Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 2201–2220 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

UnscoredPublished 12 Jul 2025, 10:30 WIB

CVE-2025-24294

CVE-2025-24294

The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the na…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-12T03:30:40.226Z. Updated 2025-07-16T13:37:43.395Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Jul 2025, 20:37 WIB

Official record

HighPublished 12 Jul 2025, 06:21 WIB

CVE-2025-5199

LPE on Multipass for macOS

In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T23:21:30.996Z. Updated 2025-07-14T20:12:58.921Z.

Showing 2201 to 2220 of 3774.First page Next page

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated15 Jul 2025, 03:12 WIB

Official record

HighPublished 12 Jul 2025, 04:32 WIB

CVE-2025-7460

TOTOLINK T6 HTTP POST Request cstecgi.cgi setWiFiAclRules buffer overflow

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be lau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T21:32:07.852Z. Updated 2025-07-14T20:13:07.116Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2025, 03:13 WIB

Official record

MedPublished 12 Jul 2025, 04:20 WIB

CVE-2025-53636

Open OnDemand Shell App closed websocket DoS

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T21:20:14.261Z. Updated 2025-07-14T20:13:13.885Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated15 Jul 2025, 03:13 WIB

Official record

MedPublished 12 Jul 2025, 04:02 WIB

CVE-2025-7459

code-projects Mobile Shop EditMobile.php sql injection

A vulnerability classified as critical was found in code-projects Mobile Shop 1.0. This vulnerability affects unknown code of the file /EditMobile.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T21:02:05.895Z. Updated 2025-07-14T20:13:20.776Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2025, 03:13 WIB

Official record

MedPublished 12 Jul 2025, 03:32 WIB

CVE-2025-7457

Campcodes Online Movie Theater Seat Reservation System manage_movie.php sql injection

A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects an unknown part of the file /admin/manage_movie.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T20:32:06.234Z. Updated 2025-07-11T20:39:02.946Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 03:39 WIB

Official record

MedPublished 12 Jul 2025, 03:02 WIB

CVE-2025-7456

Campcodes Online Movie Theater Seat Reservation System reserve.php sql injection

A vulnerability, which was classified as critical, has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this issue is some unknown functionality of the file /reserve.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T20:02:05.824Z. Updated 2025-07-11T20:20:13.568Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 03:20 WIB

Official record

MedPublished 12 Jul 2025, 02:32 WIB

CVE-2025-7455

Campcodes Online Movie Theater Seat Reservation System manage_reserve.php sql injection

A vulnerability classified as critical was found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /manage_reserve.php. The manipulation of the argument mid leads to sql injection. The attack can be launched remotely. The exploit has be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T19:32:05.247Z. Updated 2025-07-11T19:50:32.259Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 02:50 WIB

Official record

MedPublished 12 Jul 2025, 02:02 WIB

CVE-2025-7454

Campcodes Online Movie Theater Seat Reservation System manage_theater.php sql injection

A vulnerability classified as critical has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected is an unknown function of the file /admin/manage_theater.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been discl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T19:02:05.884Z. Updated 2025-07-11T19:34:29.566Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 02:34 WIB

Official record

CritPublished 12 Jul 2025, 01:53 WIB

CVE-2025-7503

CVE-2025-7503

An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s web interface or user manual. An attacker with network access can auth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T18:53:24.618Z. Updated 2025-07-11T19:17:15.281Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 02:17 WIB

Official record

MedPublished 12 Jul 2025, 01:37 WIB

CVE-2025-3631

IBM MQ denial of service

An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T18:37:38.769Z. Updated 2025-08-18T01:35:24.388Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Aug 2025, 08:35 WIB

Official record

MedPublished 12 Jul 2025, 01:32 WIB

CVE-2025-7453

saltbo zpan JSON Web Token token.go NewToken hard-coded password

A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/internal/app/service/token.go of the component JSON Web Token Handler. The manipulation with the input 123 leads to use of hard-coded password. The attack may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T18:32:05.187Z. Updated 2025-07-11T19:11:13.274Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 02:11 WIB

Official record

UnscoredPublished 12 Jul 2025, 01:26 WIB

CVE-2025-30403

CVE-2025-30403

A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T18:26:51.212Z. Updated 2025-07-11T19:23:37.185Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Jul 2025, 02:23 WIB

Official record

UnscoredPublished 12 Jul 2025, 00:39 WIB

CVE-2025-30402

CVE-2025-30402

A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T17:39:26.646Z. Updated 2025-07-11T18:31:13.286Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Jul 2025, 01:31 WIB

Official record

MedPublished 12 Jul 2025, 00:33 WIB

CVE-2025-53642

haxcms-nodejs and haxcms-php Improperly Terminate Sessions

haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T17:33:05.861Z. Updated 2025-07-14T14:17:55.724Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated14 Jul 2025, 21:17 WIB

Official record

MedPublished 12 Jul 2025, 00:32 WIB

CVE-2025-7452

kone-net go-chat Endpoint file_controller.go GetFile path traversal

A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/file_controller.go of the component Endpoint. The manipulation of the argument fileName leads to path traversal. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T17:32:05.202Z. Updated 2025-07-11T18:12:17.950Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 01:12 WIB

Official record

HighPublished 12 Jul 2025, 00:28 WIB

CVE-2025-53641

Postiz allows header mutation in middleware facilitates resulting in SSRF

Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to initiate unauthorized outbound requests from …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T17:28:20.001Z. Updated 2025-07-11T17:56:30.605Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated12 Jul 2025, 00:56 WIB

Official record

HighPublished 12 Jul 2025, 00:10 WIB

CVE-2025-43856

immich allows account hijacking through oauth2

immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, because the state parameter is not being checked. The oauth2 state parameter is similar to a csrf token, so when the user starts the login flow this unpredictable tok…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T17:10:52.423Z. Updated 2025-07-11T18:13:00.477Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 01:13 WIB

Official record

MedPublished 12 Jul 2025, 00:02 WIB

CVE-2025-7450

letseeqiji gorobbs API user.go ResetUserAvatar path traversal

A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controller/api/v1/user.go of the component API. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T17:02:05.790Z. Updated 2025-07-11T18:16:27.962Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 01:16 WIB

Official record

LowPublished 12 Jul 2025, 00:00 WIB

CVE-2024-47065

Traceroute_APP responses are not rate-limited.

Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and continuously respond. You could easily g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T17:00:44.221Z. Updated 2025-07-11T18:21:44.292Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated12 Jul 2025, 01:21 WIB

Official record