Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2921–2940 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

CritPublished 08 Aug 2025, 07:06 WIB

CVE-2025-54887

jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs. This puts users at risk because JWEs can be modifi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:06:20.021Z. Updated 2025-08-08T16:43:15.548Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated08 Aug 2025, 23:43 WIB

Official record

HighPublished 08 Aug 2025, 07:03 WIB

CVE-2025-54886

skops: Card.get_model does not block arbitrary code execution

skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.get_model does not contain any logic to prevent arbitrary code execution. The Card.get_model function supports both joblib and skops for model loading. When loading .skops models, it uses s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2921 to 2940 of 3629.First page Next page

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:03:45.318Z. Updated 2025-08-08T16:54:00.636Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated08 Aug 2025, 23:54 WIB

Official record

MedPublished 08 Aug 2025, 07:02 WIB

CVE-2025-54793

Astro: Duplicate trailing slash feature can lead to Open Redirects

Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydoma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:02:38.299Z. Updated 2025-08-08T16:55:38.979Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated08 Aug 2025, 23:55 WIB

Official record

MedPublished 08 Aug 2025, 07:02 WIB

CVE-2025-8703

Wanzhou WOES Intelligent Optimization Energy Saving System Environmental Real-Time Data Module GetAreaTrendChartData sql injection

A vulnerability classified as critical was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This vulnerability affects unknown code of the file /WEAS_HomePage/GetAreaTrendChartData of the component Environmental Real-Time Data Module. The manipulation of the argument energyId leads to sql inject…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:02:06.332Z. Updated 2025-08-08T17:14:03.198Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 00:14 WIB

Official record

MedPublished 08 Aug 2025, 07:00 WIB

CVE-2025-54368

uv is vulnerable to ZIP payload obfuscation through parsing differentials

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:39.001Z. Updated 2025-08-08T17:32:18.259Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 00:32 WIB

Official record

UnscoredPublished 08 Aug 2025, 07:00 WIB

CVE-2020-9322

CVE-2020-9322

The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATH_INFO.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T14:37:50.449Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 21:37 WIB

Official record

HighPublished 08 Aug 2025, 07:00 WIB

CVE-2025-50465

CVE-2025-50465

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The testPlatform parameter can be used to build a SQL query.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T19:04:06.734Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:04 WIB

Official record

HighPublished 08 Aug 2025, 07:00 WIB

CVE-2025-50466

CVE-2025-50466

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The entityType parameter can be used to build a SQL query.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T18:57:40.047Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated09 Aug 2025, 01:57 WIB

Official record

UnscoredPublished 08 Aug 2025, 07:00 WIB

CVE-2025-50467

CVE-2025-50467

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO interface. The supportedDataTypeParam parameter can be used to build a SQL query.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T19:03:31.545Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:03 WIB

Official record

UnscoredPublished 08 Aug 2025, 07:00 WIB

CVE-2025-50468

CVE-2025-50468

OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the DocStoreDAO interface. The entityType parameters can be used to build a SQL query.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T19:02:34.672Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Aug 2025, 02:02 WIB

Official record

UnscoredPublished 08 Aug 2025, 07:00 WIB

CVE-2025-50927

CVE-2025-50927

A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via injecting a crafted payload into the ftpusername parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T17:46:30.535Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Aug 2025, 00:46 WIB

Official record

UnscoredPublished 08 Aug 2025, 07:00 WIB

CVE-2025-50928

CVE-2025-50928

Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settings function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T17:39:32.574Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Aug 2025, 00:39 WIB

Official record

UnscoredPublished 08 Aug 2025, 07:00 WIB

CVE-2025-52913

CVE-2025-52913

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduct a path traversal attack due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the attacker to view, corrupt, or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2026-02-26T17:49:47.854Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 08 Aug 2025, 07:00 WIB

CVE-2025-52914

CVE-2025-52914

A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to conduct a SQL Injection attack due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary SQL database commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-08-08T17:55:00.637Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Aug 2025, 00:55 WIB

Official record

LowPublished 08 Aug 2025, 07:00 WIB

CVE-2025-55188

CVE-2025-55188

7-Zip before 25.01 does not always properly handle symbolic links during extraction.

Excerpt language: en.

Severity low: primary CNA CVSS 3.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-08T00:00:00.000Z. Updated 2025-11-04T22:06:47.049Z.

CVSS3.6v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 05:06 WIB

Official record

MedPublished 08 Aug 2025, 06:32 WIB

CVE-2025-8702

Wanzhou WOES Intelligent Optimization Energy Saving System Historical Data Query Module GetVariableByOneIDNew sql injection

A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the file /CommonSolution/GetVariableByOneIDNew of the component Historical Data Query Module. The manipulation of the argument ObjectID leads to sql injection. It is p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T23:32:05.468Z. Updated 2025-08-08T17:33:30.461Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Aug 2025, 00:33 WIB

Official record

UnscoredPublished 08 Aug 2025, 06:08 WIB

CVE-2025-54952

CVE-2025-54952

An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 8f062d3f661e20bb19b24b767b9a9a46e8359f2b.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T23:08:39.186Z. Updated 2025-08-08T14:11:22.140Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Aug 2025, 21:11 WIB

Official record

UnscoredPublished 08 Aug 2025, 06:06 WIB

CVE-2025-54951

CVE-2025-54951

A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T23:06:02.059Z. Updated 2025-08-12T14:20:40.207Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Aug 2025, 21:20 WIB

Official record

UnscoredPublished 08 Aug 2025, 06:03 WIB

CVE-2025-54950

CVE-2025-54950

An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T23:03:03.775Z. Updated 2025-08-12T14:18:12.048Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Aug 2025, 21:18 WIB

Official record

UnscoredPublished 08 Aug 2025, 05:58 WIB

CVE-2025-54949

CVE-2025-54949

A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T22:58:23.290Z. Updated 2025-08-12T14:13:11.044Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Aug 2025, 21:13 WIB

Official record