Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2041–2060 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 11 Nov 2025, 05:08 WIB

CVE-2025-64518

CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML Extern…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:08:06.229Z. Updated 2025-11-12T20:13:21.105Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:13 WIB

Official record

CritPublished 11 Nov 2025, 05:05 WIB

CVE-2025-64513

Milvus Proxy has Critical Authentication Bypass Vulnerability

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the Milvus cluster. This gran…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2041 to 2060 of 3020.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T22:05:14.744Z. Updated 2025-11-12T20:13:31.847Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:13 WIB

Official record

HighPublished 11 Nov 2025, 04:58 WIB

CVE-2025-64512

pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documents. Prior to version 20251107, pdfminer.six will execute arbitrary code from a malicious pickle file if provided with a malicious PDF file. The `CMapDB._load_data()` function in pdfminer.six uses `pic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:58:37.950Z. Updated 2026-01-08T22:04:11.704Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated09 Jan 2026, 05:04 WIB

Official record

HighPublished 11 Nov 2025, 04:56 WIB

CVE-2025-64507

Incus vulnerable to local privilege escalation through custom storage volumes

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:56:26.578Z. Updated 2025-11-12T20:13:48.233Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:13 WIB

Official record

MedPublished 11 Nov 2025, 04:51 WIB

CVE-2025-64504

Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs

Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1, in certain project membership APIs, the server trusted a user‑controlled orgId and used it in authorization checks. As a result, any authenticated user on the same Langfuse instanc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:51:36.603Z. Updated 2025-11-12T20:13:56.630Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:13 WIB

Official record

HighPublished 11 Nov 2025, 04:46 WIB

CVE-2025-64509

Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope can cause Bugsink to spend excessive CPU time in decompression, leading to denial of service. This can be done if the DSN is known, which it is in many common setups (JavaScript, Mobile Apps). The is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:46:11.117Z. Updated 2025-11-12T20:14:08.231Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:14 WIB

Official record

HighPublished 11 Nov 2025, 04:44 WIB

CVE-2025-64508

Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli streams, such as many zeros) can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the available memory and t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:44:24.832Z. Updated 2025-11-12T20:14:15.890Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:14 WIB

Official record

MedPublished 11 Nov 2025, 04:40 WIB

CVE-2025-64502

Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0-alpha.5, Parse Server per…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:40:33.698Z. Updated 2025-11-12T20:14:25.114Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:14 WIB

Official record

HighPublished 11 Nov 2025, 04:37 WIB

CVE-2025-64501

ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the `prosemirror_to_html` gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:37:01.010Z. Updated 2025-11-12T20:14:32.113Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 03:14 WIB

Official record

HighPublished 11 Nov 2025, 04:33 WIB

CVE-2025-64484

OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:33:58.018Z. Updated 2025-11-14T19:24:55.471Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated15 Nov 2025, 02:24 WIB

Official record

MedPublished 11 Nov 2025, 04:29 WIB

CVE-2025-64183

OpenEXR has use after free in PyObject_StealAttrString

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:29:54.234Z. Updated 2025-11-14T18:38:32.682Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated15 Nov 2025, 01:38 WIB

Official record

MedPublished 11 Nov 2025, 04:27 WIB

CVE-2025-64182

OpenEXR has buffer overflow in PyOpenEXR_old's channels() and channel()

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, a memory safety bug in the legacy OpenEXR Python adapter (the deprecated OpenEXR.InputFile wrapp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:27:21.176Z. Updated 2025-11-14T19:22:58.166Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated15 Nov 2025, 02:22 WIB

Official record

LowPublished 11 Nov 2025, 04:23 WIB

CVE-2025-64181

OpenEXR Makes Use of Uninitialized Memory

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:23:04.248Z. Updated 2025-11-12T21:05:26.971Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated13 Nov 2025, 04:05 WIB

Official record

LowPublished 11 Nov 2025, 04:18 WIB

CVE-2025-62780

changedetection.io vulnerable to stored XSS in Watch update via API

changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in changedetection.io Watch update API in versions prior to 0.50.34 due to insufficient security checks. Two scenarios are possible. In the first, an attacker can insert a new watch with an arbitrary URL wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:18:52.945Z. Updated 2025-11-10T21:43:52.020Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated11 Nov 2025, 04:43 WIB

Official record

HighPublished 11 Nov 2025, 04:15 WIB

CVE-2025-64167

Combodo iTop vulnerable to reflected XSS in webservices/export.php

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack (leading to JS execution) when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:15:11.632Z. Updated 2025-11-10T21:43:14.849Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated11 Nov 2025, 04:43 WIB

Official record

HighPublished 11 Nov 2025, 04:10 WIB

CVE-2025-49145

iTop admin can drop iTop database using webhooks

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks (mostly administrators) can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T21:10:19.742Z. Updated 2025-11-10T21:42:53.736Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated11 Nov 2025, 04:42 WIB

Official record

MedPublished 11 Nov 2025, 03:43 WIB

CVE-2025-48878

Combodo iTop vulnerable to IDOR with ModuleInstallation object

Combodo iTop is a web based IT service management tool. In versions on the 3.x branch prior to 3.2.2, an insecure direct object reference allows a user (e.g. with Service desk agent profile) to create a ModuleInstallation object when they shouldn't be able to do so. Version 3.2.2 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T20:43:04.366Z. Updated 2025-11-10T20:58:47.251Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated11 Nov 2025, 03:58 WIB

Official record

HighPublished 11 Nov 2025, 03:35 WIB

CVE-2025-48065

Combodo iTop vulnerable to reflected XSS via objection edition form error

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a field with an error contains malicious content. Versions 2.7.13 and 3.2.2 protect rendered HTML content.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T20:35:34.054Z. Updated 2025-11-10T20:58:59.754Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated11 Nov 2025, 03:58 WIB

Official record

HighPublished 11 Nov 2025, 03:33 WIB

CVE-2025-48055

Combodo iTop has stored XSS in user portal's browse brick

Combodo iTop is a web based IT service management tool. In versions prior to 3.2.2, when displaying content in a browse brick in the user portal, a cross-site scripting attack can occur. This is fixed in versions 3.2.2 and 3.3.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T20:33:48.310Z. Updated 2025-11-10T20:45:35.253Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated11 Nov 2025, 03:45 WIB

Official record

UnscoredPublished 11 Nov 2025, 03:00 WIB

CVE-2025-12729

CVE-2025-12729

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-10T20:00:56.626Z. Updated 2025-11-10T20:11:58.196Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Nov 2025, 03:11 WIB

Official record