Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2021–2040 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

MedPublished 11 Nov 2025, 07:19 WIB

CVE-2025-42894

Path Traversal vulnerability in SAP Business Connector

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system commands on the server,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:19:22.282Z. Updated 2026-02-26T17:46:57.500Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:46 WIB

Official record

MedPublished 11 Nov 2025, 07:17 WIB

CVE-2025-42893

Open Redirect vulnerability in SAP Business Connector

Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site displayed within an embedded frame. Successful exploitation could allow the attacker to steal sensitive information and pe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2021 to 2040 of 3020.First page Next page

Published 2025-11-11T00:17:34.419Z. Updated 2025-11-12T20:10:13.708Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:10 WIB

Official record

MedPublished 11 Nov 2025, 07:17 WIB

CVE-2025-42892

OS Command Injection vulnerability in SAP Business Connector

Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successfu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:17:18.198Z. Updated 2025-11-12T20:10:20.782Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:10 WIB

Official record

CritPublished 11 Nov 2025, 07:15 WIB

CVE-2025-42890

Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)

SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:15:29.439Z. Updated 2026-02-26T17:46:57.859Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:46 WIB

Official record

MedPublished 11 Nov 2025, 07:15 WIB

CVE-2025-42889

SQL Injection vulnerability in SAP Starter Solution (PL SAFT)

SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application's confidentiality and integrity but no impact on its availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:15:14.933Z. Updated 2025-11-12T20:11:06.168Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

MedPublished 11 Nov 2025, 07:15 WIB

CVE-2025-42888

Information Disclosure vulnerability in SAP GUI for Windows

SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process memory during runtime.This vulnerability has a high impact on confidentiality, with no impact on integrity and availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:15:00.675Z. Updated 2025-11-12T20:11:11.635Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

CritPublished 11 Nov 2025, 07:14 WIB

CVE-2025-42887

Code Injection vulnerability in SAP Solution Manager

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:14:45.636Z. Updated 2025-11-12T20:11:17.705Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

MedPublished 11 Nov 2025, 07:14 WIB

CVE-2025-42886

Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector

Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting in the execution of mal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:14:33.364Z. Updated 2025-11-12T20:11:23.922Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

MedPublished 11 Nov 2025, 07:14 WIB

CVE-2025-42885

Missing authentication in SAP HANA 2.0 (hdbrss)

Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable them to view information. As a result, it has a low impact on the confidentiality but no impact on the integrity and availability of the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:14:17.468Z. Updated 2025-11-12T20:11:31.942Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

MedPublished 11 Nov 2025, 07:14 WIB

CVE-2025-42884

JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:14:02.774Z. Updated 2025-11-12T20:11:40.031Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

LowPublished 11 Nov 2025, 07:13 WIB

CVE-2025-42883

Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migration Workbench)

Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low impact on the integr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:13:47.788Z. Updated 2025-11-12T20:11:48.613Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

MedPublished 11 Nov 2025, 07:13 WIB

CVE-2025-42882

Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:13:33.144Z. Updated 2025-11-12T20:11:58.984Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:11 WIB

Official record

UnscoredPublished 11 Nov 2025, 07:00 WIB

CVE-2024-57695

CVE-2024-57695

An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842) allows a local attacker to execute arbitrary code via the lock function. The manufacturer fixed the vulnerability in version 8.0 (4164.652.1856) from December 17, 2012.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-11T00:00:00.000Z. Updated 2025-11-12T20:22:58.401Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:22 WIB

Official record

HighPublished 11 Nov 2025, 05:44 WIB

CVE-2025-11578

Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system bi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:44:33.200Z. Updated 2025-12-02T20:08:21.684Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated03 Dec 2025, 03:08 WIB

Official record

HighPublished 11 Nov 2025, 05:43 WIB

CVE-2025-11892

DOM-based Cross-Site Scripting was identified in GitHub Enterprise Server Issues search allows privilege escalation and unauthorized workflow triggers

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have access to the target Git…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:43:41.790Z. Updated 2025-11-12T20:12:21.125Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:12 WIB

Official record

CritPublished 11 Nov 2025, 05:32 WIB

CVE-2021-4462

Employee Records System v1.0 Arbitrary File Upload RCE

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthenticated attacker to upload arbitrary files via the uploadID.php endpoint; uploaded files can be executed because the application does not perform proper server-side validation. Exploitation evidence was o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:32:33.955Z. Updated 2026-04-07T14:05:24.696Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:05 WIB

Official record

HighPublished 11 Nov 2025, 05:32 WIB

CVE-2018-25124

PacsOne Server 6.6.2 DICOM Web Viewer Directory Traversal LFI

PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path' parameter. Exploitatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:32:03.086Z. Updated 2026-04-07T14:03:47.357Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

LowPublished 11 Nov 2025, 05:28 WIB

CVE-2025-64529

SpiceDB's WriteRelationships fails silently if payload is too big

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions prior to 1.45.2, users who use the exclusion operator somewhere in their authorization schema; have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:28:51.589Z. Updated 2025-11-12T20:12:52.552Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:12 WIB

Official record

HighPublished 11 Nov 2025, 05:17 WIB

CVE-2025-64519

TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In versions up to and including 2.8.8, an authenticated SQL injection vulnerability exists in the moderator control panel (`modcp.php`). Users with moderator permissions can exploit this vulnerability by supplying a malicious `topic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:17:31.083Z. Updated 2025-11-12T20:13:03.908Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:13 WIB

Official record

CritPublished 11 Nov 2025, 05:11 WIB

CVE-2025-64522

Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerabilit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:11:18.863Z. Updated 2025-11-12T20:13:12.894Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:13 WIB

Official record