Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2741–2760 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

MedPublished 11 Aug 2025, 18:02 WIB

CVE-2025-8843

NASM Netwide Assember outmacho.c macho_no_dead_strip heap-based overflow

A vulnerability was found in NASM Netwide Assember 2.17rc0. This affects the function macho_no_dead_strip of the file outmacho.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T11:02:09.017Z. Updated 2025-08-11T12:33:44.615Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:33 WIB

Official record

MedPublished 11 Aug 2025, 17:32 WIB

CVE-2025-8842

NASM Netwide Assember preproc.c do_directive use after free

A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2741 to 2760 of 3629.First page Next page

Published 2025-08-11T10:32:09.151Z. Updated 2025-08-11T12:34:33.576Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:34 WIB

Official record

MedPublished 11 Aug 2025, 17:02 WIB

CVE-2025-8841

zlt2000 microservices-platform FileController.java upload unrestricted upload

A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The manipulation leads to unrestricted upload. The attack can be launched remotely. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T10:02:06.203Z. Updated 2025-08-11T12:35:23.135Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:35 WIB

Official record

MedPublished 11 Aug 2025, 16:32 WIB

CVE-2025-8840

jshERP Endpoint deleteBatch improper authorization

A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T09:32:05.802Z. Updated 2025-08-11T12:49:40.283Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:49 WIB

Official record

CritPublished 11 Aug 2025, 16:04 WIB

CVE-2025-8853

2100 Technology｜Official Document Management System - Authentication Bypass

Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T09:04:20.323Z. Updated 2025-08-11T12:50:27.146Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:50 WIB

Official record

MedPublished 11 Aug 2025, 16:02 WIB

CVE-2025-8839

jshERP Endpoint addUser improper authorization

A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T09:02:08.591Z. Updated 2025-08-11T12:51:21.325Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:51 WIB

Official record

MedPublished 11 Aug 2025, 15:32 WIB

CVE-2025-8838

WinterChenS my-site Backend admin preHandle improper authentication

A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T08:32:06.586Z. Updated 2025-08-11T12:52:36.979Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 19:52 WIB

Official record

MedPublished 11 Aug 2025, 15:02 WIB

CVE-2025-8837

JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T08:02:07.784Z. Updated 2025-08-11T19:56:29.410Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 02:56 WIB

Official record

MedPublished 11 Aug 2025, 14:52 WIB

CVE-2025-8661

Stored Cross-Site Scripting in Symantec PGP Encryption 11.0.1

A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T07:52:39.431Z. Updated 2025-08-11T19:57:11.322Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 02:57 WIB

Official record

MedPublished 11 Aug 2025, 14:32 WIB

CVE-2025-8836

JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T07:32:08.430Z. Updated 2025-08-12T13:44:11.473Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 20:44 WIB

Official record

HighPublished 11 Aug 2025, 14:21 WIB

CVE-2025-8747

Keras safe_mode bypass allows arbitrary code execution when loading a malicious model.

A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted `.keras` model archive.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T07:21:16.619Z. Updated 2026-02-26T17:49:45.906Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

MedPublished 11 Aug 2025, 14:18 WIB

CVE-2025-8660

Privilege Escalation in Symantec PGP Encryption 11.0.1

Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T07:18:08.397Z. Updated 2025-08-11T14:59:58.663Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated11 Aug 2025, 21:59 WIB

Official record

MedPublished 11 Aug 2025, 14:02 WIB

CVE-2025-8835

JasPer Image Color Space Conversion jas_image.c jas_image_chclrspc null pointer dereference

A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T07:02:07.422Z. Updated 2025-08-12T13:46:19.331Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 20:46 WIB

Official record

MedPublished 11 Aug 2025, 13:32 WIB

CVE-2025-8834

JCG Link-net LW-N915R Wireless Basic Settings basic.asp cross site scripting

A vulnerability has been found in JCG Link-net LW-N915R 17s.20.001.908. Affected is an unknown function of the file /wireless/basic.asp of the component Wireless Basic Settings Page. The manipulation of the argument Network Name leads to cross site scripting. It is possible to launch the attack remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T06:32:06.665Z. Updated 2025-08-12T14:19:31.832Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 21:19 WIB

Official record

HighPublished 11 Aug 2025, 13:02 WIB

CVE-2025-8833

Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 langSwitchBack stack-based overflow

A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function langSwitchBack of the file /goform/langSwitchBack. The manipulation of the argument langSelectionOnly leads to stack-based buffer overflow. The attack may be initiated remotely. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T06:02:06.045Z. Updated 2025-08-11T20:10:10.133Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 03:10 WIB

Official record

UnscoredPublished 11 Aug 2025, 13:00 WIB

CVE-2025-7965

CBX Restaurant Booking <= 1.2.1 - Plugin Reset via CSRF

The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T06:00:02.778Z. Updated 2026-01-09T20:20:49.331Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Jan 2026, 03:20 WIB

Official record

HighPublished 11 Aug 2025, 12:32 WIB

CVE-2025-8832

Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setDMZ stack-based overflow

A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the function setDMZ of the file /goform/setDMZ. The manipulation of the argument DMZIPAddress leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T05:32:06.427Z. Updated 2025-08-11T20:11:06.369Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 03:11 WIB

Official record

HighPublished 11 Aug 2025, 12:02 WIB

CVE-2025-8831

Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 remoteManagement stack-based overflow

A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function remoteManagement of the file /goform/remoteManagement. The manipulation of the argument portNumber leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T05:02:06.522Z. Updated 2025-08-11T20:14:17.067Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 03:14 WIB

Official record

MedPublished 11 Aug 2025, 11:32 WIB

CVE-2025-8830

Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setWan sub_3517C os command injection

A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of the file /goform/setWan. The manipulation of the argument Hostname leads to os command injection. The attack may be launched remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T04:32:06.147Z. Updated 2025-08-11T20:29:35.103Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 03:29 WIB

Official record

HighPublished 11 Aug 2025, 11:24 WIB

CVE-2025-8854

bullet3 VHACD utility: stack-based buffer overflow in OFF parser (LoadOFF)

Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OFF file with an overlong initial token processed by the VHACD test utility or invoked indirectly through PyBullet's vhacd function.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-11T04:24:02.469Z. Updated 2025-08-11T20:32:47.464Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated12 Aug 2025, 03:32 WIB

Official record