Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 1341–1360 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-63701

CVE-2025-63701

A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an undersized output buffer. The driver incorrectly assumes the output buffer size matches the input buffer size, leading t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2025-11-14T21:35:25.537Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Nov 2025, 04:35 WIB

Official record

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-63724

CVE-2025-63724

SQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2025-11-14T19:27:33.715Z.

CVSS

Showing 1341 to 1360 of 3020.First page Next page

—

KEVNot listed

EPSSPresent

Updated15 Nov 2025, 02:27 WIB

Official record

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-63725

CVE-2025-63725

Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2025-11-14T21:28:50.193Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Nov 2025, 04:28 WIB

Official record

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-63744

CVE-2025-63744

A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the load() function of bin_dyldcache.c. Processing a crafted file can cause a segmentation fault and crash the program.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2025-11-16T21:02:45.591Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Nov 2025, 04:02 WIB

Official record

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-63745

CVE-2025-63745

A NULL pointer dereference vulnerability was discovered in radare2 6.0.5 and earlier within the info() function of bin_ne.c. A crafted binary input can trigger a segmentation fault, leading to a denial of service when the tool processes malformed data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2025-11-14T21:31:01.937Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Nov 2025, 04:31 WIB

Official record

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-63830

CVE-2025-63830

CKFinder 1.4.3 is vulnerable to Cross Site Scripting (XSS) in the File Upload function. An attacker can upload a crafted SVG containing active content.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2025-11-14T21:27:26.031Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Nov 2025, 04:27 WIB

Official record

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-63891

CVE-2025-63891

Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema and credential hashes) via an unauthenticated HTTP GET request to /obs/database/obs_db.sql.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2026-07-05T16:11:26.397Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:11 WIB

Official record

UnscoredPublished 14 Nov 2025, 07:00 WIB

CVE-2025-64084

CVE-2025-64084

An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vucc_details_ajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenticated attacker to execute arbitrary SQL commands by injecting a ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-14T00:00:00.000Z. Updated 2025-11-16T21:03:47.185Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Nov 2025, 04:03 WIB

Official record

HighPublished 14 Nov 2025, 06:02 WIB

CVE-2025-64530

@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields. Apollo Federation incorr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T23:02:45.740Z. Updated 2025-11-14T15:57:42.013Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Nov 2025, 22:57 WIB

Official record

HighPublished 14 Nov 2025, 05:02 WIB

CVE-2025-13131

Sonarr Service Sonarr.Console.exe default permission

A vulnerability was found in Sonarr 4.0.15.2940. The impacted element is an unknown function of the file C:\ProgramData\Sonarr\bin\Sonarr.Console.exe of the component Service. Performing manipulation results in incorrect default permissions. The attack is only possible with local access. The vendor confirms this vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T22:02:07.748Z. Updated 2025-11-14T15:58:36.445Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated14 Nov 2025, 22:58 WIB

Official record

HighPublished 14 Nov 2025, 05:02 WIB

CVE-2025-13130

Radarr Service Radarr.Console.exe default permission

A vulnerability has been found in Radarr 5.28.0.10274. The affected element is an unknown function of the file C:\ProgramData\Radarr\bin\Radarr.Console.exe of the component Service. Such manipulation leads to incorrect default permissions. The attack can only be performed from a local environment. The vendor was contac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T22:02:05.548Z. Updated 2025-11-14T15:24:32.425Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated14 Nov 2025, 22:24 WIB

Official record

HighPublished 14 Nov 2025, 05:01 WIB

CVE-2025-36236

AIX Path Traversal

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request to write arbitrary files on the system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T22:01:31.264Z. Updated 2025-11-14T15:25:04.199Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated14 Nov 2025, 22:25 WIB

Official record

CritPublished 14 Nov 2025, 05:01 WIB

CVE-2025-36250

AIX Code Execution

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T22:01:27.447Z. Updated 2026-02-26T16:56:58.500Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:56 WIB

Official record

CritPublished 14 Nov 2025, 05:01 WIB

CVE-2025-36096

AIX Insufficiently Protected Credentials

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T22:01:22.072Z. Updated 2026-02-26T16:56:58.936Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:56 WIB

Official record

CritPublished 14 Nov 2025, 05:01 WIB

CVE-2025-36251

AIX Command Execution

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T22:01:13.345Z. Updated 2026-02-26T16:56:59.416Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:56 WIB

Official record

LowPublished 14 Nov 2025, 04:48 WIB

CVE-2025-64754

Jitsi Meet has DOM Redirect on Microsoft OAuth Flow

Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T21:48:08.692Z. Updated 2025-11-14T16:03:57.905Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated14 Nov 2025, 23:03 WIB

Official record

MedPublished 14 Nov 2025, 04:46 WIB

CVE-2025-64753

grist-core has insufficient access control in endpoints for comparisons between documents and versions

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or tables to which the use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T21:46:00.508Z. Updated 2025-11-14T16:17:23.927Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated14 Nov 2025, 23:17 WIB

Official record

MedPublished 14 Nov 2025, 04:43 WIB

CVE-2025-64752

grist-core has path to server-side requests via websocket

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack escalation. This issue is fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T21:43:57.610Z. Updated 2025-11-14T17:10:33.307Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated15 Nov 2025, 00:10 WIB

Official record

MedPublished 14 Nov 2025, 04:34 WIB

CVE-2025-64749

Directus Vulnerable to Information Leakage in Existing Collections

Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in the Directus REST API in versions of Directus prior to version 11.13.0. The `/items/{collection}` API returns different error messages for two cases: when a user tries to access an e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T21:34:54.603Z. Updated 2025-11-14T17:15:38.905Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated15 Nov 2025, 00:15 WIB

Official record

MedPublished 14 Nov 2025, 04:29 WIB

CVE-2025-64748

Directus's conceal fields are searchable if read permissions enabled

Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked (`****`), successful matches can be detected through returned r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-13T21:29:44.649Z. Updated 2025-11-13T21:39:43.765Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated14 Nov 2025, 04:39 WIB

Official record