Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 201–220 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 29 Sep 2025, 08:02 WIB

CVE-2025-11134

Cudy TR1200 Wireless Settings config cross site scripting

A security vulnerability has been detected in Cudy TR1200 1.16.3-20230804-164635. Impacted is an unknown function of the file /cgi-bin/luci/admin/network/wireless/config/ of the component Wireless Settings Page. Such manipulation of the argument SSID leads to cross site scripting. It is possible to launch the attack re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T01:02:05.150Z. Updated 2025-09-29T11:50:13.674Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Sep 2025, 18:50 WIB

Official record

MedPublished 29 Sep 2025, 07:47 WIB

CVE-2025-7698

CVE-2025-7698

Out-of-bounds read vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printer…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 201 to 220 of 4319.First page Next page

Published 2025-09-29T00:47:02.910Z. Updated 2026-03-15T23:37:02.705Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 06:37 WIB

Official record

MedPublished 29 Sep 2025, 07:46 WIB

CVE-2025-9904

CVE-2025-9904

Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:46:03.660Z. Updated 2026-03-15T23:38:21.389Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 06:38 WIB

Official record

MedPublished 29 Sep 2025, 07:44 WIB

CVE-2025-9903

CVE-2025-9903

Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic Plus LIPSLX Printer Driver / Generic Plus PS Printer Driver / UFRII LT Printer Driver / CARPS2 Printer Driver / Generic FAX Driver / LIPS4 Printe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:44:55.506Z. Updated 2026-03-15T23:37:40.864Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated16 Mar 2026, 06:37 WIB

Official record

HighPublished 29 Sep 2025, 07:32 WIB

CVE-2025-11130

iHongRen pptp-vpn XPC Service HelperTool.m shouldAcceptNewConnection missing authentication

A weakness has been identified in iHongRen pptp-vpn 1.0/1.0.1 on macOS. This issue affects the function shouldAcceptNewConnection of the file HelpTool/HelperTool.m of the component XPC Service. This manipulation causes missing authentication. The attack can only be executed locally. The exploit has been made available …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:32:06.122Z. Updated 2025-09-29T11:59:04.849Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Sep 2025, 18:59 WIB

Official record

CritPublished 29 Sep 2025, 07:02 WIB

CVE-2025-11126

Apeman ID71 system.ini hard-coded credentials

A security flaw has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The manipulation results in hard-coded credentials. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor was con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:02:05.583Z. Updated 2025-09-29T12:00:34.530Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Sep 2025, 19:00 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2024-57412

CVE-2024-57412

An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-10-28T20:19:09.167Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2025, 03:19 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-51495

CVE-2025-51495

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-10-01T15:21:21.511Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2025, 22:21 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-55795

CVE-2025-55795

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID withou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-09-29T17:44:43.586Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2025, 00:44 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-56233

CVE-2025-56233

Openindiana, kernel SunOS 5.11 has a denial of service vulnerability. For the processing of TCP packets with RST or SYN flag set, Openindiana has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be within the current receive …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-10-28T20:20:41.342Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2025, 03:20 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-56234

CVE-2025-56234

AT_NA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST packets, PLC AT_NA2000 has a wide acceptable range of sequence numbers. It does not require the sequence number to exactly match the next expected sequence value, just to be within the current receive …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-10-28T20:21:58.993Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2025, 03:21 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-56449

CVE-2025-56449

A security vulnerability was identified in Obsidian Scheduler's REST API 5.0.0 thru 6.3.0. If an account is locked out due to not enrolling in MFA (e.g. after the 7-day enforcement window), the REST API still allows the use of Basic Authentication to authenticate and perform administrative actions. In particular, the d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-10-28T20:24:22.903Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2025, 03:24 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-56764

CVE-2025-56764

Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning different error messages ("Unknown user" vs. "Wrong password"), allowing an attacker to enumerate valid usernames.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-11-11T18:36:27.156Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2025, 01:36 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-56795

CVE-2025-56795

Mealie 3.0.1 and earlier is vulnerable to Stored Cross-Site Scripting (XSS) in the recipe creation functionality. Unsanitized user input in the "note" and "text" fields of the "/api/recipes/{recipe_name}" endpoint is rendered in the frontend without proper escaping leading to persistent XSS.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-10-01T17:31:42.944Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Oct 2025, 00:31 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-56807

CVE-2025-56807

A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using the file explorer in the admin dashboard when creating new folders.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2026-07-05T01:12:42.358Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:12 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-57197

CVE-2025-57197

In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change feature. A local attacker with root access to the device can dynamically instrument the app to bypass the current PIN verification check and directly modify the authentication PIN. This…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2026-07-05T01:13:04.284Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:13 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-57266

CVE-2025-57266

An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive information such as API Keys via the /api/assistant/list endpoint.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-09-29T20:39:21.912Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2025, 03:39 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-57424

CVE-2025-57424

A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker can insert arbitrary JavaScript into their profile, which executes in the browser of any user viewing it, including administrators. Due to the absence of the HttpOnly flag on the sess…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-09-29T19:05:53.307Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2025, 02:05 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-57428

CVE-2025-57428

Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gain access to the debug shell exposed via Telnet on Port 23 and execute hardware-level flash and register manipulation commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-10-28T20:26:26.761Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2025, 03:26 WIB

Official record

UnscoredPublished 29 Sep 2025, 07:00 WIB

CVE-2025-57483

CVE-2025-57483

A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the vulnerable parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T00:00:00.000Z. Updated 2025-09-29T18:45:01.787Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Sep 2025, 01:45 WIB

Official record