Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 1321–1340 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 20 Sep 2025, 02:15 WIB

CVE-2025-43809

CVE-2025-43809

Cross-Site Request Forgery (CSRF) vulnerability in the server (license) registration page in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.9, 7.4 GA through update 92, and older unsupported versions allows remote attackers …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T19:15:50.893Z. Updated 2025-09-19T19:48:50.196Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Sep 2025, 02:48 WIB

Official record

CritPublished 20 Sep 2025, 01:55 WIB

CVE-2022-4980

General Bytes Crypto Application Server (CAS) Unauthenticated Creation of Admin Account via Default-installation/First-admin Page

General Bytes Crypto Application Server (CAS) beginning with version 20201208 prior to 20220531.38 (backport) and 20220725.22 (mainline) contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used by the product's default-installation / first-admin creation p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1321 to 1340 of 4319.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:55:02.928Z. Updated 2025-11-21T16:07:20.732Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated21 Nov 2025, 23:07 WIB

Official record

CritPublished 20 Sep 2025, 01:54 WIB

CVE-2024-13990

MicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of Updates

MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle (MitM) attack and substitute malicious update payloads for legitimate o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:54:08.729Z. Updated 2025-11-19T15:58:41.454Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 22:58 WIB

Official record

MedPublished 20 Sep 2025, 01:53 WIB

CVE-2025-26517

CVE-2025-26517 Privilege Escalation Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a privilege escalation vulnerability. Successful exploit could allow an unauthorized authenticated attacker to discover Grid node names and IP addresses or modify Storage Grades.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:53:07.531Z. Updated 2025-09-19T19:07:36.019Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated20 Sep 2025, 02:07 WIB

Official record

HighPublished 20 Sep 2025, 01:51 WIB

CVE-2025-34191

Vasion Print (formerly PrinterLogic) Arbitrary File Write as Root via Response Path Symlink Follow

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) contain an arbitrary file write vulnerability via the response file handling. When tasks produce output the service writes response data into files under /opt/Printe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:51:42.645Z. Updated 2026-05-15T11:15:11.640Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

MedPublished 20 Sep 2025, 01:51 WIB

CVE-2025-26516

CVE-2025-26516 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:51:12.609Z. Updated 2025-09-19T19:06:24.828Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated20 Sep 2025, 02:06 WIB

Official record

HighPublished 20 Sep 2025, 01:51 WIB

CVE-2025-34190

Vasion Print (formerly PrinterLogic) PrinterInstallerClientService Authentication Bypass via LD_PRELOAD Hooking

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (macOS/Linux client deployments) are vulnerable to an authentication bypass in PrinterInstallerClientService. The service requires root privileges for certain administrative operations, but…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:51:12.091Z. Updated 2026-05-25T23:41:29.469Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:41 WIB

Official record

CritPublished 20 Sep 2025, 01:50 WIB

CVE-2025-34205

Vasion Print (formerly PrinterLogic) Dangerous PHP Dead Code Enables RCE

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead code present in multiple Docker-hosted PHP instances. A script named /var/www/app/resetroot.php (found in several containers) lacks authenticati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:50:38.657Z. Updated 2026-05-15T11:15:20.825Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

MedPublished 20 Sep 2025, 01:50 WIB

CVE-2025-43803

CVE-2025-43803

Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to vi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:50:09.161Z. Updated 2025-09-19T19:13:03.380Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Sep 2025, 02:13 WIB

Official record

HighPublished 20 Sep 2025, 01:50 WIB

CVE-2025-34202

Vasion Print (formerly PrinterLogic) Insecure Access to Docker Instances WAN

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 (VA and SaaS deployments) expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a gateway — to reach cont…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:50:09.021Z. Updated 2026-05-26T11:51:52.802Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 18:51 WIB

Official record

MedPublished 20 Sep 2025, 01:49 WIB

CVE-2025-34189

Vasion Print (formerly PrinterLogic) Insecure Inter-Process Communication Allows Local Session Hijacking

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local inter-process communication (IPC) mechanism. The software stores IPC request and response files inside /opt/PrinterInsta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:49:29.691Z. Updated 2026-05-15T11:15:10.093Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

CritPublished 20 Sep 2025, 01:48 WIB

CVE-2025-34206

Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host configuration and secret material under /var/www/efs_storage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in .secrets, MySQL clien…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:48:58.217Z. Updated 2025-11-17T23:56:33.927Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 06:56 WIB

Official record

CritPublished 20 Sep 2025, 01:48 WIB

CVE-2025-34199

Vasion Print (formerly PrinterLogic) Insecure SSL Verification Allows Man-in-the-Middle Attacks

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 (VA and SaaS deployments) contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal microservices. In multiple p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:48:05.124Z. Updated 2026-05-15T11:15:18.510Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 20 Sep 2025, 01:47 WIB

CVE-2025-34193

Vasion Print (formerly PrinterLogic) Insecure Windows Components Lack Modern Memory Protections and Use Outdated Runtimes

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client components (PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLauncher.exe) that lack modern compile-time and runtime exploit mit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:47:35.733Z. Updated 2026-05-15T11:15:13.407Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 20 Sep 2025, 01:47 WIB

CVE-2025-34201

Vasion Print (formerly PrinterLogic) Lack of Network Segmentation Between Docker Instances

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) run many Docker containers on shared internal networks without firewalling or segmentation between instances. A compromise of any single container allows direct access to internal services (HTTP, Redis, MySQL, etc.) on…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:47:07.728Z. Updated 2025-11-17T23:56:33.115Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 06:56 WIB

Official record

HighPublished 20 Sep 2025, 01:46 WIB

CVE-2025-34188

Vasion Print (formerly PrinterLogic) Local Log Disclosure of Cleartext Sessions

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local logging mechanism. Authentication session tokens, including PHPSESSID, XSRF-TOKEN, and laravel_session, are stored in cleartext w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:46:40.632Z. Updated 2026-05-15T11:15:09.256Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 20 Sep 2025, 01:46 WIB

CVE-2025-34194

Vasion Print (formerly PrinterLogic) Local Privilege Escalation via Insecure Temporary File Handling

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software creates files as NT AUTHORITY\SYSTEM inside a d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:46:12.462Z. Updated 2026-05-25T23:41:30.172Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:41 WIB

Official record

HighPublished 20 Sep 2025, 01:45 WIB

CVE-2025-34200

Vasion Print (formerly PrinterLogic) Network Account Password Stored in Cleartext

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with local shell access can read /etc/issue to obtain the network ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:45:41.248Z. Updated 2025-11-17T23:56:32.928Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 06:56 WIB

Official record

HighPublished 20 Sep 2025, 01:41 WIB

CVE-2025-34204

Vasion Print (formerly PrinterLogic) Processes Running as Root Inside Docker Instances

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) contains multiple Docker containers that run primary application processes (for example PHP workers, Node.js servers and custom binaries) as the root user. This increases the blast radius of a container compromise and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:41:02.997Z. Updated 2025-11-17T23:56:33.612Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 06:56 WIB

Official record

CritPublished 20 Sep 2025, 01:40 WIB

CVE-2025-34198

Vasion Print (formerly PrinterLogic) Shared / Hardcoded SSH Host Private Keys in Appliance Image

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys (RSA, ECDSA, and ED25519) are present across installations, rather than b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-19T18:40:31.977Z. Updated 2026-05-15T11:15:17.569Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record