Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 2561–2580 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

MedPublished 10 Jun 2025, 17:05 WIB

CVE-2025-40658

Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS

An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelection.asp.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T10:05:46.265Z. Updated 2025-06-10T13:04:47.377Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:04 WIB

Official record

CritPublished 10 Jun 2025, 17:04 WIB

CVE-2025-40657

SQL injection vulnerability in DM Corporative CMS

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the codform parameter in /modules/forms/collectform.asp.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T10:04:09.279Z. Updated 2025-06-10T19:59:50.416Z.

Showing 2561 to 2580 of 3682.First page Next page

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated11 Jun 2025, 02:59 WIB

Official record

CritPublished 10 Jun 2025, 17:03 WIB

CVE-2025-40656

SQL injection vulnerability in DM Corporative CMS

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the cod parameter in /administer/node-selection/data.asp.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T10:03:49.029Z. Updated 2025-06-10T13:06:37.697Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:06 WIB

Official record

CritPublished 10 Jun 2025, 17:03 WIB

CVE-2025-40655

SQL injection vulnerability in DM Corporative CMS

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name parameter in /antcatalogue.asp.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T10:03:24.120Z. Updated 2025-06-10T14:13:50.233Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:13 WIB

Official record

CritPublished 10 Jun 2025, 17:01 WIB

CVE-2025-40654

SQL injection vulnerability in DM Corporative CMS

A SQL injection vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to retrieve, create, update and delete databases through the name and cod parameters in /antbuspre.asp.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T10:01:14.010Z. Updated 2025-06-10T14:16:13.950Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:16 WIB

Official record

HighPublished 10 Jun 2025, 15:44 WIB

CVE-2025-4681

CVE-2025-4681

Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affects upKeeper Instant Privilege Access: before 1.4.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:44:14.160Z. Updated 2025-06-10T14:18:17.300Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:18 WIB

Official record

MedPublished 10 Jun 2025, 15:43 WIB

CVE-2025-3117

CVE-2025-3117

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:43:15.540Z. Updated 2025-06-10T14:19:52.530Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:19 WIB

Official record

HighPublished 10 Jun 2025, 15:41 WIB

CVE-2025-4680

CVE-2025-4680

Improper Input Validation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects upKeeper Instant Privilege Access: before 1.4.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:41:44.594Z. Updated 2025-06-10T14:20:53.952Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:20 WIB

Official record

HighPublished 10 Jun 2025, 15:34 WIB

CVE-2025-3116

CVE-2025-3116

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:34:50.585Z. Updated 2025-06-10T14:21:34.597Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:21 WIB

Official record

MedPublished 10 Jun 2025, 15:32 WIB

CVE-2025-3905

CVE-2025-3905

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impacting PLC system variables that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:32:09.065Z. Updated 2025-06-10T14:23:25.411Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:23 WIB

Official record

HighPublished 10 Jun 2025, 15:28 WIB

CVE-2025-3112

CVE-2025-3112

CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sends manipulated HTTPS Content-Length header to the webserver.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:28:31.391Z. Updated 2025-06-10T14:24:46.175Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:24 WIB

Official record

MedPublished 10 Jun 2025, 15:25 WIB

CVE-2025-3899

CVE-2025-3899

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:25:39.254Z. Updated 2025-06-10T14:33:59.816Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:33 WIB

Official record

HighPublished 10 Jun 2025, 15:22 WIB

CVE-2025-3898

CVE-2025-3898

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:22:02.228Z. Updated 2025-06-10T14:35:45.654Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 21:35 WIB

Official record

HighPublished 10 Jun 2025, 15:15 WIB

CVE-2025-5743

CVE-2025-5743

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote control over the charging station when an authenticated user modifies configuration parameters on the web server.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:15:42.268Z. Updated 2025-10-07T03:29:00.117Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated07 Oct 2025, 10:29 WIB

Official record

MedPublished 10 Jun 2025, 15:11 WIB

CVE-2025-5742

CVE-2025-5742

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated user modifies configuration parameters on the web server

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:11:55.330Z. Updated 2025-06-10T13:08:22.827Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:08 WIB

Official record

MedPublished 10 Jun 2025, 15:09 WIB

CVE-2025-5741

CVE-2025-5741

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file reads from the charging station. The exploitation of this vulnerability does require an authenticated session of the web server.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:09:21.392Z. Updated 2025-06-10T13:08:45.816Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 20:08 WIB

Official record

HighPublished 10 Jun 2025, 15:06 WIB

CVE-2025-5740

CVE-2025-5740

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary file writes when an authenticated user on the web server manipulates file path.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T08:06:49.986Z. Updated 2025-10-07T03:27:41.387Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated07 Oct 2025, 10:27 WIB

Official record

UnscoredPublished 10 Jun 2025, 14:55 WIB

CVE-2025-27817

Apache Kafka Client: Arbitrary file read and SSRF vulnerability

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows cli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T07:55:14.422Z. Updated 2025-06-10T15:15:40.843Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

UnscoredPublished 10 Jun 2025, 14:54 WIB

CVE-2025-27819

Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration

In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T07:54:41.896Z. Updated 2025-06-10T15:15:58.031Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

UnscoredPublished 10 Jun 2025, 14:52 WIB

CVE-2025-27818

Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration

A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T07:52:31.778Z. Updated 2026-02-26T17:51:05.352Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:51 WIB

Official record