Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1261–1280 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

HighPublished 20 Aug 2025, 19:52 WIB

CVE-2025-8453

CVE-2025-8453

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user with console access modifies a configuration file used by a root-level daemon to execute custom scripts.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T12:52:50.191Z. Updated 2025-08-20T15:11:28.414Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:11 WIB

Official record

MedPublished 20 Aug 2025, 19:52 WIB

CVE-2025-54172

Stored Cross-Site Scripting in QuickCMS

QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. Regular admin user is not able to inject any JS scripts into the page. The vendor was…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1261 to 1280 of 3629.First page Next page

Published 2025-08-20T12:52:47.745Z. Updated 2025-08-20T15:12:10.775Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:12 WIB

Official record

MedPublished 20 Aug 2025, 19:32 WIB

CVE-2025-43749

CVE-2025-43749

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows unauthenticated users (guests) to access via URL files uploaded in the form and s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T12:32:15.890Z. Updated 2025-08-20T15:12:48.985Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:12 WIB

Official record

MedPublished 20 Aug 2025, 19:19 WIB

CVE-2025-4877

Libssh: write beyond bounds in binary to base64 conversion functions

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the pro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T12:19:18.520Z. Updated 2026-08-31T11:28:35.916Z.

CVSS4.5v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 18:28 WIB

Official record

MedPublished 20 Aug 2025, 19:19 WIB

CVE-2025-4437

Cri-o: large /etc/passwd file may lead to denial of service

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T12:19:18.453Z. Updated 2026-09-01T11:51:10.231Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 18:51 WIB

Official record

MedPublished 20 Aug 2025, 19:12 WIB

CVE-2025-43750

CVE-2025-43750

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows remote unauthenticated users (guests) to upload files via the form attachment fie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T12:12:19.779Z. Updated 2025-09-17T23:41:55.512Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Sep 2025, 06:41 WIB

Official record

MedPublished 20 Aug 2025, 18:54 WIB

CVE-2025-43741

CVE-2025-43741

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote authenticat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T11:54:34.594Z. Updated 2025-08-20T15:17:03.975Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:17 WIB

Official record

MedPublished 20 Aug 2025, 18:38 WIB

CVE-2025-7777

Mirror-registry: host header injection in mirror-registry

The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T11:38:59.459Z. Updated 2026-02-27T16:38:55.806Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 23:38 WIB

Official record

MedPublished 20 Aug 2025, 18:35 WIB

CVE-2025-43742

CVE-2025-43742

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows an remote non-authent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T11:35:14.494Z. Updated 2025-08-20T13:17:29.001Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Aug 2025, 20:17 WIB

Official record

MedPublished 20 Aug 2025, 18:26 WIB

CVE-2025-8102

Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions

The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This makes it possible for unauthenticated attackers to deactivate o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T11:26:09.579Z. Updated 2026-04-08T16:57:20.755Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:57 WIB

Official record

MedPublished 20 Aug 2025, 16:14 WIB

CVE-2025-57734

CVE-2025-57734

In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:14:01.457Z. Updated 2025-08-20T13:20:01.275Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 20:20 WIB

Official record

MedPublished 20 Aug 2025, 16:14 WIB

CVE-2025-57733

CVE-2025-57733

In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:14:00.896Z. Updated 2025-08-20T13:21:10.847Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 20:21 WIB

Official record

HighPublished 20 Aug 2025, 16:14 WIB

CVE-2025-57732

CVE-2025-57732

In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:14:00.271Z. Updated 2026-02-26T17:48:24.783Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

HighPublished 20 Aug 2025, 16:13 WIB

CVE-2025-57731

CVE-2025-57731

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:13:59.700Z. Updated 2025-08-20T15:25:43.894Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:25 WIB

Official record

MedPublished 20 Aug 2025, 16:13 WIB

CVE-2025-57730

CVE-2025-57730

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:13:59.164Z. Updated 2025-08-20T15:19:37.239Z.

CVSS5.2v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:19 WIB

Official record

MedPublished 20 Aug 2025, 16:13 WIB

CVE-2025-57729

CVE-2025-57729

In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:13:58.579Z. Updated 2026-02-26T17:48:25.319Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

MedPublished 20 Aug 2025, 16:13 WIB

CVE-2025-57728

CVE-2025-57728

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:13:57.934Z. Updated 2025-08-20T15:20:52.623Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:20 WIB

Official record

MedPublished 20 Aug 2025, 16:13 WIB

CVE-2025-57727

CVE-2025-57727

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T09:13:57.151Z. Updated 2025-08-20T15:21:13.202Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated20 Aug 2025, 22:21 WIB

Official record

UnscoredPublished 20 Aug 2025, 15:56 WIB

CVE-2024-39954

Apache EventMesh Runtime: SSRF

CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T08:56:41.560Z. Updated 2025-08-20T13:20:27.851Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Aug 2025, 20:20 WIB

Official record

MedPublished 20 Aug 2025, 15:36 WIB

CVE-2025-9229

Information Disclosure in MiR robots and MiR fleet through verbose error pages

Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-20T08:36:57.846Z. Updated 2025-11-05T12:09:23.900Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 19:09 WIB

Official record