Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 2921–2940 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 10 Sep 2025, 03:49 WIB

CVE-2025-54239

After Effects | Out-of-bounds Read (CWE-125)

After Effects versions 25.3, 24.6.7 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure, potentially disclosing sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:49:47.313Z. Updated 2025-09-09T20:59:15.728Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated10 Sep 2025, 03:59 WIB

Official record

MedPublished 10 Sep 2025, 03:49 WIB

CVE-2025-54240

After Effects | Out-of-bounds Read (CWE-125)

After Effects versions 25.3, 24.6.7 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure, potentially disclosing sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:49:46.486Z. Updated 2025-09-09T20:59:10.508Z.

Showing 2921 to 2940 of 4319.First page Next page

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated10 Sep 2025, 03:59 WIB

Official record

HighPublished 10 Sep 2025, 03:37 WIB

CVE-2025-54084

Calix Gigacenter ONT - Command Injection

OS Command ('OS Command Injection') vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows authenticated attackers with 'super' user credentials to execute arbitrary OS commands through improper input validation, potentially leading to full system compromise.This issue affects GigaCenter ONT: 844E, 844G, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:37:28.023Z. Updated 2025-09-12T13:59:00.965Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 20:59 WIB

Official record

HighPublished 10 Sep 2025, 03:29 WIB

CVE-2025-43491

Poly Lens Desktop Application – Privilege Escalation

A vulnerability in the Poly Lens Desktop application running on the Windows platform might allow modifications to the filesystem, which might lead to SYSTEM level privileges being granted.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:29:47.968Z. Updated 2026-02-26T17:48:49.381Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

MedPublished 10 Sep 2025, 03:29 WIB

CVE-2025-54083

Calix GigaCenter ONT firmware - Sensitive Information Disclosure

Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:29:17.196Z. Updated 2025-09-12T13:58:21.007Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 20:58 WIB

Official record

HighPublished 10 Sep 2025, 03:26 WIB

CVE-2025-59037

DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:26:57.986Z. Updated 2025-09-10T14:28:58.864Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated10 Sep 2025, 21:28 WIB

Official record

MedPublished 10 Sep 2025, 03:23 WIB

CVE-2025-34178

Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting

In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:23:44.475Z. Updated 2026-07-14T22:25:52.398Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 05:25 WIB

Official record

CritPublished 10 Sep 2025, 03:19 WIB

CVE-2025-58768

DeepChat's Mermaid rendering has XSS leading to RCE

DeepChat is a smart assistant uses artificial intelligence. Prior to version 0.3.5, in the Mermaid chart rendering component, there is a risky operation of directly using `innerHTML` to set user content. Therefore, any malicious content rendered via Mermaid will directly trigger the exploit chain, leading to command ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:19:52.122Z. Updated 2025-09-09T20:31:54.042Z.

CVSS9.7v3.1KEVNot listedEPSSPresentUpdated10 Sep 2025, 03:31 WIB

Official record

MedPublished 10 Sep 2025, 03:19 WIB

CVE-2025-34177

Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting

In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:19:09.928Z. Updated 2026-07-14T22:25:51.705Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 05:25 WIB

Official record

HighPublished 10 Sep 2025, 03:16 WIB

CVE-2025-58765

wabac.js has XSS vulnerability in 404 error handling logic

wabac.js provides a full web archive replay system, or 'wayback machine', using Service Workers. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the 404 error handling logic of wabac.js v2.23.10 and below. The parameter `requestURL` (derived from the original request target) is directly embedded into an …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:16:26.657Z. Updated 2025-09-10T13:22:05.307Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated10 Sep 2025, 20:22 WIB

Official record

MedPublished 10 Sep 2025, 03:14 WIB

CVE-2025-34176

Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure

In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:14:37.899Z. Updated 2026-07-14T22:25:51.016Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 05:25 WIB

Official record

HighPublished 10 Sep 2025, 03:13 WIB

CVE-2025-58763

Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. This vulnerability requires the application to have been cloned from G…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:13:44.797Z. Updated 2025-09-10T13:32:35.831Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated10 Sep 2025, 20:32 WIB

Official record

MedPublished 10 Sep 2025, 03:10 WIB

CVE-2025-54255

Acrobat Reader | Violation of Secure Design Principles (CWE-657)

Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Violation of Secure Design Principles vulnerability that could result in a security feature bypass impacting integrity. An attacker does not have to be authenticated. Exploitation of this issue does not require user interacti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:10:02.351Z. Updated 2025-10-01T21:37:47.035Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated02 Oct 2025, 04:37 WIB

Official record

MedPublished 10 Sep 2025, 03:09 WIB

CVE-2025-34175

Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting

In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:09:50.289Z. Updated 2026-07-14T22:25:50.307Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 05:25 WIB

Official record

HighPublished 10 Sep 2025, 03:08 WIB

CVE-2025-54257

Acrobat Reader | Use After Free (CWE-416)

Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file, and scope is unc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:08:48.397Z. Updated 2026-02-26T17:48:49.658Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

HighPublished 10 Sep 2025, 03:08 WIB

CVE-2025-7635

Calix GigaCenter ONT - Unauthenticated Telnet

Unauthenticated Telnet access vulnerability in Calix GigaCenter ONT allows root access.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:08:37.767Z. Updated 2025-09-12T13:56:22.271Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 20:56 WIB

Official record

CritPublished 10 Sep 2025, 03:08 WIB

CVE-2025-58762

Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application filesystem. This leads to remote code execution when combined with the `Scr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:08:27.965Z. Updated 2025-09-10T20:20:35.507Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated11 Sep 2025, 03:20 WIB

Official record

MedPublished 10 Sep 2025, 03:02 WIB

CVE-2025-34174

Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T20:02:05.701Z. Updated 2025-11-20T12:23:37.606Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 19:23 WIB

Official record

HighPublished 10 Sep 2025, 02:59 WIB

CVE-2025-53914

Calix GigaCenter ONT (Broadcom SoC) - Excessive Privileges

Excessive Privileges vulnerability in Calix GigaCenter ONT (Broadcom SoC modules) allows Privilege Abuse.This issue affects GigaCenter ONT: 844E, 844G, 844GE, 854GE, 812G, 813G, 818G.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T19:59:27.381Z. Updated 2025-09-12T13:55:32.373Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated12 Sep 2025, 20:55 WIB

Official record

HighPublished 10 Sep 2025, 02:59 WIB

CVE-2025-58761

Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The `real_pms_image_proxy` is used to fet…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-09T19:59:17.329Z. Updated 2025-09-10T13:47:59.287Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated10 Sep 2025, 20:47 WIB

Official record