Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1141–1160 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 21 Aug 2025, 07:01 WIB

CVE-2025-27215

CVE-2025-27215

An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system. Affected Products: UniFi Connect Display Cast (Version 1.10.3 and earlier) UniFi Connect Display Cast Pro (Version 1.0.89 and earlier) U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:01:24.190Z. Updated 2025-08-21T14:46:44.681Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2025, 21:46 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:01 WIB

CVE-2025-27214

CVE-2025-27214

A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical or adjacent access to perform an unauthorized factory reset. Affected Products: UniFi Connect EV Station Pro (Version 1.5.18 and earlier) Mitigation: Update Un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1141 to 1160 of 3629.First page Next page

Published 2025-08-21T00:01:24.186Z. Updated 2025-08-21T14:46:51.491Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2025, 21:46 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:01 WIB

CVE-2025-27216

CVE-2025-27216

Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:01:24.177Z. Updated 2025-08-21T14:46:58.533Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2025, 21:46 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:01 WIB

CVE-2025-27217

CVE-2025-27217

A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:01:24.159Z. Updated 2025-08-21T14:47:06.360Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2025, 21:47 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2024-45438

CVE-2024-45438

An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. The file quarantine.php within the SpamTitan interface allows unauthenticated users to trigger account-level actions using a crafted GET request. Notably, when a non-existent email address is provided a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-11-03T19:30:54.287Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:30 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2024-50641

CVE-2024-50641

An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-08-21T18:56:26.719Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2025, 01:56 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-47184

CVE-2025-47184

An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 allows an authenticated, unprivileged attacker to achieve information disclosure and privilege escalation via a crafted ISys XML message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-09-11T17:45:24.043Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Sep 2025, 00:45 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-50860

CVE-2025-50860

SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-11-25T14:15:30.169Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Nov 2025, 21:15 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-51606

CVE-2025-51606

hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled binary to forge valid access tokens and impersonate any user, including privileged ones such as "admin". The vulnerability poses a critical security risk in systems…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-08-22T13:56:21.230Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2025, 20:56 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-51818

CVE-2025-51818

MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-08-22T15:55:00.414Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2025, 22:55 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-51989

CVE-2025-51989

HTML injection vulnerability in the registration interface in Evolution Consulting Kft. HRmaster module v235 allows an attacker to inject HTML tags into the "keresztnév" (firstname) field, which will be sent out in an email resulting in possible Phishing scenarios against any, previously not registered, email address.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2026-07-05T16:08:41.908Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:08 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-52194

CVE-2025-52194

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio files. The vulnerability occurs in the ircam_read_header function at src/ircam.c:164 during sample rate processing, leading to memory corruption and potential code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-08-21T19:56:46.362Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2025, 02:56 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-52351

CVE-2025-52351

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes the same password as a query parameter in the account activation URL (e.g., https://domain.com/activate=xyz). This practice can result in password exposure via browser history, proxy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-08-21T20:02:42.436Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2025, 03:02 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-52352

CVE-2025-52352

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to register accounts via APIs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-08-21T19:56:40.661Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2025, 02:56 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-52395

CVE-2025-52395

An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint that fails to validate the identity of the requester properly

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2025-08-21T16:03:31.683Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Aug 2025, 23:03 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-55366

CVE-2025-55366

Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account passwords and execute a horizontal privilege escalation attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2026-07-05T01:09:43.184Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:09 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-55367

CVE-2025-55367

Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2026-07-05T01:09:47.168Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:09 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-55368

CVE-2025-55368

Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify the supplier status under any account.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2026-07-05T01:09:51.076Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:09 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-55370

CVE-2025-55370

Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID data by modifying the ID value.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2026-07-05T01:09:55.093Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:09 WIB

Official record

UnscoredPublished 21 Aug 2025, 07:00 WIB

CVE-2025-55371

CVE-2025-55371

Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the information of the handler by executing the getAllList method.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-21T00:00:00.000Z. Updated 2026-07-05T01:09:58.972Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:09 WIB

Official record