Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 2021–2040 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

HighPublished 13 Jun 2025, 02:29 WIB

CVE-2025-6031

Insecure device pairing in end of life Amazon Cloud Cam

Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. When a user powers on the Amazon Cloud Cam, the device attempts to connect to a remote service infrastructure that has been deprecated due to end-of-life status. The device defaults…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T19:29:11.082Z. Updated 2025-10-14T18:01:10.993Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 01:01 WIB

Official record

MedPublished 13 Jun 2025, 01:50 WIB

CVE-2025-49576

Citizen allows stored XSS in search no result messages

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2021 to 2040 of 3682.First page Next page

Published 2025-06-12T18:50:55.931Z. Updated 2025-06-12T19:05:48.122Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 02:05 WIB

Official record

MedPublished 13 Jun 2025, 01:50 WIB

CVE-2025-49578

Citizen allows stored XSS in user registration date message

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T18:50:49.300Z. Updated 2025-06-12T19:12:17.575Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 02:12 WIB

Official record

MedPublished 13 Jun 2025, 01:50 WIB

CVE-2025-49579

Citizen allows stored XSS in menu heading message

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T18:50:44.360Z. Updated 2025-06-12T19:16:43.720Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 02:16 WIB

Official record

MedPublished 13 Jun 2025, 01:45 WIB

CVE-2025-49575

Citizen allows stored XSS in Command Palette tip messages

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `ed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T18:45:23.363Z. Updated 2025-06-12T18:58:25.445Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 01:58 WIB

Official record

MedPublished 13 Jun 2025, 01:45 WIB

CVE-2025-49577

Citizen allows stored XSS in preference menu headings

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T18:45:18.415Z. Updated 2025-06-12T19:01:58.426Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 02:01 WIB

Official record

LowPublished 13 Jun 2025, 01:04 WIB

CVE-2025-43866

Vantage6 Server JWT secret not cryptographically secure

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is fixed in 4.11.0.

Excerpt language: en.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T18:04:57.649Z. Updated 2025-06-13T14:06:06.347Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 21:06 WIB

Official record

LowPublished 13 Jun 2025, 00:29 WIB

CVE-2025-43863

vantage6 lacks brute-force protection on change password functionality

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that ro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T17:29:57.047Z. Updated 2025-06-12T17:54:44.017Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 00:54 WIB

Official record

MedPublished 13 Jun 2025, 00:25 WIB

CVE-2025-49081

Input validation vulnerability in the Secure Access prior to version 13.55

There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with system administrator permissions can impair the availability of the Secure Access administrative UI by writing invalid data to the warehouse over the network. The at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T17:25:47.812Z. Updated 2025-06-12T17:59:46.307Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 00:59 WIB

Official record

HighPublished 13 Jun 2025, 00:08 WIB

CVE-2025-49080

Memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54

There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Denial of Service by sending a specially crafted sequence of packets to the server. The attack complexity is low, there are no attack requirements, privileges, or us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T17:08:50.086Z. Updated 2025-06-17T18:17:08.994Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Jun 2025, 01:17 WIB

Official record

LowPublished 12 Jun 2025, 23:27 WIB

CVE-2025-5982

Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T16:27:56.700Z. Updated 2025-06-12T17:29:27.471Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 00:29 WIB

Official record

HighPublished 12 Jun 2025, 23:05 WIB

CVE-2024-7562

CVE-2024-7562

A potential elevated privilege issue has been reported with InstallShield built Standalone MSI setups having multiple InstallScript custom actions configured. All supported versions (InstallShield 2023 R2, InstallShield 2022 R2 and InstallShield 2021 R2) are affected by this issue.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T16:05:31.562Z. Updated 2025-06-17T18:17:28.748Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated18 Jun 2025, 01:17 WIB

Official record

CritPublished 12 Jun 2025, 22:18 WIB

CVE-2025-49467

Joomla Extension - jevents.net - SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla

A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publicly accessible actions to list events by date ranges.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T15:18:32.804Z. Updated 2025-06-12T15:52:20.609Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated12 Jun 2025, 22:52 WIB

Official record

HighPublished 12 Jun 2025, 22:18 WIB

CVE-2025-36573

CVE-2025-36573

Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability. A user with local access could potentially exploit this vulnerability, leading to Information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T15:18:00.863Z. Updated 2025-06-12T15:35:26.976Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 Jun 2025, 22:35 WIB

Official record

CritPublished 12 Jun 2025, 21:56 WIB

CVE-2024-56158

XWiki allows SQL injection in query endpoint of REST API with Oracle

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T14:56:56.939Z. Updated 2026-01-12T14:43:46.541Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated12 Jan 2026, 21:43 WIB

Official record

MedPublished 12 Jun 2025, 21:27 WIB

CVE-2025-49200

Unencrypted backup contains sensitive information

The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T14:27:57.643Z. Updated 2025-06-17T18:59:46.867Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 01:59 WIB

Official record

HighPublished 12 Jun 2025, 21:26 WIB

CVE-2025-49199

Backup files can be modified and uploaded

The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it. This allows the attacker to disrupt the application by configuring the services in a way that they are unable to run, making the application unusable. They can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T14:26:32.507Z. Updated 2025-06-17T19:02:18.155Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 02:02 WIB

Official record

LowPublished 12 Jun 2025, 21:24 WIB

CVE-2025-49198

Poor quality of randomness in authorization tokens

The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T14:24:55.991Z. Updated 2025-06-17T19:02:49.762Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 02:02 WIB

Official record

MedPublished 12 Jun 2025, 21:23 WIB

CVE-2025-49197

Deprecated TLS version supported

The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user account.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T14:23:04.373Z. Updated 2025-06-17T19:03:20.901Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 02:03 WIB

Official record

MedPublished 12 Jun 2025, 21:20 WIB

CVE-2025-49196

Deprecated TLS version supported

A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in unexpected ways or spoof identities of other users or devices, affecting the confidentiality and integrity of the device.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-12T14:20:53.321Z. Updated 2025-06-17T19:03:56.791Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 02:03 WIB

Official record