Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 261–280 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 26 Nov 2025, 04:31 WIB

CVE-2025-62703

Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer

Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework implements an RPC server…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T21:31:10.304Z. Updated 2025-11-26T15:59:41.232Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 22:59 WIB

Official record

HighKEVPublished 26 Nov 2025, 03:17 WIB

CVE-2025-58360

GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 261 to 280 of 3020.First page Next page

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-11-25T20:17:35.254Z. Updated 2026-02-26T16:07:29.959Z.

CVSS8.2v3.1KEVListedEPSSPresentUpdated26 Feb 2026, 23:07 WIB

Official record

HighPublished 26 Nov 2025, 02:59 WIB

CVE-2025-66017

CGGMP21 presignatures can be used in the way that significantly reduces security

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces security. cggmp24 ver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T19:59:07.956Z. Updated 2025-11-25T20:48:35.800Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated26 Nov 2025, 03:48 WIB

Official record

CritPublished 26 Nov 2025, 02:48 WIB

CVE-2025-66016

CGGMP24 is missing a check in the ZK proof used in CGGMP21

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which single malicious signer can reconstruct full private key. This is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T19:48:16.483Z. Updated 2025-11-25T20:57:34.072Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 Nov 2025, 03:57 WIB

Official record

HighPublished 26 Nov 2025, 02:43 WIB

CVE-2025-9624

OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T19:43:40.330Z. Updated 2025-12-15T14:04:03.148Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated15 Dec 2025, 21:04 WIB

Official record

HighPublished 26 Nov 2025, 02:36 WIB

CVE-2025-65965

Grype has a credential disclosure vulnerability in Grype JSON output

Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials wil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T19:36:11.090Z. Updated 2025-11-25T20:08:48.709Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated26 Nov 2025, 03:08 WIB

Official record

UnscoredPublished 26 Nov 2025, 02:15 WIB

CVE-2025-12816

CVE-2025-12816

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T19:15:50.243Z. Updated 2025-11-25T21:04:09.432Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 04:04 WIB

Official record

LowPublished 26 Nov 2025, 02:06 WIB

CVE-2025-65961

Contao is vulnerable to cross-site scripting in templates

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T19:06:37.395Z. Updated 2025-11-25T19:29:04.630Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 02:29 WIB

Official record

HighPublished 26 Nov 2025, 02:04 WIB

CVE-2025-34350

UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read

UnForm Server versions < 10.1.15 contain an unauthenticated arbitrary file read and SMB coercion vulnerability in the Doc Flow feature’s 'arc' endpoint. The Doc Flow module uses the 'arc' handler to retrieve and render pages or resources specified by the user-supplied 'pp' parameter, but it does so without enforcing au…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T19:04:13.305Z. Updated 2026-02-18T15:39:07.116Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Feb 2026, 22:39 WIB

Official record

MedPublished 26 Nov 2025, 01:54 WIB

CVE-2025-65960

Contao is vulnerable to remote code execution in template closures

Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:54:48.897Z. Updated 2025-11-25T20:00:14.687Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 03:00 WIB

Official record

HighPublished 26 Nov 2025, 01:10 WIB

CVE-2025-33203

CVE-2025-33203

NVIDIA NeMo Agent Toolkit UI for Web contains a vulnerability in the chat API endpoint where an attacker may cause a Server-Side Request Forgery. A successful exploit of this vulnerability may lead to information disclosure and denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:10:33.659Z. Updated 2025-11-26T15:58:54.292Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 22:58 WIB

Official record

HighPublished 26 Nov 2025, 01:07 WIB

CVE-2025-33205

CVE-2025-33205

NVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an untrusted control sphere by use of a predefined variable. A successful exploit of this vulnerability may lead to code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:07:20.804Z. Updated 2026-02-26T16:07:30.704Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:07 WIB

Official record

HighPublished 26 Nov 2025, 01:06 WIB

CVE-2025-33204

CVE-2025-33204

NVIDIA NeMo Framework for all platforms contains a vulnerability in the NLP and LLM components, where malicious data created by an attacker could cause code injection. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:06:22.946Z. Updated 2026-02-26T16:07:31.399Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:07 WIB

Official record

LowPublished 26 Nov 2025, 01:00 WIB

CVE-2025-33200

CVE-2025-33200

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:00:51.222Z. Updated 2025-11-25T21:33:39.747Z.

CVSS2.3v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 04:33 WIB

Official record

LowPublished 26 Nov 2025, 01:00 WIB

CVE-2025-33199

CVE-2025-33199

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause incorrect control flow behavior. A successful exploit of this vulnerability might lead to data tampering.

Excerpt language: en.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:00:38.785Z. Updated 2025-11-25T21:23:03.253Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 04:23 WIB

Official record

LowPublished 26 Nov 2025, 01:00 WIB

CVE-2025-33198

CVE-2025-33198

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:00:25.687Z. Updated 2025-11-25T21:07:34.785Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 04:07 WIB

Official record

MedPublished 26 Nov 2025, 01:00 WIB

CVE-2025-33197

CVE-2025-33197

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a NULL pointer dereference. A successful exploit of this vulnerability might lead to denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T18:00:11.847Z. Updated 2025-11-25T21:02:01.516Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 04:02 WIB

Official record

MedPublished 26 Nov 2025, 00:59 WIB

CVE-2025-33196

CVE-2025-33196

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause a resource to be reused. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T17:59:55.719Z. Updated 2025-11-25T20:13:43.804Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 03:13 WIB

Official record

MedPublished 26 Nov 2025, 00:59 WIB

CVE-2025-33195

CVE-2025-33195

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause unexpected memory buffer operations. A successful exploit of this vulnerability might lead to data tampering, denial of service, or escalation of privileges.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T17:59:42.186Z. Updated 2026-02-26T16:07:32.099Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:07 WIB

Official record

MedPublished 26 Nov 2025, 00:59 WIB

CVE-2025-33194

CVE-2025-33194

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper processing of input data. A successful exploit of this vulnerability might lead to information disclosure or denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T17:59:27.294Z. Updated 2025-11-25T19:38:56.479Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated26 Nov 2025, 02:38 WIB

Official record