Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2881–2900 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

CritPublished 09 Aug 2025, 01:11 WIB

CVE-2012-10044

MobileCartly 1.0 savepage.php Arbitrary File Creation

MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking file_put_contents() on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T18:11:31.472Z. Updated 2026-04-07T14:02:39.641Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 09 Aug 2025, 01:11 WIB

CVE-2012-10046

E-Mail Security Virtual Appliance learn-msg.cgi Command Injection

The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2881 to 2900 of 3629.First page Next page

Published 2025-08-08T18:11:08.292Z. Updated 2026-04-07T14:02:41.070Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 09 Aug 2025, 01:10 WIB

CVE-2012-10052

EGallery 1.2 Arbitrary PHP File Upload

EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full rem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T18:10:46.550Z. Updated 2026-04-07T14:02:46.161Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 09 Aug 2025, 01:10 WIB

CVE-2012-10047

Cyclope Employee Surveillance Solution v6.x SQL Injection

Cyclope Employee Surveillance Solution versions 6.x are vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T18:10:24.982Z. Updated 2026-07-28T01:46:25.986Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

CritPublished 09 Aug 2025, 01:10 WIB

CVE-2012-10050

CuteFlow <= 2.11.2 Arbitrary File Upload RCE

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T18:10:03.287Z. Updated 2026-05-15T11:13:58.480Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:13 WIB

Official record

CritPublished 09 Aug 2025, 01:09 WIB

CVE-2010-10013

AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE

An unauthenticated remote command execution vulnerability exists in AjaXplorer (now known as Pydio Cells) versions prior to 2.6. The flaw resides in the checkInstall.php script within the access.ssh plugin, which fails to properly sanitize user-supplied input to the destServer GET parameter. By injecting shell metachar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T18:09:40.513Z. Updated 2026-05-15T11:13:20.560Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:13 WIB

Official record

CritPublished 09 Aug 2025, 01:09 WIB

CVE-2012-10043

ActFax 4.32 Client Importer Buffer Overflow

A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy() during CSV parsing. An at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T18:09:17.239Z. Updated 2026-04-07T14:02:38.995Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 09 Aug 2025, 00:24 WIB

CVE-2025-5095

Burk Technology ARC Solo Missing Authentication for Critical Function

Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. A password change request can be sent directly to the device's HTTP endpoint without providing valid credentials. The system does not enforce proper authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T17:24:32.553Z. Updated 2025-08-08T18:55:32.283Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 01:55 WIB

Official record

MedPublished 08 Aug 2025, 23:32 WIB

CVE-2025-8732

libxml2 xmlcatalog xmlParseSGMLCatalog recursion

A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the component xmlcatalog. The manipulation leads to uncontrolled recursion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T16:32:06.990Z. Updated 2026-06-02T12:59:45.337Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 19:59 WIB

Official record

CritPublished 08 Aug 2025, 23:27 WIB

CVE-2025-8284

Packet Power EMX and EG Missing Authentication for Critical Function

By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users to access and manipulate monitoring and control functions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T16:27:14.031Z. Updated 2025-08-08T19:14:38.595Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:14 WIB

Official record

HighPublished 08 Aug 2025, 23:23 WIB

CVE-2025-8393

Dreame Technology iOS and Android Mobile Applications Improper Certificate Validation

A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentials and sensitive se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T16:23:19.199Z. Updated 2025-08-08T19:14:14.004Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:14 WIB

Official record

CritPublished 08 Aug 2025, 23:17 WIB

CVE-2025-46414

EG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts

The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides clear feedback when the correct PIN is entered. This vul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T16:17:43.727Z. Updated 2025-08-08T19:13:44.835Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:13 WIB

Official record

MedPublished 08 Aug 2025, 23:14 WIB

CVE-2025-47872

EG4 Electronics EG4 Inverters Observable Discrepancy

The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registered, or does not exist in the database. Combined with the fact that serial numbers are sequentially assigned, this allows an attacker to gain information on th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T16:14:18.901Z. Updated 2025-08-08T19:13:18.978Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:13 WIB

Official record

HighPublished 08 Aug 2025, 23:09 WIB

CVE-2025-53520

EG4 Electronics EG4 Inverters Download of Code Without Integrity Check

The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the fir…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T16:09:02.072Z. Updated 2025-08-08T19:12:44.942Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:12 WIB

Official record

HighPublished 08 Aug 2025, 23:00 WIB

CVE-2025-52586

EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information

The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerability may allow an attacker with access to a local network to intercept, manipulate, replay, or forge critical data, including read/write operations for voltage, c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T16:00:43.694Z. Updated 2025-09-08T17:06:06.953Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 00:06 WIB

Official record

MedPublished 08 Aug 2025, 22:42 WIB

CVE-2025-4576

CVE-2025-4576

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T15:42:34.497Z. Updated 2025-08-08T16:07:00.233Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Aug 2025, 23:07 WIB

Official record

CritPublished 08 Aug 2025, 22:40 WIB

CVE-2025-8356

Path Traversal leading to RCE

In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T15:40:12.588Z. Updated 2026-02-26T17:49:46.284Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

CritPublished 08 Aug 2025, 22:32 WIB

CVE-2025-8731

TRENDnet TI-G160i/TI-PG102i/TPL-430AP SSH Service default credentials

A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T15:32:05.773Z. Updated 2025-08-13T08:18:21.779Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated13 Aug 2025, 15:18 WIB

Official record

HighPublished 08 Aug 2025, 22:31 WIB

CVE-2025-8355

XXE leading to SSRF

In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T15:31:44.554Z. Updated 2025-08-08T16:02:42.866Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Aug 2025, 23:02 WIB

Official record

MedPublished 08 Aug 2025, 21:51 WIB

CVE-2025-36023

IBM Cloud Pak for Business Automation security bypass

IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and system information due to an indirect object reference through a user-controlled key.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T14:51:12.631Z. Updated 2025-08-08T15:07:16.477Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Aug 2025, 22:07 WIB

Official record