Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1301–1320 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44655

CVE-2025-44655

In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2026-07-05T01:02:17.997Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:02 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44657

CVE-2025-44657

In Linksys EA6350 V2.1.2, the chroot_local_user option is enabled in the dynamically generated vsftpd configuration file. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2026-07-05T01:02:22.762Z.

Showing 1301 to 1320 of 3774.First page Next page

CVSS

—

KEVNot listed

EPSSPresent

Updated05 Jul 2026, 08:02 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-44658

CVE-2025-44658

In Netgear RAX30 V1.0.10.94, a PHP-FPM misconfiguration vulnerability is caused by not following the specification to only limit FPM to .php extensions. An attacker may exploit this by uploading malicious scripts disguised with alternate extensions and tricking the web server into executing them as PHP, bypassing secur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-08-07T13:43:33.448Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:43 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46116

CVE-2025-46116

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where an authenticated attacker can disable the passphrase requirement for a hidden CLI command `!v54!` via a management API call and then invoke it to escape the restrict…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T16:53:31.177Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 23:53 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46117

CVE-2025-46117

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where a hidden debug script `.ap_debug.sh` invoked from the restricted CLI does not properly sanitize its input, allowing an authenticated attacker to execute arbitrary co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-23T17:21:00.524Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jul 2025, 00:21 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46118

CVE-2025-46118

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139 and in Ruckus ZoneDirector prior to 10.5.1.0.279, where hard-coded credentials for the ftpuser account provide FTP access to the controller, enabling a remote attacker to upload or retrieve arbitrary files from writable fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-28T19:37:41.834Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jul 2025, 02:37 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46119

CVE-2025-46119

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where an authenticated request to the management endpoint `/admin/_cmdstat.jsp` discloses the administrator password in a trivially reversible obfuscated form. The same ob…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-23T17:19:32.729Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jul 2025, 00:19 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46120

CVE-2025-46120

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a path-traversal flaw in the web interface lets the server execute attacker-supplied EJS templates outside permitted directories, allowing a remote unauthenticated a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-23T17:18:49.943Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jul 2025, 00:18 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46121

CVE-2025-46121

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addStaFavourite` and `stamgr_cfg_adpt_addStaIot` pass a client hostname directly to snprintf as the format string. A remote attacker can exploit this flaw either by sending a crafted r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-28T19:42:06.394Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jul 2025, 02:42 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46122

CVE-2025-46122

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the authenticated diagnostics API endpoint `/admin/_cmdstat.jsp` passes attacker-controlled input to the shell without adequate validation, enabling a remote attacker to specify a target by MAC address and execute a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-23T17:16:46.566Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jul 2025, 00:16 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-46123

CVE-2025-46123

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.1.0.279, where the authenticated configuration endpoint `/admin/_conf.jsp` writes the Wi-Fi guest password to memory with snprintf using the attacker-supplied value as the format s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-24T20:25:38.729Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Jul 2025, 03:25 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51396

CVE-2025-51396

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:44:35.496Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:44 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51397

CVE-2025-51397

A stored cross-site scripting (XSS) vulnerability in the Facebook Chat module of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Surname parameter under the Recipient' Lists.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:41:32.084Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:41 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51398

CVE-2025-51398

A stored cross-site scripting (XSS) vulnerability in the Facebook registration page of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:39:50.296Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:39 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51400

CVE-2025-51400

A stored cross-site scripting (XSS) vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:38:16.326Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:38 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51401

CVE-2025-51401

A stored cross-site scripting (XSS) vulnerability in the chat transfer function of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the operator name parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:35:12.779Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:35 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51403

CVE-2025-51403

A stored cross-site scripting (XSS) vulnerability in the department assignment editing module of of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Alias Nick parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-21T19:40:01.470Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 02:40 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51868

CVE-2025-51868

Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the conversation_id parameter to the conversation_history endpoint.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:53:54.886Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:53 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-51869

CVE-2025-51869

Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted space_id, thread_id, and message_id parameters to the v1/space/{space_id}/thread/{thread_id}/message/{message_id} endpoint.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:33:04.838Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:33 WIB

Official record

UnscoredPublished 21 Jul 2025, 07:00 WIB

CVE-2025-52362

CVE-2025-52362

Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-21T00:00:00.000Z. Updated 2025-07-22T13:29:39.578Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jul 2025, 20:29 WIB

Official record