Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 2301–2320 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 13 Aug 2025, 09:43 WIB

CVE-2025-8881

CVE-2025-8881

Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T02:43:44.561Z. Updated 2025-08-13T20:01:13.370Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 03:01 WIB

Official record

UnscoredPublished 13 Aug 2025, 09:43 WIB

CVE-2025-8901

CVE-2025-8901

Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T02:43:44.252Z. Updated 2025-08-28T16:36:58.788Z.

CVSS—

Showing 2301 to 2320 of 3629.First page Next page

KEV

Not listed

EPSSPresent

Updated28 Aug 2025, 23:36 WIB

Official record

UnscoredPublished 13 Aug 2025, 09:43 WIB

CVE-2025-8880

CVE-2025-8880

Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T02:43:43.711Z. Updated 2026-02-26T17:48:41.969Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

UnscoredPublished 13 Aug 2025, 09:43 WIB

CVE-2025-8879

CVE-2025-8879

Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of gestures. (Chromium security severity: High)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T02:43:43.287Z. Updated 2026-02-26T17:48:42.532Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

HighPublished 13 Aug 2025, 08:49 WIB

CVE-2025-4410

SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution.

A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T01:49:47.629Z. Updated 2025-08-14T05:53:21.108Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Aug 2025, 12:53 WIB

Official record

HighPublished 13 Aug 2025, 08:46 WIB

CVE-2025-4277

Tcg2Smm: improper input validation may lead to arbitrary code execution

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T01:46:22.998Z. Updated 2025-08-14T05:54:24.230Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Aug 2025, 12:54 WIB

Official record

HighPublished 13 Aug 2025, 08:41 WIB

CVE-2025-4276

UsbCoreDxe: improper input validation may lead to arbitrary code execution

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T01:41:56.834Z. Updated 2025-08-14T05:54:07.744Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Aug 2025, 12:54 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-43982

CVE-2025-43982

Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be disabled in the GUI.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-14T14:04:16.127Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:04 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-43986

CVE-2025-43986

An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default and exposed over the WAN interface without authentication.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-14T14:07:42.793Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:07 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-43988

CVE-2025-43988

KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-14T14:11:41.071Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 21:11 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-43989

CVE-2025-43989

The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-13T20:30:40.433Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 03:30 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-45313

CVE-2025-45313

A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2026-07-05T01:08:37.762Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:08 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-45314

CVE-2025-45314

A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2026-07-05T01:08:41.591Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:08 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-45315

CVE-2025-45315

A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2026-07-05T01:08:45.592Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:08 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-45316

CVE-2025-45316

A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-13T20:28:00.065Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 03:28 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-45317

CVE-2025-45317

A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-13T20:25:26.076Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 03:25 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-50251

CVE-2025-50251

Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-13T20:31:26.260Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 03:31 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-50594

CVE-2025-50594

An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-14T13:55:33.643Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 20:55 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-50608

CVE-2025-50608

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_base_set in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-14T13:38:23.789Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Aug 2025, 20:38 WIB

Official record

UnscoredPublished 13 Aug 2025, 07:00 WIB

CVE-2025-50609

CVE-2025-50609

A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of specify_parame in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-13T00:00:00.000Z. Updated 2025-08-14T17:30:37.669Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Aug 2025, 00:30 WIB

Official record