Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2221–2240 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 08 Nov 2025, 03:15 WIB

CVE-2025-64439

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 2.1.2 and below, the JsonPlusSerializer (used as the default serialization protocol for all checkpointing) contains a Remote Code Execution (RCE) vulnerability when deseria…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T20:15:21.710Z. Updated 2025-11-07T20:21:52.610Z.

CVSS7.4v4.0KEVNot listedEPSSPresentUpdated08 Nov 2025, 03:21 WIB

Official record

CritPublished 08 Nov 2025, 02:42 WIB

CVE-2025-10230

Samba: command injection in wins server hook script

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2221 to 2240 of 3020.First page Next page

Published 2025-11-07T19:42:06.624Z. Updated 2026-08-31T11:24:35.193Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 18:24 WIB

Official record

MedPublished 08 Nov 2025, 02:04 WIB

CVE-2025-36006

IBM Db2 denial of service

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial due to the improper release of resources after use.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T19:04:05.595Z. Updated 2025-11-07T19:15:29.778Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 02:15 WIB

Official record

MedPublished 08 Nov 2025, 01:59 WIB

CVE-2025-7700

Ffmpeg: null pointer dereference in ffmpeg als decoder (libavcodec/alsdec.c)

A flaw was found in FFmpeg’s ALS audio decoder, where it does not properly check for memory allocation failures. This can cause the application to crash when processing certain malformed audio files. While it does not lead to data theft or system control, it can be used to disrupt services and cause a denial of service…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:59:28.962Z. Updated 2026-05-06T14:38:29.969Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated06 May 2026, 21:38 WIB

Official record

MedPublished 08 Nov 2025, 01:57 WIB

CVE-2025-36008

IBM Db2 denial of service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper allocation of resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:57:09.615Z. Updated 2025-11-07T19:10:03.557Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 02:10 WIB

Official record

MedPublished 08 Nov 2025, 01:53 WIB

CVE-2025-36131

IBM Db2 information disclosure

IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which could be obtained by a third party with physical access to the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:53:45.472Z. Updated 2025-11-07T19:06:54.110Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 02:06 WIB

Official record

MedPublished 08 Nov 2025, 01:45 WIB

CVE-2025-36136

IBM denial of service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local user to cause a denial of service due to the database monitor script incorrectly detecting that the instance is still starting under specific conditions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:45:46.550Z. Updated 2025-11-07T18:53:53.234Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:53 WIB

Official record

MedPublished 08 Nov 2025, 01:40 WIB

CVE-2025-36185

IBM Db2 denial of service

IBM Db2 12.1.0 through 12.1.2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a local user to cause a denial of service due to improper neutralization of special elements in data query logic.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:40:59.591Z. Updated 2025-11-07T18:52:26.052Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:52 WIB

Official record

MedPublished 08 Nov 2025, 01:40 WIB

CVE-2025-12890

Bluetooth: peripheral: Invalid handling of malformed connection request

Improper handling of malformed Connection Request with the interval set to be 1 (which supposed to be illegal) and the chM 0x7CFFFFFFFF triggers a crash. The peripheral will not be connectable after it.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:40:56.266Z. Updated 2026-10-13T19:55:57.611Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated14 Oct 2026, 02:55 WIB

Official record

HighPublished 08 Nov 2025, 01:40 WIB

CVE-2025-36186

IBM Db2 privilege escalation

IBM Db2 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) under specific configurations could allow a local user to execute malicious code that escalate their privileges to root due to execution of unnecessary privileges operated at a higher than minimum level.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:40:32.478Z. Updated 2026-02-26T17:47:07.406Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

MedPublished 08 Nov 2025, 01:38 WIB

CVE-2025-64432

KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the cl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:38:33.246Z. Updated 2025-11-07T18:54:46.779Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:54 WIB

Official record

MedPublished 08 Nov 2025, 01:38 WIB

CVE-2025-33012

IBM Db2 improper account lockout

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux could allow an authenticated user to regain access after account lockout due to password use after expiration date.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:38:29.123Z. Updated 2025-11-07T18:56:16.588Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:56 WIB

Official record

MedPublished 08 Nov 2025, 01:36 WIB

CVE-2025-2534

IBM Db2 denial of service

IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:36:49.488Z. Updated 2025-11-07T18:56:31.224Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:56 WIB

Official record

MedPublished 08 Nov 2025, 01:26 WIB

CVE-2025-36135

IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to Cross-Site Scripting

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:26:57.845Z. Updated 2025-11-07T18:47:27.813Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:47 WIB

Official record

MedPublished 08 Nov 2025, 01:23 WIB

CVE-2024-47118

IBM Db2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query

IBM Db2 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:23:07.665Z. Updated 2025-11-07T18:48:16.332Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:48 WIB

Official record

HighPublished 08 Nov 2025, 01:09 WIB

CVE-2025-64431

IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering

Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks through its V2Beta API, allowing authenticated users with specific administrator roles within one organization to access and modify data belonging to other organizati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:09:25.466Z. Updated 2025-11-07T18:29:24.551Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:29 WIB

Official record

MedPublished 08 Nov 2025, 01:04 WIB

CVE-2025-12829

CVE-2025-12829

An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:04:15.700Z. Updated 2025-11-07T18:13:55.938Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:13 WIB

Official record

MedPublished 08 Nov 2025, 01:02 WIB

CVE-2025-12873

Campcodes School File Management update_user.php sql injection

A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:02:07.310Z. Updated 2025-11-07T18:27:05.910Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:27 WIB

Official record

HighPublished 08 Nov 2025, 01:01 WIB

CVE-2025-9458

PRT File Parsing Memory Corruption Vulnerability

A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T18:01:48.595Z. Updated 2026-05-08T18:25:56.856Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated09 May 2026, 01:25 WIB

Official record

HighPublished 08 Nov 2025, 00:55 WIB

CVE-2025-64430

Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3.1-alpha.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter, al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T17:55:27.768Z. Updated 2025-11-07T18:23:02.250Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:23 WIB

Official record