Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 2281–2300 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 11 Jul 2025, 10:02 WIB

CVE-2025-7436

Campcodes Online Recruitment Management System ajax.php sql injection

A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_vacancy. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T03:02:06.269Z. Updated 2025-07-11T13:24:30.269Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:24 WIB

Official record

MedPublished 11 Jul 2025, 09:02 WIB

CVE-2025-7435

LiveHelperChat lhc-php-resque Extension List list cross site scripting

A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. This affects an unknown part of the file /site_admin/lhcphpresque/list/ of the component List Handler. The manipulation of the argument queue name leads to cross si…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2281 to 2300 of 3774.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T02:02:07.812Z. Updated 2025-07-11T13:25:38.312Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:25 WIB

Official record

HighPublished 11 Jul 2025, 08:32 WIB

CVE-2025-7434

Tenda FH451 POST Request addressNat fromAddressNat stack-based overflow

A vulnerability was found in Tenda FH451 up to 1.0.0.9 and classified as critical. Affected by this issue is the function fromAddressNat of the file /goform/addressNat of the component POST Request Handler. The manipulation of the argument page leads to stack-based buffer overflow. The attack may be launched remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T01:32:08.701Z. Updated 2025-07-11T13:31:24.317Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:31 WIB

Official record

HighPublished 11 Jul 2025, 08:02 WIB

CVE-2025-7423

Tenda O3V2 httpd setWrlFilterList formWifiMacFilterSet stack-based overflow

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). Affected by this vulnerability is the function formWifiMacFilterSet of the file /goform/setWrlFilterList of the component httpd. The manipulation of the argument macList leads to stack-based buffer overflow. The attack can be launched remote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T01:02:08.323Z. Updated 2025-07-11T13:32:32.154Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:32 WIB

Official record

HighPublished 11 Jul 2025, 07:32 WIB

CVE-2025-7422

Tenda O3V2 httpd setNetworkService setAutoReboot stack-based overflow

A vulnerability classified as critical has been found in Tenda O3V2 1.0.0.12(3880). Affected is the function setAutoReboot of the file /goform/setNetworkService of the component httpd. The manipulation of the argument week leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:32:07.629Z. Updated 2025-07-11T13:33:23.043Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:33 WIB

Official record

MedPublished 11 Jul 2025, 07:16 WIB

CVE-2025-5241

Denial-of-Service Vulnerability in MELSEC iQ-F Series

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a cert…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:16:43.275Z. Updated 2025-07-11T13:34:05.817Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:34 WIB

Official record

HighPublished 11 Jul 2025, 07:02 WIB

CVE-2025-7421

Tenda O3V2 httpd operateMacFilter fromMacFilterModify stack-based overflow

A vulnerability was found in Tenda O3V2 1.0.0.12(3880). It has been rated as critical. This issue affects the function fromMacFilterModify of the file /goform/operateMacFilter of the component httpd. The manipulation of the argument mac leads to stack-based buffer overflow. The attack may be initiated remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:02:06.586Z. Updated 2025-07-11T13:35:03.633Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:35 WIB

Official record

HighPublished 11 Jul 2025, 07:00 WIB

CVE-2013-3307

CVE-2013-3307

Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2025-07-11T19:32:03.983Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated12 Jul 2025, 02:32 WIB

Official record

UnscoredPublished 11 Jul 2025, 07:00 WIB

CVE-2023-38327

CVE-2023-38327

An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote attackers to enumerate the users of web applications based on server response.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2025-07-15T19:55:59.782Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Jul 2025, 02:55 WIB

Official record

UnscoredPublished 11 Jul 2025, 07:00 WIB

CVE-2023-38329

CVE-2023-38329

An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2025-07-15T19:55:53.646Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Jul 2025, 02:55 WIB

Official record

MedPublished 11 Jul 2025, 07:00 WIB

CVE-2025-45582

CVE-2025-45582

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2025-11-02T00:12:55.951Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated02 Nov 2025, 07:12 WIB

Official record

UnscoredPublished 11 Jul 2025, 07:00 WIB

CVE-2025-51591

CVE-2025-51591

A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2026-07-05T16:11:02.049Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:11 WIB

Official record

UnscoredPublished 11 Jul 2025, 07:00 WIB

CVE-2025-52089

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2025-07-19T01:47:59.764Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jul 2025, 08:47 WIB

Official record

MedPublished 11 Jul 2025, 07:00 WIB

CVE-2025-52994

CVE-2025-52994

gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2025-07-11T15:06:03.756Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated11 Jul 2025, 22:06 WIB

Official record

MedPublished 11 Jul 2025, 07:00 WIB

CVE-2025-53864

CVE-2025-53864

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have ch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-11T00:00:00.000Z. Updated 2025-09-23T18:38:15.547Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated24 Sep 2025, 01:38 WIB

Official record

MedPublished 11 Jul 2025, 06:45 WIB

CVE-2025-53471

Emerson ValveLink Products Improper Input Validation

Emerson ValveLink products receive input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T23:45:39.592Z. Updated 2026-06-04T20:45:43.072Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated05 Jun 2026, 03:45 WIB

Official record

MedPublished 11 Jul 2025, 06:43 WIB

CVE-2025-48496

Emerson ValveLink Products Uncontrolled Search Path Element

Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T23:43:33.592Z. Updated 2025-07-11T13:54:00.868Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:54 WIB

Official record

HighPublished 11 Jul 2025, 06:41 WIB

CVE-2025-46358

Emerson ValveLink Products Protection Mechanism Failure

Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T23:41:25.965Z. Updated 2025-07-11T13:54:26.695Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:54 WIB

Official record

HighPublished 11 Jul 2025, 06:39 WIB

CVE-2025-50109

Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory

Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T23:39:11.220Z. Updated 2025-07-11T13:54:53.276Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:54 WIB

Official record

CritPublished 11 Jul 2025, 06:37 WIB

CVE-2025-52579

Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory

Emerson ValveLink Products store sensitive information in cleartext in memory. The sensitive memory might be saved to disk, stored in a core dump, or remain uncleared if the product crashes, or if the programmer does not properly clear the memory before freeing it.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T23:37:21.515Z. Updated 2025-07-11T13:55:15.422Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 20:55 WIB

Official record