Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 2301–2320 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63638

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Add Task" b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:53:48.931Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:53 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63639

CVE-2025-63639

The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing the conversation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:54:49.563Z.

Showing 2301 to 2320 of 3020.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:54 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63640

CVE-2025-63640

Sourcecodester Medicine Reminder App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Medicine Name" and "Notes (Optional)" fields when creating an "Upcoming Reminder", allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Sa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:57:27.995Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:57 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63686

CVE-2025-63686

There is an arbitrary file download vulnerability in GuoMinJim PersonManage thru commit 5a02b1ab208feacf3a34fc123c9381162afbaa95 (2020-11-23) in the document query function under the Download Center menu in the PersonManage system.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T17:02:24.609Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 00:02 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63687

CVE-2025-63687

An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users posts.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T17:02:09.707Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 00:02 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63689

CVE-2025-63689

Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacker to execute arbitrary code via the orderby parameter

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2026-01-27T17:07:38.095Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jan 2026, 00:07 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63690

CVE-2025-63690

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a parameterless constructor and its methods with parameter type String through reflection. At this time, the eval method in Tomcat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-07T18:41:28.538Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:41 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63691

CVE-2025-63691

In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-07T18:49:24.568Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Nov 2025, 01:49 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63713

CVE-2025-63713

Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test titles and matching p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:49:02.610Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:49 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63714

CVE-2025-63714

Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of user-supplied input whe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:46:37.928Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:46 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63716

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:51:49.558Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:51 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63717

CVE-2025-63717

The change password functionality at /pet_grooming/admin/change_pass.php in SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. The application does not implement adequate anti-CSRF tokens or same-site cookie restrictions, allowing attackers to trick authentic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:52:47.893Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:52 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63718

CVE-2025-63718

A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T19:50:00.663Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 02:50 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63783

CVE-2025-63783

A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for the requested proj…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T17:04:57.483Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 00:04 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63784

CVE-2025-63784

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing a redirect URL. A remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-12T17:07:08.494Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2025, 00:07 WIB

Official record

UnscoredPublished 07 Nov 2025, 07:00 WIB

CVE-2025-63785

CVE-2025-63785

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An attacker can exploit this…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-07T00:00:00.000Z. Updated 2025-11-10T20:03:11.850Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Nov 2025, 03:03 WIB

Official record

MedPublished 07 Nov 2025, 06:20 WIB

CVE-2025-12789

Rhsso: open redirect

A flaw was found in Red Hat Single Sign-On. This issue is an Open Redirect vulnerability that occurs during the logout process. The redirect_uri parameter associated with the openid-connect logout protocol does not properly validate the provided URL.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-06T23:20:50.489Z. Updated 2025-11-07T17:59:33.792Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Nov 2025, 00:59 WIB

Official record

HighPublished 07 Nov 2025, 05:31 WIB

CVE-2025-58423

Advantech DeviceOn/iEdge Path Traversal

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-06T22:31:02.740Z. Updated 2025-12-01T15:36:29.593Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Dec 2025, 22:36 WIB

Official record

HighPublished 07 Nov 2025, 05:29 WIB

CVE-2025-59171

Advantech DeviceOn/iEdge Path Traversal

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-06T22:29:27.309Z. Updated 2025-11-07T14:02:38.873Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 21:02 WIB

Official record

HighPublished 07 Nov 2025, 05:27 WIB

CVE-2025-62630

Advantech DeviceOn/iEdge Path Traversal

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-06T22:27:14.439Z. Updated 2025-11-07T14:03:30.791Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Nov 2025, 21:03 WIB

Official record