Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 21–40 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

HighPublished 31 Jul 2025, 22:00 WIB

CVE-2013-10035

ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST request…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:00:42.257Z. Updated 2026-05-14T02:06:13.524Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:06 WIB

Official record

CritPublished 31 Jul 2025, 22:00 WIB

CVE-2014-125124

Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell command, allowing arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 21 to 40 of 3774.First page Next page

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:00:20.053Z. Updated 2026-05-15T11:14:22.583Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

HighPublished 31 Jul 2025, 21:59 WIB

CVE-2025-34146

nyariv sandboxjs 0.8.23 Prototype Pollution Sandbox Escape DoS

A prototype pollution vulnerability exists in @nyariv/sandboxjs versions <= 0.8.23, allowing attackers to inject arbitrary properties into Object.prototype via crafted JavaScript code. This can result in a denial-of-service (DoS) condition or, under certain conditions, escape the sandboxed environment intended to restr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:59:35.716Z. Updated 2026-10-08T15:21:18.196Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

HighPublished 31 Jul 2025, 21:58 WIB

CVE-2011-10008

MPlayer Lite r33064 M3U Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability exists in MPlayer Lite r33064 due to improper bounds checking when handling M3U playlist files containing long http:// URL entries. An attacker can craft a malicious .m3u file with a specially formatted URL that triggers a stack overflow when processed by the player, particul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:58:28.548Z. Updated 2026-04-07T14:01:59.344Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:01 WIB

Official record

MedPublished 31 Jul 2025, 21:57 WIB

CVE-2014-125122

Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint. By exploiting this flaw, an unauthenticated remote attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:57:59.666Z. Updated 2026-04-07T14:03:26.941Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

CritPublished 31 Jul 2025, 21:57 WIB

CVE-2014-125123

Kloxo < 6.1.12 Unauthenticated SQL Injection RCE

An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel (developed by LXCenter) prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, allowing an attacker to extract the administrator’s password f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:57:28.299Z. Updated 2026-05-15T11:14:21.879Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

CritPublished 31 Jul 2025, 21:56 WIB

CVE-2013-10033

Kimai 0.9.2 db_restore.php SQL Injection

An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw allows attackers to inject arbitrary SQL queries into the dates[] POST parameter, enabling file write via INTO OUTFILE under specific environmental conditions. This can lead to remote code execution …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:56:59.144Z. Updated 2026-04-07T14:02:56.764Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 31 Jul 2025, 21:56 WIB

CVE-2013-10034

Kaseya < 6.3.0.2 uploadImage.asp Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthenticated users to upload files to arbitrary paths via a crafted filename parameter in a multipart/form-data POST request. Due to the lack of authentication and input sanitation, an at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:56:30.930Z. Updated 2026-05-15T11:14:08.174Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

HighPublished 31 Jul 2025, 21:55 WIB

CVE-2013-10039

GestioIP 3.0 ip_checkhost.cgi RCE

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deployment configuration.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:55:54.624Z. Updated 2026-05-15T11:14:08.954Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

CritPublished 31 Jul 2025, 21:55 WIB

CVE-2013-10042

freeFTPd <= 1.0.10 PASS Command Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability exists in freeFTPd version 1.0.10 and earlier in the handling of the FTP PASS command. When an attacker sends a specially crafted password string, the application fails to validate input length, resulting in memory corruption. This can lead to denial of service or arbitrary c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:55:25.594Z. Updated 2026-05-15T11:14:10.534Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

CritPublished 31 Jul 2025, 21:54 WIB

CVE-2013-10038

FlashChat Arbitrary File Upload RCE

An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed remotely, resulting in arb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:54:47.793Z. Updated 2026-04-07T14:03:00.963Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

CritPublished 31 Jul 2025, 21:54 WIB

CVE-2012-10021

D-Link DIR-605L Captcha Handling Buffer Overflow

A stack-based buffer overflow vulnerability exists in D-Link DIR-605L Wireless N300 Cloud Router firmware versions 1.12 and 1.13 via the getAuthCode() function. The flaw arises from unsafe usage of sprintf() when processing user-supplied CAPTCHA data via the FILECODE parameter in /goform/formLogin. A remote unauthentic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:54:19.755Z. Updated 2026-05-14T02:06:05.524Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:06 WIB

Official record

CritPublished 31 Jul 2025, 21:53 WIB

CVE-2013-10040

ClipBucket <= 2.6 ofc_upload_image.php Arbitrary File Upload RCE

ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-library/. This endpoint allows unauthenticated users to upload arbitrary files, including executable PHP scripts. Once uploaded, the attacker can access the file via a predictable pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:53:55.238Z. Updated 2026-05-15T11:14:09.761Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

HighPublished 31 Jul 2025, 21:53 WIB

CVE-2013-10036

Beetel Connection Manager NetConfig.ini Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04 when parsing the UserName parameter in the NetConfig.ini configuration file. A crafted .ini file containing an overly long UserName value can overwrite the Structured Exception Handler (SEH), leading to arbitrary…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:53:39.747Z. Updated 2026-07-15T01:23:15.869Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

CritPublished 31 Jul 2025, 21:53 WIB

CVE-2013-10043

Astium VOIP PBX <= 2.1 SQL Injection File Upload RCE

A vulnerability exists in OAstium VoIP PBX astium-confweb-2.1-25399 and earlier, where improper input validation in the logon.php script allows an attacker to bypass authentication via SQL injection. Once authenticated as an administrator, the attacker can upload arbitrary PHP code through the importcompany field in im…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:53:20.420Z. Updated 2026-05-15T11:14:11.333Z.

CVSS9.5v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

CritPublished 31 Jul 2025, 21:52 WIB

CVE-2014-125121

Array Networks vAPV and vxAG Default Credential Privilege Escalation

Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of hardcoded SSH credentials (or SSH private key) and insecure permissions on a startup script. The devices ship with a default SSH login or a hardcoded DSA private …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:52:45.290Z. Updated 2026-04-07T14:03:26.222Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

HighPublished 31 Jul 2025, 21:50 WIB

CVE-2014-125125

A10 Networks AX Loadbalancer Path Traversal

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit this flaw by sending c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:50:53.697Z. Updated 2026-05-15T11:14:23.430Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

MedPublished 31 Jul 2025, 21:12 WIB

CVE-2025-7738

Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text expo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:12:02.648Z. Updated 2025-12-23T22:16:48.426Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated24 Dec 2025, 05:16 WIB

Official record

MedPublished 31 Jul 2025, 21:02 WIB

CVE-2025-8407

code-projects Vehicle Management filter2.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Vehicle Management 1.0. This issue affects some unknown processing of the file /filter2.php. The manipulation of the argument from leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:02:05.917Z. Updated 2025-07-31T14:16:40.311Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:16 WIB

Official record

MedPublished 31 Jul 2025, 20:48 WIB

CVE-2025-54589

copyparty Reflected XSS via Filter Parameter

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T13:48:41.615Z. Updated 2025-07-31T14:12:45.463Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:12 WIB

Official record