Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2921–2940 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

CritPublished 04 Nov 2025, 04:55 WIB

CVE-2024-13997

Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host

Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. By abusing the migration workflow, an admin-level attacker could execute actions outside the intended…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T21:55:48.197Z. Updated 2026-09-30T17:19:53.314Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:19 WIB

Official record

MedPublished 04 Nov 2025, 04:53 WIB

CVE-2024-13998

Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2921 to 2940 of 3020.First page Next page

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T21:53:51.223Z. Updated 2026-09-30T17:19:53.973Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:19 WIB

Official record

MedPublished 04 Nov 2025, 04:40 WIB

CVE-2025-11193

CVE-2025-11193

A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T21:40:32.038Z. Updated 2025-11-03T21:47:52.661Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:47 WIB

Official record

MedPublished 04 Nov 2025, 04:18 WIB

CVE-2025-36172

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for 24.0.0-IF007, 24.0.1-IF005 and 25.0.0-IF002

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to em…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T21:18:09.139Z. Updated 2025-11-03T21:41:45.434Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:41 WIB

Official record

MedPublished 04 Nov 2025, 04:03 WIB

CVE-2025-12657

Malformed KMIP response may result in access violation

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T21:03:25.384Z. Updated 2025-11-03T21:26:22.750Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:26 WIB

Official record

HighPublished 04 Nov 2025, 02:47 WIB

CVE-2025-12531

IBM InfoSphere Information Server is affected by an XML external entity injection (XXE) vulnerability

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T19:47:40.992Z. Updated 2025-11-03T20:15:28.986Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:15 WIB

Official record

MedPublished 04 Nov 2025, 02:36 WIB

CVE-2025-12642

HTTP Header Smuggling via Trailer Merge

lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Inject unsafe input into backend logic that trusts request headers …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T19:36:17.011Z. Updated 2025-11-03T19:44:09.174Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:44 WIB

Official record

LowPublished 04 Nov 2025, 01:40 WIB

CVE-2025-8558

CVE-2025-8558

Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents the server from receiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T18:40:03.946Z. Updated 2025-11-03T19:03:11.645Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:03 WIB

Official record

CritPublished 03 Nov 2025, 23:45 WIB

CVE-2025-12463

Unauthenticated SQL Injection in Guetebruck G-Cam Series Cameras

An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi` script. This has been confirmed on the EFD-2130 camera running firmware version 1.12.0.19.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T16:45:39.423Z. Updated 2025-11-03T20:51:37.271Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:51 WIB

Official record

HighPublished 03 Nov 2025, 23:35 WIB

CVE-2025-10280

Incorrect Content Type Cross-Site Scripting Vulnerability

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T16:35:56.241Z. Updated 2026-02-26T17:47:39.634Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

CritKEVPublished 03 Nov 2025, 23:35 WIB

CVE-2025-11953

Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests

The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST request to the server and run arbitrary executables. On Window…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-11-03T16:35:07.168Z. Updated 2026-02-26T17:47:39.982Z.

CVSS9.8v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

MedPublished 03 Nov 2025, 22:54 WIB

CVE-2025-36093

security vulnerabilities are addressed with IBM Business Automation Insights iFixes for October 2025.

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T15:54:30.869Z. Updated 2025-11-03T16:25:26.455Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated03 Nov 2025, 23:25 WIB

Official record

MedPublished 03 Nov 2025, 22:15 WIB

CVE-2025-36092

IBM Business Automation Insights improper input validation

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to the improper validation of input length.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T15:15:43.546Z. Updated 2025-11-03T15:35:59.011Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated03 Nov 2025, 22:35 WIB

Official record

MedPublished 03 Nov 2025, 22:14 WIB

CVE-2025-36091

IBM Business Automation Insights unverified ownership

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T15:14:02.557Z. Updated 2025-11-03T15:37:32.628Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated03 Nov 2025, 22:37 WIB

Official record

HighPublished 03 Nov 2025, 22:13 WIB

CVE-2025-11761

HP Client Management Script Library – Security Update

A potential security vulnerability has been identified in the HP Client Management Script Library software, which might allow escalation of privilege during the installation process. HP is releasing software updates to mitigate the potential vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T15:13:39.263Z. Updated 2026-02-26T17:47:40.431Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

CritPublished 03 Nov 2025, 21:26 WIB

CVE-2025-8900

Doccure Core < 1.5.4 - Unauthenticated Privilege Escalation

The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes it possible for unauthenticated attackers to gain elevated pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T14:26:38.140Z. Updated 2026-04-08T16:50:36.844Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:50 WIB

Official record

MedPublished 03 Nov 2025, 20:09 WIB

CVE-2025-64294

WordPress WP Snow Effect plugin <= 1.1.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in d3wp WP Snow Effect wp-snow-effect allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Snow Effect: from n/a through <= 1.1.19.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T13:09:39.398Z. Updated 2026-04-28T16:14:14.122Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 03 Nov 2025, 20:02 WIB

CVE-2025-12626

jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal

A security flaw has been discovered in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This affects the function getImgUrl of the file WxActGoldeneggsPrizesController.java. Performing manipulation of the argument imgurl results in path traversal. Remote exploitation of the attack is possible. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T13:02:06.078Z. Updated 2025-11-03T14:08:09.907Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated03 Nov 2025, 21:08 WIB

Official record

UnscoredPublished 03 Nov 2025, 19:15 WIB

CVE-2025-40107

can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled

In the Linux kernel, the following vulnerability has been resolved: can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled This issue is similar to the vulnerability in the `mcp251x` driver, which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from sleep before in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T12:15:12.587Z. Updated 2026-05-11T21:42:39.083Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:42 WIB

Official record

CritPublished 03 Nov 2025, 18:51 WIB

CVE-2025-0987

IDOR in CB Project's CVLand

Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection. This issue affects CVLand: from 2.1.0 through 20251103. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-03T11:51:14.209Z. Updated 2026-06-06T07:03:33.667Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:03 WIB

Official record