Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2961–2980 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 07 Aug 2025, 22:25 WIB

CVE-2025-47907

Incorrect results returned from Rows.Scan in database/sql

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another que…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T15:25:30.704Z. Updated 2025-11-04T21:10:56.083Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:10 WIB

Official record

HighPublished 07 Aug 2025, 22:19 WIB

CVE-2025-7054

Infinite loop triggered by connection ID retirement

Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections possess a set of connection identifiers (IDs); see Section 5.1 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#section-5.1 . Once the QUIC handshake completes, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2961 to 2980 of 3629.First page Next page

Published 2025-08-07T15:19:29.542Z. Updated 2025-08-07T15:52:20.008Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 22:52 WIB

Official record

MedPublished 07 Aug 2025, 16:59 WIB

CVE-2025-8533

Incorrect Authorization of XPC Service in Fantastical.app

A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAcceptNewConnection method, unconditionally accepting requests from any local process. As a result, any local, unprivileged process could connect to the XPC servic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T09:59:12.324Z. Updated 2025-08-07T13:27:42.989Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:27 WIB

Official record

HighPublished 07 Aug 2025, 12:22 WIB

CVE-2025-35970

CVE-2025-35970

On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If the administrator password is not changed from the initial one, a remote attacker with SNMP access can log in to the product with the administrator privilege.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T05:22:09.768Z. Updated 2025-08-07T13:35:47.701Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:35 WIB

Official record

HighPublished 07 Aug 2025, 12:09 WIB

CVE-2025-29866

CVE-2025-29866

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T05:09:53.284Z. Updated 2025-08-07T13:37:56.611Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:37 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8583

CVE-2025-8583

Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:40.083Z. Updated 2025-08-07T13:20:06.480Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:20 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8582

CVE-2025-8582

Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:39.884Z. Updated 2025-08-11T13:29:12.773Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Aug 2025, 20:29 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8581

CVE-2025-8581

Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:39.671Z. Updated 2025-08-07T13:29:32.387Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:29 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8580

CVE-2025-8580

Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:39.448Z. Updated 2025-08-07T13:31:14.634Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:31 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8579

CVE-2025-8579

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:39.240Z. Updated 2025-08-07T13:32:48.487Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:32 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8578

CVE-2025-8578

Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:38.991Z. Updated 2026-02-26T17:49:50.444Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8577

CVE-2025-8577

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:38.705Z. Updated 2025-08-07T13:38:34.937Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:38 WIB

Official record

UnscoredPublished 07 Aug 2025, 08:30 WIB

CVE-2025-8576

CVE-2025-8576

Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:38.461Z. Updated 2026-02-26T17:49:50.747Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

HighPublished 07 Aug 2025, 08:30 WIB

CVE-2025-29865

CVE-2025-29865

: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path Traversal.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T01:30:37.885Z. Updated 2025-08-07T13:25:39.749Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:25 WIB

Official record

HighPublished 07 Aug 2025, 07:42 WIB

CVE-2025-3770

SMM IDT Privilege Escalation Vulnerability

EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:42:14.628Z. Updated 2025-08-07T13:28:12.175Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:28 WIB

Official record

HighPublished 07 Aug 2025, 07:07 WIB

CVE-2025-54784

SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability in the email viewer in versions 7.14.0 through 7.14.6. An external attacker could send a prepared message to the inbox of the SuiteCRM-instance. By simply viewing…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:07:07.525Z. Updated 2025-08-07T13:59:34.417Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:59 WIB

Official record

MedPublished 07 Aug 2025, 07:05 WIB

CVE-2025-54783

SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:05:11.823Z. Updated 2025-08-07T13:38:51.739Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 20:38 WIB

Official record

LowPublished 07 Aug 2025, 07:04 WIB

CVE-2025-54798

tmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameter

tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via symbolic link dir parameter. This is fixed in version 0.2.4.

Excerpt language: en.

Severity low: primary CNA CVSS 2.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:04:35.370Z. Updated 2025-11-03T20:06:39.242Z.

CVSS2.5v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:06 WIB

Official record

LowPublished 07 Aug 2025, 07:04 WIB

CVE-2025-54799

Lego does not enforce HTTPS

Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego library and the lego cli as well) don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME challenge over unencrypt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:04:14.718Z. Updated 2025-08-07T14:07:32.104Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 21:07 WIB

Official record

MedPublished 07 Aug 2025, 07:02 WIB

CVE-2025-54885

Thinbus generates insufficient entropy: 252 bits vs minimum 256 bits

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime (defaulted to 2048 bits). The clie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-07T00:02:42.612Z. Updated 2025-08-07T14:13:18.243Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 21:13 WIB

Official record