Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2761–2780 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12157

Simple User Capabilities <= 1.0 - Missing Authorization to Unauthenticated Capability Reset

The Simple User Capabilities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to reset any user's capabilities.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:16.185Z. Updated 2026-04-08T16:46:57.760Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:46 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12410

SH Contextual Help <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation in the sh_contextual_help_dashboard_widget() function. This makes it possible for unauthenticated attackers to update the plugin's set…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2761 to 2780 of 3020.First page Next page

Published 2025-11-04T04:27:15.805Z. Updated 2026-04-08T16:46:07.809Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:46 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-11758

All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure

The All in One Time Clock Lite plugin for WordPress is vulnerable to unauthorized access due to a missing authorization check in all versions up to, and including, 2.0.3. This is due to the plugin exposing admin-level AJAX actions to unauthenticated users via wp_ajax_nopriv_ hooks, while relying only on a nonce check …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:15.403Z. Updated 2026-04-08T16:43:03.290Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:43 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12413

Social Media WPCF7 Stop Words <= 1.1.3 - Cross-Site Request Forgery to Settings Update

The Social Media WPCF7 Stop Words plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.3. This is due to missing or incorrect nonce validation on the smWpCfSwOptions() function. This makes it possible for unauthenticated attackers to update the plugin's settings and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:14.981Z. Updated 2026-04-08T16:42:56.439Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:42 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12350

DominoKit <= 1.1.0 - Missing Authorization to Unauthenticated Settings Update

The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_option_admin_action AJAX endpoint in all versions up to, and including, 1.1.0. This makes it possible for unauthenticated attackers to update plugin settings.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:14.553Z. Updated 2026-04-08T16:40:26.185Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:40 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12393

Free Quotation <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting

The Free Quotation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:14.125Z. Updated 2026-04-08T16:39:41.916Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:39 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12416

Pagerank Tools <= 1.1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Pagerank Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing nonce validation on the pr_save_settings() function and insufficient input sanitization. This makes it possible for unauthenticated atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:13.744Z. Updated 2026-04-08T16:37:24.988Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:37 WIB

Official record

HighPublished 04 Nov 2025, 11:27 WIB

CVE-2025-10896

Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload

Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:13.331Z. Updated 2026-04-08T16:35:52.884Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12412

Top Bar Notification <= 1.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on th tbn_ajax_add() function. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malici…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:12.930Z. Updated 2026-04-08T16:34:13.704Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:34 WIB

Official record

MedPublished 04 Nov 2025, 11:27 WIB

CVE-2025-12188

Posts Navigation Links for Sections and Headings - Free by WP Masters <= 1.0.1 - Cross-Site Request Forgery to Settings Update

The Posts Navigation Links for Sections and Headings – Free by WP Masters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the 'wpm_navigation_links_settings' page. This makes it possible for unauthentic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:27:12.323Z. Updated 2026-04-08T16:33:33.004Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:33 WIB

Official record

MedPublished 04 Nov 2025, 11:23 WIB

CVE-2025-12683

NULL DACL assigned to Named Pipe communicating with SYSTEM Service

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalation(only if chained with other elements) f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T04:23:02.884Z. Updated 2025-11-04T20:50:21.977Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated05 Nov 2025, 03:50 WIB

Official record

MedPublished 04 Nov 2025, 10:26 WIB

CVE-2025-12069

WP Global Screen Options <= 0.2 - Cross-Site Request Forgery to Screen Options Update

The WP Global Screen Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing nonce validation on the `updatewpglobalscreenoptions` action handler. This makes it possible for unauthenticated attackers to modify global screen options for a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:26:47.094Z. Updated 2026-04-08T17:27:25.458Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:27 WIB

Official record

CritPublished 04 Nov 2025, 10:26 WIB

CVE-2025-11008

CE21 Suite <= 2.3.1 - Unauthenticated Sensitive Information Exposure to Privilege Escalation

The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as other users as long as the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:26:46.726Z. Updated 2026-04-08T17:09:17.322Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:09 WIB

Official record

MedPublished 04 Nov 2025, 10:26 WIB

CVE-2025-12401

Label Plugins <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the label_plugins_options() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:26:46.350Z. Updated 2026-04-08T17:04:21.143Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

CritPublished 04 Nov 2025, 10:26 WIB

CVE-2025-11007

CE21 Suite 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via Plugin Settings Update

The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings includin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:26:45.901Z. Updated 2025-11-04T18:49:41.405Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 01:49 WIB

Official record

MedPublished 04 Nov 2025, 10:26 WIB

CVE-2025-12070

ViaAds <= 2.1.2 - Cross-Site Request Forgery to API Key Update

The ViaAds plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the `ViaAds_pluginHandler` function. This makes it possible for unauthenticated attackers to modify the plugin's API key and cookie consent settings via a f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:26:45.215Z. Updated 2026-04-08T16:32:25.505Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:32 WIB

Official record

MedPublished 04 Nov 2025, 10:19 WIB

CVE-2025-47370

Reachable Assertion in BT Controller

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:19:26.256Z. Updated 2025-11-04T19:00:52.629Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 02:00 WIB

Official record

HighPublished 04 Nov 2025, 10:19 WIB

CVE-2025-47368

Buffer Over-read in DSP Service

Memory corruption when dereferencing an invalid userspace address in a user buffer during MCDM IOCTL processing.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:19:24.982Z. Updated 2026-02-26T17:47:29.071Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

HighPublished 04 Nov 2025, 10:19 WIB

CVE-2025-47367

Out-of-bounds Write in WinBlast Driver

Memory corruption while accessing a buffer during IOCTL processing.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:19:23.734Z. Updated 2026-02-26T17:47:29.622Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

HighPublished 04 Nov 2025, 10:19 WIB

CVE-2025-47365

Integer Overflow or Wraparound in Automotive Platform

Memory corruption while processing large input data from a remote source via a communication interface.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-04T03:19:22.474Z. Updated 2026-02-26T17:47:29.940Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record