Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 121–140 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 31 Jul 2025, 05:02 WIB

CVE-2025-8335

code-projects Simple Car Rental System cross-site request forgery

A vulnerability classified as problematic has been found in code-projects Simple Car Rental System 1.0. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T22:02:06.806Z. Updated 2025-07-31T14:34:25.859Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:34 WIB

Official record

MedPublished 31 Jul 2025, 04:32 WIB

CVE-2025-8334

Campcodes Online Recruitment Management System ajax.php sql injection

A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php?action=delete_recruitment_status. The manipulation of the argument ID leads to sql injection. The attack may be launched remote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 121 to 140 of 3774.First page Next page

Published 2025-07-30T21:32:05.858Z. Updated 2025-07-31T14:34:31.103Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:34 WIB

Official record

HighPublished 31 Jul 2025, 04:14 WIB

CVE-2025-54586

GitProxy is susceptible to a hidden commits injection attack

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T21:14:41.238Z. Updated 2025-07-31T17:55:46.333Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 00:55 WIB

Official record

MedPublished 31 Jul 2025, 04:02 WIB

CVE-2025-8333

code-projects Online Farm System categoryvalue.php sql injection

A vulnerability was found in code-projects Online Farm System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /categoryvalue.php. The manipulation of the argument Value leads to sql injection. The attack can be launched remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T21:02:05.135Z. Updated 2025-07-31T14:34:36.704Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:34 WIB

Official record

MedPublished 31 Jul 2025, 03:32 WIB

CVE-2025-8332

code-projects Online Farm System register.php sql injection

A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /register.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T20:32:06.315Z. Updated 2025-07-31T14:34:43.203Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:34 WIB

Official record

HighPublished 31 Jul 2025, 03:17 WIB

CVE-2025-54585

GitProxy is vulnerable to a new branch approval exploit

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations relying on GitProxy to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T20:17:20.844Z. Updated 2025-07-30T20:30:27.179Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 03:30 WIB

Official record

MedPublished 31 Jul 2025, 03:02 WIB

CVE-2025-8331

code-projects Online Farm System forgot_pass.php sql injection

A vulnerability was found in code-projects Online Farm System 1.0 and classified as critical. This issue affects some unknown processing of the file /forgot_pass.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T20:02:05.589Z. Updated 2025-07-30T20:16:06.045Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 03:16 WIB

Official record

HighPublished 31 Jul 2025, 03:01 WIB

CVE-2025-54584

GitProxy is vulnerable to a packfile parsing exploit

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T20:01:16.338Z. Updated 2025-07-30T20:19:21.613Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 03:19 WIB

Official record

HighPublished 31 Jul 2025, 02:59 WIB

CVE-2025-54583

GitProxy bypasses approvals when pushing multiple branches

GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T19:59:44.317Z. Updated 2025-07-30T20:13:10.804Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 03:13 WIB

Official record

HighPublished 31 Jul 2025, 02:57 WIB

CVE-2025-54581

vproxy is vulnerable to a divide by zero DoS attack

vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3.3 and below, untrusted data is extracted from the user-controlled HTTP Proxy-Authorization header and passed to Extension::try_from and flows into parse_ttl_extension where it is parsed as a TTL value. If an attacker supplies a TTL of zero (e.g. by using a us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T19:57:46.454Z. Updated 2025-07-30T20:23:36.826Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 03:23 WIB

Official record

MedPublished 31 Jul 2025, 02:55 WIB

CVE-2025-54575

ImageSharp Triggers an Infinite Loop in its GIF Decoder When Skipping Malformed Comment Extension Blocks

ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block (with a missing block terminator) can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. This leads to a denial …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T19:55:16.248Z. Updated 2025-07-30T19:59:35.532Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:59 WIB

Official record

HighPublished 31 Jul 2025, 02:45 WIB

CVE-2024-48916

Ceph is vulnerable to authentication bypass through RadosGW

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a known patched version has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T19:45:00.454Z. Updated 2025-07-30T19:54:42.022Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:54 WIB

Official record

CritPublished 31 Jul 2025, 02:41 WIB

CVE-2025-54576

OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions 7.10.0 and below, oauth2-proxy deployments are vulnerable when using the skip_auth_routes configuration option with regex patterns. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T19:41:04.189Z. Updated 2025-07-30T19:55:28.553Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:55 WIB

Official record

MedPublished 31 Jul 2025, 02:32 WIB

CVE-2025-8330

code-projects Vehicle Management edit1.php sql injection

A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. This vulnerability affects unknown code of the file /edit1.php. The manipulation of the argument sno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T19:32:05.677Z. Updated 2025-07-30T19:45:06.698Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:45 WIB

Official record

MedPublished 31 Jul 2025, 02:02 WIB

CVE-2025-8329

code-projects Vehicle Management filter3.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. This affects an unknown part of the file /filter3.php. The manipulation of the argument company leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T19:02:05.922Z. Updated 2025-07-30T19:19:35.407Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 02:19 WIB

Official record

MedPublished 31 Jul 2025, 01:18 WIB

CVE-2025-30103

CVE-2025-30103

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5 contains a Files or Directories Accessible to External Parties vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T18:18:02.955Z. Updated 2025-07-30T18:29:44.849Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 01:29 WIB

Official record

LowPublished 31 Jul 2025, 01:14 WIB

CVE-2025-36609

CVE-2025-36609

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Excerpt language: en.

Severity low: primary CNA CVSS 2.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T18:14:01.641Z. Updated 2025-07-30T18:31:00.614Z.

CVSS2.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 01:31 WIB

Official record

MedPublished 31 Jul 2025, 01:09 WIB

CVE-2025-36608

CVE-2025-36608

Dell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T18:09:48.039Z. Updated 2025-07-30T18:30:26.865Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 01:30 WIB

Official record

MedPublished 31 Jul 2025, 01:02 WIB

CVE-2025-8328

code-projects Exam Form Submission register.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Exam Form Submission 1.0. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument USN leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T18:02:05.852Z. Updated 2025-07-30T18:19:24.997Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 01:19 WIB

Official record

MedPublished 31 Jul 2025, 01:01 WIB

CVE-2025-30480

CVE-2025-30480

Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-30T18:01:53.920Z. Updated 2025-07-30T18:21:24.665Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 01:21 WIB

Official record