Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2721–2740 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

HighPublished 12 Aug 2025, 00:59 WIB

CVE-2025-54063

Cherry Studio One-click Remote Code Execution Vulnerability through Custom URL Handling

Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T17:59:40.626Z. Updated 2025-08-11T18:15:43.581Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated12 Aug 2025, 01:15 WIB

Official record

CritPublished 12 Aug 2025, 00:50 WIB

CVE-2025-53187

Unauthenticated RCE

Due to an issue in configuration, code that was intended for debugging purposes was included in the market release of the ASPECT FW allowing an attacker to bypass authentication. This vulnerability may allow an attacker to change the system time, access files, and make function calls without prior authentication. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2721 to 2740 of 3629.First page Next page

Published 2025-08-11T17:50:01.166Z. Updated 2025-09-04T00:44:57.244Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 07:44 WIB

Official record

MedPublished 11 Aug 2025, 23:25 WIB

CVE-2025-8866

CVE-2025-8866

YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T16:25:35.897Z. Updated 2025-08-11T17:11:02.446Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 00:11 WIB

Official record

HighPublished 11 Aug 2025, 23:01 WIB

CVE-2025-38499

clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LO…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T16:01:08.257Z. Updated 2026-10-15T21:52:17.524Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

CritPublished 11 Aug 2025, 21:56 WIB

CVE-2012-10040

Openfiler v2.x NetworkCard Command Execution

Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T14:56:01.862Z. Updated 2026-04-07T14:02:36.751Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 11 Aug 2025, 21:55 WIB

CVE-2012-10039

ZEN Load Balancer Filelog Command Execution

ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. Z…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T14:55:52.604Z. Updated 2026-04-07T14:02:35.988Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 11 Aug 2025, 21:54 WIB

CVE-2012-10038

Auxilium RateMyPet Arbitrary File Upload RCE

Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T14:54:39.531Z. Updated 2026-04-07T14:02:34.811Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 11 Aug 2025, 21:54 WIB

CVE-2012-10037

PhpTax pfilez Parameter Exec Remote Code Injection

PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T14:54:16.517Z. Updated 2026-04-07T14:02:33.588Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

MedPublished 11 Aug 2025, 21:32 WIB

CVE-2025-8859

code-projects eBlog Site File Upload save-slider.php unrestricted upload

A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T14:32:05.712Z. Updated 2025-08-11T17:29:25.268Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 00:29 WIB

Official record

MedPublished 11 Aug 2025, 21:19 WIB

CVE-2025-8865

CVE-2025-8865

The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain malformed inputs. An authenticated attacker could exploit this issue to crash the YCQL tablet server, resulting in a denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T14:19:02.960Z. Updated 2025-08-11T15:04:04.232Z.

CVSS4.1v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 22:04 WIB

Official record

MedPublished 11 Aug 2025, 21:02 WIB

CVE-2025-8852

WuKongOpenSource WukongCRM API Response upload information exposure

A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T14:02:05.671Z. Updated 2025-08-11T15:36:58.682Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 22:36 WIB

Official record

MedPublished 11 Aug 2025, 20:32 WIB

CVE-2025-8851

LibTIFF tiffcrop tiffcrop.c readSeparateStripsetoBuffer stack-based overflow

A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T13:32:08.843Z. Updated 2025-08-12T13:43:18.136Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 20:43 WIB

Official record

MedPublished 11 Aug 2025, 20:30 WIB

CVE-2025-8864

CVE-2025-8864

Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T13:30:09.039Z. Updated 2025-08-11T15:05:42.481Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 22:05 WIB

Official record

HighPublished 11 Aug 2025, 20:03 WIB

CVE-2025-8863

CVE-2025-8863

YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T13:03:18.238Z. Updated 2025-08-11T15:08:45.940Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 22:08 WIB

Official record

MedPublished 11 Aug 2025, 20:02 WIB

CVE-2025-8847

yangzongzhuan RuoYi edit cross site scripting

A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice/edit. The manipulation of the argument noticeTitle/noticeContent leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T13:02:06.785Z. Updated 2025-08-12T13:42:58.718Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 20:42 WIB

Official record

HighPublished 11 Aug 2025, 19:40 WIB

CVE-2025-8862

CVE-2025-8862

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T12:40:35.201Z. Updated 2025-08-11T19:35:03.672Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 02:35 WIB

Official record

MedPublished 11 Aug 2025, 19:32 WIB

CVE-2025-8846

NASM Netwide Assember parser.c parse_line stack-based overflow

A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected is the function parse_line of the file parser.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T12:32:07.575Z. Updated 2025-08-11T19:41:08.735Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 02:41 WIB

Official record

MedPublished 11 Aug 2025, 19:21 WIB

CVE-2025-8672

TCC Bypass via Inherited Permissions in Bundled Interpreter in GIMP.app

MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T12:21:48.487Z. Updated 2025-08-11T19:45:08.822Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 02:45 WIB

Official record

MedPublished 11 Aug 2025, 19:02 WIB

CVE-2025-8845

NASM Netwide Assember nasm.c assemble_file stack-based overflow

A vulnerability was identified in NASM Netwide Assember 2.17rc0. This issue affects the function assemble_file of the file nasm.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T12:02:08.301Z. Updated 2025-08-12T13:43:32.950Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 20:43 WIB

Official record

MedPublished 11 Aug 2025, 18:32 WIB

CVE-2025-8844

NASM Netwide Assember preproc.c parse_smacro_template null pointer dereference

A vulnerability was determined in NASM Netwide Assember 2.17rc0. This vulnerability affects the function parse_smacro_template of the file preproc.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T11:32:08.340Z. Updated 2025-08-11T12:12:07.494Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:12 WIB

Official record