Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2601–2620 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

CritPublished 12 Aug 2025, 23:33 WIB

CVE-2025-55167

WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T16:33:15.458Z. Updated 2025-08-12T17:42:46.954Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated13 Aug 2025, 00:42 WIB

Official record

MedPublished 12 Aug 2025, 23:25 WIB

CVE-2025-55166

svg-sanitizer By-Passing Attribute Sanitization

savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patche…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2601 to 2620 of 3629.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T16:25:17.220Z. Updated 2025-08-12T17:48:05.000Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated13 Aug 2025, 00:48 WIB

Official record

MedPublished 12 Aug 2025, 23:06 WIB

CVE-2025-3089

Broken Access Control in ServiceNow AI Platform

ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T16:06:39.883Z. Updated 2025-08-12T18:17:15.832Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated13 Aug 2025, 01:17 WIB

Official record

HighPublished 12 Aug 2025, 23:02 WIB

CVE-2025-55164

content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE

content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T16:02:44.952Z. Updated 2025-08-20T19:39:47.679Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated21 Aug 2025, 02:39 WIB

Official record

HighPublished 12 Aug 2025, 23:02 WIB

CVE-2025-38500

xfrm: interface: fix use-after-free after changing collect_md xfrm interface

In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces. The check to enforce this was…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T16:02:42.363Z. Updated 2026-08-05T12:02:27.344Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:02 WIB

Official record

CritPublished 12 Aug 2025, 22:57 WIB

CVE-2025-55010

Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the project_activities table. A…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T15:57:13.343Z. Updated 2025-08-12T16:24:36.343Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated12 Aug 2025, 23:24 WIB

Official record

MedPublished 12 Aug 2025, 22:57 WIB

CVE-2025-55011

Kanboard Path Traversal in File Write via Task File Upload Api

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate whether the task_id parameter is a valid task id, nor does it check for path traversal. As a result, a malicious actor could write a file anywhere on the system…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T15:57:08.108Z. Updated 2025-08-12T19:31:01.757Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated13 Aug 2025, 02:31 WIB

Official record

MedPublished 12 Aug 2025, 22:48 WIB

CVE-2025-54864

Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T15:48:54.115Z. Updated 2025-08-12T16:06:33.566Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 23:06 WIB

Official record

HighPublished 12 Aug 2025, 22:47 WIB

CVE-2025-54800

Hydra persistent XSS in build metrics

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T15:47:11.337Z. Updated 2025-08-12T15:57:41.274Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 22:57 WIB

Official record

MedPublished 12 Aug 2025, 22:23 WIB

CVE-2025-8452

Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.

By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default administrator password.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T15:23:00.577Z. Updated 2025-10-08T13:39:35.427Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Oct 2025, 20:39 WIB

Official record

MedPublished 12 Aug 2025, 22:05 WIB

CVE-2025-5468

CVE-2025-5468

Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T15:05:23.222Z. Updated 2025-08-12T18:58:34.165Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated13 Aug 2025, 01:58 WIB

Official record

MedPublished 12 Aug 2025, 22:00 WIB

CVE-2025-5466

CVE-2025-5466

XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T15:00:05.978Z. Updated 2025-08-12T19:00:58.665Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated13 Aug 2025, 02:00 WIB

Official record

HighPublished 12 Aug 2025, 21:56 WIB

CVE-2025-5462

CVE-2025-5462

A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:56:19.798Z. Updated 2025-08-12T15:08:46.265Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated12 Aug 2025, 22:08 WIB

Official record

HighPublished 12 Aug 2025, 21:50 WIB

CVE-2025-5456

CVE-2025-5456

A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:50:46.329Z. Updated 2025-08-12T15:05:53.651Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated12 Aug 2025, 22:05 WIB

Official record

HighPublished 12 Aug 2025, 21:48 WIB

CVE-2025-3831

Exposed SFTP server

Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:48:26.195Z. Updated 2025-08-12T15:02:44.904Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated12 Aug 2025, 22:02 WIB

Official record

MedPublished 12 Aug 2025, 21:42 WIB

CVE-2025-8310

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:42:31.728Z. Updated 2026-02-26T17:49:41.618Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

HighPublished 12 Aug 2025, 21:37 WIB

CVE-2025-8297

CVE-2025-8297

Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:37:23.954Z. Updated 2026-02-26T17:49:41.972Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

HighPublished 12 Aug 2025, 21:33 WIB

CVE-2025-8296

CVE-2025-8296

SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:33:47.566Z. Updated 2026-02-26T17:49:42.379Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

MedPublished 12 Aug 2025, 21:13 WIB

CVE-2024-38805

iSCSI Remote Memory Corruption and Denial of Service

EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:13:28.174Z. Updated 2025-08-12T14:34:39.772Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated12 Aug 2025, 21:34 WIB

Official record

HighPublished 12 Aug 2025, 21:02 WIB

CVE-2025-22830

SmiFlash Race Condition Vulnerability

APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-12T14:02:50.803Z. Updated 2025-08-12T14:40:09.250Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 21:40 WIB

Official record