Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1281–1300 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

HighPublished 21 Jul 2025, 13:16 WIB

CVE-2025-7919

Simopro Technology｜WinMatrix3 Web package - SQL Injection

WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T06:16:00.562Z. Updated 2025-07-21T15:28:33.924Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 22:28 WIB

Official record

CritPublished 21 Jul 2025, 13:12 WIB

CVE-2025-7918

Simopro Technology｜WinMatrix3 Web package - SQL Injection

WinMatrix3 Web package developed by Simopro Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T06:12:49.798Z. Updated 2025-07-21T15:39:22.593Z.

Showing 1281 to 1300 of 3774.First page Next page

CVSS9.3v4.0

KEVNot listed

EPSSPresent

Updated21 Jul 2025, 22:39 WIB

Official record

HighPublished 21 Jul 2025, 13:08 WIB

CVE-2025-7917

Simopro Technology｜WinMatrix3 Web package - Arbitrary File Upload

WinMatrix3 Web package developed by Simopro Technology has an Arbitrary File Upload vulnerability, allowing remote attackers with administrator privileges to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T06:08:38.612Z. Updated 2025-07-21T15:39:46.038Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated21 Jul 2025, 22:39 WIB

Official record

CritPublished 21 Jul 2025, 12:57 WIB

CVE-2025-7916

Simopro Technology｜WinMatrix3 - Insecure Deserialization

WinMatrix3 developed by Simopro Technology has an Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized contents.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T05:57:51.661Z. Updated 2025-07-21T18:23:55.612Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 01:23 WIB

Official record

MedPublished 21 Jul 2025, 07:32 WIB

CVE-2025-7915

Chanjet CRM Login Page mailinactive.php sql injection

A vulnerability was found in Chanjet CRM 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /mail/mailinactive.php of the component Login Page. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:32:04.959Z. Updated 2025-07-21T18:20:38.629Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 01:20 WIB

Official record

HighPublished 21 Jul 2025, 07:02 WIB

CVE-2025-7914

Tenda AC6 httpd setparentcontrolinfo buffer overflow

A vulnerability has been found in Tenda AC6 15.03.06.50 and classified as critical. Affected by this vulnerability is the function setparentcontrolinfo of the component httpd. The manipulation leads to buffer overflow. The attack can be launched remotely.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:02:07.481Z. Updated 2025-07-21T18:17:40.558Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Jul 2025, 01:17 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2020-26799

CVE-2020-26799

A reflected cross-site scripting (XSS) vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-21T18:56:22.377Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 01:56 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2024-55040

CVE-2024-55040

Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T15:46:27.739Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:46 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-36845

CVE-2025-36845

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The endpoint /_internal/redirect.php allows for Server-Side Request Forgery (SSRF). The endpoint takes a URL as input, sends a request to this address, and reflects the content in the response. This can be used to request endpoints only reachable by the appli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-21T19:00:44.901Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 02:00 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-36846

CVE-2025-36846

An issue was discovered in Eveo URVE Web Manager 27.02.2025. The application exposes a /_internal/pc/vpro.php localhost endpoint to unauthenticated users that is vulnerable to OS Command Injection. The endpoint takes an input parameter that is passed directly into the shell_exec() function of PHP. NOTE: this can be cha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-21T19:05:38.118Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 02:05 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-43720

CVE-2025-43720

Headwind MDM before 5.33.1 makes configuration details accessible to unauthorized users. The Configuration profile is exposed to the Observer user role, revealing the password requires to escape out of the MDM controlled device's profile.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:52:37.367Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:52 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-43976

CVE-2025-43976

The com.enflick.android.tn2ndLine application through 24.17.1.0 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T15:51:13.268Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:51 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-43977

CVE-2025-43977

The com.skt.prod.dialer application through 12.5.0 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.skt.prod.dialer.activities.outgoingcall.OutgoingCallInternalBroadcaster component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T15:51:32.586Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 22:51 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44647

CVE-2025-44647

In TRENDnet TEW-WLC100P 2.03b03, the i_dont_care_about_security_and_use_aggressive_mode_psk option is enabled in the strongSwan configuration file, so that IKE Responders are allowed to use IKEv1 Aggressive Mode with Pre-Shared Keys to conduct offline attacks on the openly transmitted hash of the PSK.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2026-07-05T01:06:44.900Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:06 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44649

CVE-2025-44649

In the configuration file of racoon in the TRENDnet TEW-WLC100P 2.03b03, the first item of exchage_mode is set to aggressive. Aggressive mode in IKE Phase 1 exposes identity information in plaintext, is vulnerable to offline dictionary attacks, and lacks flexibility in negotiating security parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2026-07-29T14:46:22.842Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jul 2026, 21:46 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44650

CVE-2025-44650

In Netgear R7000 V1.3.1.64_10.1.36 and EAX80 V1.0.1.70_1.0.2, the USERLIMIT_GLOBAL option is set to 0 in the bftpd.conf configuration file. This can cause DoS attacks when unlimited users are connected.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-08-07T13:29:43.759Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:29 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44651

CVE-2025-44651

In TRENDnet TPL-430AP FW1.0, the USERLIMIT_GLOBAL option is set to 0 in the bftpd-related configuration file. This can cause DoS attacks when unlimited users are connected.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2026-07-05T01:06:53.200Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:06 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44652

CVE-2025-44652

In Netgear RAX30 V1.0.10.94_3, the USERLIMIT_GLOBAL option is set to 0 in multiple bftpd-related configuration files. This can cause DoS attacks when unlimited users are connected.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-08-07T13:32:29.448Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:32 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44653

CVE-2025-44653

In H3C GR2200 MiniGR1A0V100R016, the USERLIMIT_GLOBAL option is set to 0 in the /etc/bftpd.conf. This can cause DoS attacks when unlimited users are connected.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2026-07-05T01:06:57.074Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:06 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44654

CVE-2025-44654

In Linksys E2500 3.0.04.002, the chroot_local_user option is enabled in the vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2026-07-29T14:46:56.171Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jul 2026, 21:46 WIB

Official record