Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 221–240 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2025-15114

Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:47.116Z. Updated 2026-03-11T19:29:49.602Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated12 Mar 2026, 02:29 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2025-15113

Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload

Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary code on the home auto…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 221 to 240 of 5493.First page Next page

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:46.694Z. Updated 2026-03-11T19:30:48.494Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated12 Mar 2026, 02:30 WIB

Official record

MedPublished 31 Dec 2025, 05:41 WIB

CVE-2025-15112

Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability

Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to arbitrary websites when clicking on a specially constructed l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:46.247Z. Updated 2026-03-11T19:29:59.272Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated12 Mar 2026, 02:29 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2025-15111

Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability

Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:45.831Z. Updated 2026-03-11T19:30:33.994Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated12 Mar 2026, 02:30 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2024-58338

Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute Command

Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command. Attackers can exploit the traceroute command to inject shell commands and gain full root access to the device by bypassing the restricted login environment.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:45.411Z. Updated 2026-03-05T12:03:44.307Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:03 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2024-58337

Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI

Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:44.989Z. Updated 2026-01-16T19:00:19.517Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Jan 2026, 02:00 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2024-58336

Akuvox Smart Intercom S539 Unauthenticated Video Stream Disclosure

Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080. Attackers can retrieve video stream data without authentication by directly accessing the specified endpoint on affected Akuvox doorphone and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:44.569Z. Updated 2026-01-16T19:00:19.275Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Jan 2026, 02:00 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2024-58315

Tosibox Key Service 3.3.0 Local Privilege Escalation via Unquoted Service Path

Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can exploit the service startup process by inserting malicious code in the system root path, enabling unauthorized code execution during…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:44.147Z. Updated 2026-08-29T13:38:24.925Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 20:38 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2023-54327

Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:43.728Z. Updated 2026-05-14T02:07:05.311Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:07 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2023-54163

NLB mKlik Macedonia 3.3.12 SQL Injection via International Transfer Parameters

NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the mobile banking application.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:43.245Z. Updated 2026-01-16T19:00:18.541Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated17 Jan 2026, 02:00 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2023-53983

Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass

Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:42.839Z. Updated 2026-10-01T21:44:54.086Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 04:44 WIB

Official record

MedPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50804

JM-DATA ONU JF511-TV 1.0.67 Cross-Site Request Forgery (CSRF) Vulnerability

JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to cross-site request forgery (CSRF) attacks, allowing attackers to perform administrative actions on behalf of authenticated users without their knowledge or consent.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:42.422Z. Updated 2026-01-16T19:00:14.014Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated17 Jan 2026, 02:00 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50803

JM-DATA ONU JF511-TV 1.0.67 Default Credentials Vulnerability

JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:41.999Z. Updated 2026-01-05T20:24:15.140Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Jan 2026, 03:24 WIB

Official record

MedPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50801

JM-DATA ONU JF511-TV 1.0.67 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability

JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to authenticated stored cross-site scripting (XSS) attacks, allowing attackers with authenticated access to inject malicious scripts that will be executed in other users' browsers when they view the affected content.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:41.205Z. Updated 2026-01-02T21:21:47.667Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated03 Jan 2026, 04:21 WIB

Official record

MedPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50800

H3C SSL VPN n/a Username Enumeration via Login Script Credential Verification

H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parameter. Attackers can submit different usernames to the login_submit.cgi endpoint and analyze response messages to distinguish between existing and non-existing accounts.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:40.801Z. Updated 2026-01-02T19:51:05.508Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Jan 2026, 02:51 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50799

Fetch Softworks Fetch FTP Client 5.8.2 Remote CPU Consumption Denial of Service

Fetch FTP Client 5.8.2 contains a denial of service vulnerability that allows attackers to trigger 100% CPU consumption by sending long server responses. Attackers can send specially crafted FTP server responses exceeding 2K bytes to cause excessive resource utilization and potentially crash the application.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:40.340Z. Updated 2026-01-02T19:47:21.277Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated03 Jan 2026, 02:47 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50796

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:39.503Z. Updated 2026-10-01T19:19:13.061Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50795

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via traceroute.php

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the traceroute.php script, which triggers the malicious…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:39.100Z. Updated 2026-10-01T19:19:12.365Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50794

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:38.681Z. Updated 2026-10-01T19:19:11.695Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

HighPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50793

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Authenticated Command Injection via www-data-handler.php

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows attackers to inject system commands through the 'services' POST parameter. Attackers can exploit this vulnerability by crafting malicious 'services' parameter values to execute ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:38.291Z. Updated 2026-10-01T19:19:11.069Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record