Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 2581–2600 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 12 Sep 2025, 17:24 WIB

CVE-2025-10267

NewType Infortech｜NUP Portal - Missing Authentication

NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files. If the attacker manages to bypass the file extension restrictions, they could upload a webshell and execute it on the server side.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T10:24:06.546Z. Updated 2025-09-12T15:17:33.037Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 22:17 WIB

Official record

CritPublished 12 Sep 2025, 17:19 WIB

CVE-2025-10266

NewType Infortech｜NUP Portal - SQL Injection

NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T10:19:44.920Z. Updated 2025-09-12T15:41:20.826Z.

Showing 2581 to 2600 of 4319.First page Next page

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 22:41 WIB

Official record

HighPublished 12 Sep 2025, 17:15 WIB

CVE-2025-10265

Digiever｜NVR - OS Command Injection

Certain models of NVR developed by Digiever has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T10:15:46.072Z. Updated 2025-09-29T17:11:21.199Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 00:11 WIB

Official record

CritPublished 12 Sep 2025, 17:06 WIB

CVE-2025-10264

Digiever｜NVR - Exposure of Sensitive Information

Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the system configuration file and obtain plaintext credentials of the NVR and its connected cameras.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T10:06:12.163Z. Updated 2025-09-12T15:52:40.298Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 22:52 WIB

Official record

HighPublished 12 Sep 2025, 16:11 WIB

CVE-2025-7448

Man in the middle (MitM) attack vulnerability in Wi-SUN library

Wi-SUN unexpected 4- Way Handshake packet receptions may lead to predictable keys and potentially leading to Man in the middle (MitM) attack

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T09:11:53.850Z. Updated 2025-09-12T17:20:37.955Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated13 Sep 2025, 00:20 WIB

Official record

HighKEVPublished 12 Sep 2025, 14:21 WIB

CVE-2025-21043

CVE-2025-21043

Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-09-12T07:21:51.025Z. Updated 2026-10-07T19:59:17.893Z.

CVSS8.8v3.1KEVListedEPSSPresentUpdated08 Oct 2026, 02:59 WIB

Official record

HighKEVPublished 12 Sep 2025, 14:21 WIB

CVE-2025-21042

CVE-2025-21042

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-09-12T07:21:49.997Z. Updated 2026-10-07T20:01:48.070Z.

CVSS8.8v3.1KEVListedEPSSPresentUpdated08 Oct 2026, 03:01 WIB

Official record

MedPublished 12 Sep 2025, 13:06 WIB

CVE-2025-1250

Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T06:06:14.804Z. Updated 2025-09-12T17:20:05.685Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Sep 2025, 00:20 WIB

Official record

HighPublished 12 Sep 2025, 13:06 WIB

CVE-2025-2256

Improper Validation of Specified Quantity in Input in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T06:06:04.796Z. Updated 2025-09-12T17:19:32.801Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 Sep 2025, 00:19 WIB

Official record

HighPublished 12 Sep 2025, 13:05 WIB

CVE-2025-6454

Server-Side Request Forgery (SSRF) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T06:05:49.792Z. Updated 2025-09-12T17:18:59.590Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated13 Sep 2025, 00:18 WIB

Official record

MedPublished 12 Sep 2025, 13:05 WIB

CVE-2025-6769

Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to view administrator-only maintenance notes by accessing runner details through specific interfaces.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T06:05:44.797Z. Updated 2025-09-12T17:18:18.621Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated13 Sep 2025, 00:18 WIB

Official record

MedPublished 12 Sep 2025, 13:05 WIB

CVE-2025-7337

Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by uploading large files.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T06:05:35.035Z. Updated 2025-09-12T16:07:00.708Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 Sep 2025, 23:07 WIB

Official record

UnscoredPublished 12 Sep 2025, 13:00 WIB

CVE-2025-8280

Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI']

The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T06:00:06.157Z. Updated 2025-09-12T16:22:30.609Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Sep 2025, 23:22 WIB

Official record

UnscoredPublished 12 Sep 2025, 13:00 WIB

CVE-2025-3650

jQuery Colorbox <= 4.6.3 - Contributor+ Stored XSS

The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T06:00:03.695Z. Updated 2025-09-12T16:29:28.056Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Sep 2025, 23:29 WIB

Official record

MedPublished 12 Sep 2025, 12:50 WIB

CVE-2025-58781

CVE-2025-58781

WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T05:50:51.104Z. Updated 2025-09-12T16:30:11.420Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 23:30 WIB

Official record

MedPublished 12 Sep 2025, 12:32 WIB

CVE-2025-10291

linlinjava litemall cancel WxAftersaleController improper authorization

A weakness has been identified in linlinjava litemall up to 1.8.0. This affects the function WxAftersaleController of the file /wx/aftersale/cancel. Executing manipulation of the argument ID can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T05:32:07.780Z. Updated 2025-09-12T16:39:03.224Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 23:39 WIB

Official record

HighPublished 12 Sep 2025, 12:24 WIB

CVE-2025-8575

LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'

The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lws_cl_delete_file' function in all versions up to, and including, 2.4.1.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T05:24:31.396Z. Updated 2026-04-08T17:34:20.206Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:34 WIB

Official record

UnscoredPublished 12 Sep 2025, 12:10 WIB

CVE-2025-10148

predictable WebSocket mask

curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T05:10:37.469Z. Updated 2026-09-15T06:02:23.283Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Sep 2026, 13:02 WIB

Official record

UnscoredPublished 12 Sep 2025, 12:10 WIB

CVE-2025-9086

Out of bounds read for cookie path

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T05:10:03.815Z. Updated 2026-09-15T06:02:35.281Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Sep 2026, 13:02 WIB

Official record

MedPublished 12 Sep 2025, 12:02 WIB

CVE-2025-10288

roncoo roncoo-pay list improper authentication

A vulnerability was found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The impacted element is an unknown function of the file /user/info/list. Performing manipulation results in improper authentication. It is possible to initiate the attack remotely. The exploit has been made public and could b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-12T05:02:07.934Z. Updated 2025-09-12T13:04:22.764Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 20:04 WIB

Official record