Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 2001–2020 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

UnscoredPublished 13 Jun 2025, 07:00 WIB

CVE-2025-45987

CVE-2025-45987

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the dns1 and dns2 parameters in the bs_SetDNSInfo function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-13T00:00:00.000Z. Updated 2025-06-13T15:03:03.641Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Jun 2025, 22:03 WIB

Official record

UnscoredPublished 13 Jun 2025, 07:00 WIB

CVE-2025-45988

CVE-2025-45988

Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL-X26_DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bs_SetCmd function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-13T00:00:00.000Z. Updated 2025-06-13T15:06:37.196Z.

Showing 2001 to 2020 of 3682.First page Next page

CVSS—

KEVNot listed

EPSSPresent

Updated13 Jun 2025, 22:06 WIB

Official record

UnscoredPublished 13 Jun 2025, 07:00 WIB

CVE-2025-46060

CVE-2025-46060

Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-13T00:00:00.000Z. Updated 2026-07-05T01:01:03.934Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:01 WIB

Official record

UnscoredPublished 13 Jun 2025, 07:00 WIB

CVE-2025-46096

CVE-2025-46096

Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-13T00:00:00.000Z. Updated 2025-06-13T16:02:25.106Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Jun 2025, 23:02 WIB

Official record

MedPublished 13 Jun 2025, 06:41 WIB

CVE-2025-4228

Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability

An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain files available within the Broker VM and escalate their privileges to root.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T23:41:37.071Z. Updated 2026-02-26T17:50:38.802Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 13 Jun 2025, 06:30 WIB

CVE-2025-4230

PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this issue is significantly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T23:30:15.781Z. Updated 2026-02-26T17:50:39.127Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 13 Jun 2025, 06:27 WIB

CVE-2025-4231

PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface

A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T23:27:31.432Z. Updated 2026-02-26T17:50:39.522Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 13 Jun 2025, 06:22 WIB

CVE-2025-4232

GlobalProtect: Authenticated Code Injection Through Wildcard on macOS

An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T23:22:34.993Z. Updated 2026-02-26T17:50:39.870Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 13 Jun 2025, 05:14 WIB

CVE-2025-4233

Prisma Access Browser: Inappropriate implementation in Cache

An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T22:14:53.314Z. Updated 2025-06-13T14:05:18.163Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 21:05 WIB

Official record

MedPublished 13 Jun 2025, 04:39 WIB

CVE-2025-41233

CVE-2025-41233

Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the Moderate severity range https://www.broadcom.com/support/vmware-services/security-response with a maximum CVSSv3 base score of 6.8 https://www.first.org/cvss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T21:39:53.475Z. Updated 2025-06-13T14:05:40.989Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 21:05 WIB

Official record

MedPublished 13 Jun 2025, 04:14 WIB

CVE-2025-41234

RFD Attack via “Content-Disposition” Header Sourced from Request

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input. Specifically, an applica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T21:14:42.957Z. Updated 2025-06-13T14:03:35.406Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 21:03 WIB

Official record

MedPublished 13 Jun 2025, 03:56 WIB

CVE-2025-49589

PCSX2 Contains a Stack-based Buffer Overflow in IOP Console Logging

PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execute arbitrary code if the user enabled IOP Console Logging. This v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T20:56:38.711Z. Updated 2025-06-13T14:07:14.750Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 21:07 WIB

Official record

HighPublished 13 Jun 2025, 03:36 WIB

CVE-2025-27689

CVE-2025-27689

Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T20:36:24.943Z. Updated 2026-02-26T17:50:40.294Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 13 Jun 2025, 03:05 WIB

CVE-2025-5485

SinoTrack GPS Receiver Weak Authentication

User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malicious actor can enumerate potential targets by incrementing or decrementing from known identifiers or through enumerating random digit sequences.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T20:05:35.216Z. Updated 2025-06-12T20:14:57.139Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 03:14 WIB

Official record

HighPublished 13 Jun 2025, 03:03 WIB

CVE-2025-5484

SinoTrack GPS Receiver Weak Authentication

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T20:03:32.255Z. Updated 2025-06-12T20:16:45.707Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 03:16 WIB

Official record

HighPublished 13 Jun 2025, 02:56 WIB

CVE-2025-36539

AVEVA PI Data Archive Uncaught Exception

AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T19:56:33.320Z. Updated 2025-06-12T20:04:23.575Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 03:04 WIB

Official record

HighPublished 13 Jun 2025, 02:51 WIB

CVE-2025-44019

AVEVA PI Data Archive Uncaught Exception

AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary PI Data Archive subsystems, resulting in a denial of service. Depending on the timing of the crash, data present in snapshots/write cache may be lost.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T19:51:56.663Z. Updated 2025-06-12T20:06:50.361Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 03:06 WIB

Official record

MedPublished 13 Jun 2025, 02:42 WIB

CVE-2025-2745

AVEVA PI Web API Cross-site Scripting

A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/update annotations or upload media files) to persist arbitrary JavaScript code that will be executed by users who were socially engineered t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T19:42:27.001Z. Updated 2025-06-12T20:09:34.976Z.

CVSS4.5v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 03:09 WIB

Official record

MedPublished 13 Jun 2025, 02:37 WIB

CVE-2025-4418

AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value

An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow a miscreant with elevated privileges to modify PI Connector for CygNet local data files (cache and buffers) in a way that causes the connector service to b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T19:37:46.740Z. Updated 2025-06-12T19:54:54.525Z.

CVSS6.7v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 02:54 WIB

Official record

MedPublished 13 Jun 2025, 02:32 WIB

CVE-2025-4417

AVEVA PI Connector for CygNet Cross-site Scripting

A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit affected pages.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T19:32:32.628Z. Updated 2025-06-12T19:57:09.559Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 02:57 WIB

Official record