The manipulation of the argument remark leads to cross site scripting. The attack can be launche…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T23:31:06.185Z. Updated 2025-06-23T19:29:21.474Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record

MedPublished 20 Jun 2025, 06:00 WIB

CVE-2025-6286

PHPGurukul COVID19 Testing Management System search-report-result.php redirect

A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument q leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T23:00:22.589Z. Updated 2025-06-23T19:29:26.800Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record

MedPublished 20 Jun 2025, 06:00 WIB

CVE-2025-6285

PHPGurukul COVID19 Testing Management System search-report-result.php cross site scripting

A vulnerability was found in PHPGurukul COVID19 Testing Management System 2021. It has been rated as problematic. This issue affects some unknown processing of the file /search-report-result.php. The manipulation of the argument q leads to cross site scripting. The attack may be initiated remotely. The exploit has been…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T23:00:20.107Z. Updated 2025-06-23T19:29:31.802Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record

MedPublished 20 Jun 2025, 05:31 WIB

CVE-2025-6284

PHPGurukul Car Rental Portal cross-site request forgery

A vulnerability was found in PHPGurukul Car Rental Portal 3.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T22:31:11.482Z. Updated 2025-06-23T19:29:37.412Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record

MedPublished 20 Jun 2025, 05:31 WIB

CVE-2025-6283

xataio Xata Agent route.ts GET path traversal

A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the file apps/dbagent/src/app/api/evals/route.ts. The manipulation of the argument passed leads to path traversal. Upgrading to version 0.3.1 is able to address this issue. The patch is na…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T22:31:07.828Z. Updated 2025-06-23T19:29:42.982Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record

MedPublished 20 Jun 2025, 05:00 WIB

CVE-2025-6282

xlang-ai OpenAgents file.py create_upload_file path traversal

A vulnerability was found in xlang-ai OpenAgents up to ff2e46440699af1324eb25655b622c4a131265bb and classified as critical. Affected by this issue is the function create_upload_file of the file backend/api/file.py. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. C…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T22:00:16.250Z. Updated 2025-06-23T19:29:48.205Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record

LowPublished 20 Jun 2025, 04:35 WIB

CVE-2025-47293

PowSyBl Core XML Reader allows XXE and SSRF

PowSyBl (Power System Blocks) is a framework to build power system oriented software. Prior to version 6.7.2, in certain places, powsybl-core XML parsing is vulnerable to an XML external entity (XXE) attack and to a server-side request forgery (SSRF) attack. This allows an attacker to elevate their privileges to read f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T21:35:40.992Z. Updated 2025-06-20T15:58:24.070Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated20 Jun 2025, 22:58 WIB

Official record

MedPublished 20 Jun 2025, 04:31 WIB

CVE-2025-6281

OpenBMB XAgent community path traversal

A vulnerability has been found in OpenBMB XAgent up to 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /conv/community. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T21:31:05.566Z. Updated 2025-06-23T19:29:53.164Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record

MedPublished 20 Jun 2025, 04:27 WIB

CVE-2025-6280

TransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversal

A vulnerability, which was classified as critical, was found in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function download_attachment of the file SuperAGI/superagi/helper/read_email.py of the component EmailToolKit. The manipulation of the argument filename leads to path traversal. The exploit has been…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-19T21:27:45.359Z. Updated 2025-06-23T19:29:57.906Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Jun 2025, 02:29 WIB

Official record