Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 2321–2340 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 11 Jul 2025, 04:07 WIB

CVE-2025-6390

Cleartext storage of sensitive information in Brocade SANnav server audit logs.

Brocade SANnav before SANnav 2.4.0a logs passwords and pbe keys in the Brocade SANnav server audit logs after installation and under specific conditions. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server admin of the host server and are not…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T21:07:02.812Z. Updated 2025-07-11T16:57:31.743Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 23:57 WIB

Official record

MedPublished 11 Jul 2025, 04:02 WIB

CVE-2025-7415

Tenda O3V2 httpd getTraceroute fromTraceroutGet command injection

A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.12(3880). This issue affects the function fromTraceroutGet of the file /goform/getTraceroute of the component httpd. The manipulation of the argument dest leads to command injection. The attack may be initiated remotely. The exploit h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2321 to 2340 of 3774.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T21:02:07.027Z. Updated 2025-07-11T16:58:46.182Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 23:58 WIB

Official record

MedPublished 11 Jul 2025, 03:41 WIB

CVE-2025-4662

Plaintext security passwords are logged in the audit logs while executing openssl cmd

Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase from the command line or while providing the passphrase through a temporary file. These audit logs are the local server VM’s audit logs and are not controlled b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:41:20.151Z. Updated 2025-07-11T16:59:42.253Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 23:59 WIB

Official record

MedPublished 11 Jul 2025, 03:32 WIB

CVE-2025-7414

Tenda O3V2 httpd setPingInfo fromNetToolGet os command injection

A vulnerability classified as critical was found in Tenda O3V2 1.0.0.12(3880). This vulnerability affects the function fromNetToolGet of the file /goform/setPingInfo of the component httpd. The manipulation of the argument domain leads to os command injection. The attack can be initiated remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:32:07.344Z. Updated 2025-07-10T20:47:41.403Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:47 WIB

Official record

HighPublished 11 Jul 2025, 03:19 WIB

CVE-2025-3947

Integer underflow during processing of short network packets in CDA FTEB responder

The Honeywell Experion PKS contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in improper integer data value checking during subtraction leading to a denial of serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:19:13.991Z. Updated 2025-08-04T19:46:31.982Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 02:46 WIB

Official record

HighPublished 11 Jul 2025, 03:16 WIB

CVE-2025-3946

Incorrect response generation during FTEB protocol processing

The Honeywell Experion PKS and OneWireless WDM contains a Deployment of Wrong Handler vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to Input Data Manipulation, which could result in incorrect handling of packets leading to remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:16:54.743Z. Updated 2025-08-04T19:46:15.112Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 02:46 WIB

Official record

CritPublished 11 Jul 2025, 03:15 WIB

CVE-2025-2523

Lack of buffer clearing before reuse may result in incorrect system behavior.

The Honeywell Experion PKS and OneWireless WDM contains an Integer Underflow vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in a failure during subtraction allowing remote co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:15:32.600Z. Updated 2025-08-04T19:45:51.105Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 02:45 WIB

Official record

MedPublished 11 Jul 2025, 03:11 WIB

CVE-2025-2522

Lack of buffer clearing before reuse may result in incorrect system behavior.

The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which could result in buffer reuse which may cause incorrect s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:11:43.603Z. Updated 2025-08-04T19:45:13.439Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 02:45 WIB

Official record

HighPublished 11 Jul 2025, 03:08 WIB

CVE-2025-2521

Lack of indexes’ validation against buffer borders leads to remote code execution.

The Honeywell Experion PKS and OneWireless WDM contains a Memory Buffer vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to an Overread Buffers, which could result in improper index validation against buffer borders leading to remote code execut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:08:04.077Z. Updated 2025-08-04T19:44:27.744Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 02:44 WIB

Official record

MedPublished 11 Jul 2025, 03:02 WIB

CVE-2025-7413

code-projects Library System profile.php unrestricted upload

A vulnerability classified as critical has been found in code-projects Library System 1.0. This affects an unknown part of the file /user/teacher/profile.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T20:02:05.739Z. Updated 2025-07-10T20:20:15.391Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:20 WIB

Official record

HighPublished 11 Jul 2025, 02:54 WIB

CVE-2025-2520

Dereferencing of an uninitialized pointer leads to denial of service.

The Honeywell Experion PKS contains an Uninitialized Variable in the common Epic Platform Analyzer (EPA) communications. An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, which results in a dereferencing of an uninitialized pointer leading to a denial of service.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:54:35.250Z. Updated 2025-08-04T19:44:48.506Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 02:44 WIB

Official record

HighPublished 11 Jul 2025, 02:46 WIB

CVE-2025-53629

cpp-httplib Unbounded Memory Allocation in Chunked/No-Length Requests Vulnerability

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.23.0, incoming requests using Transfer-Encoding: chunked in the header can allocate memory arbitrarily in the server, potentially leading to its exhaustion. This vulnerability is fixed in 0.23.0. NOTE: This vulnerability is rel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:46:01.872Z. Updated 2025-07-10T20:19:21.578Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:19 WIB

Official record

MedPublished 11 Jul 2025, 02:45 WIB

CVE-2025-53628

cpp-httplib does not limit the length of a line

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerability is fixed in 0.20.1. NOTE: This vulnerability is related to CVE-2025-53629.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:45:54.960Z. Updated 2025-07-10T20:26:28.864Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:26 WIB

Official record

HighPublished 11 Jul 2025, 02:39 WIB

CVE-2025-53634

Chall-Manager's HTTP Gateway have no header check timeout leading to potential slow loris attacks

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:39:57.816Z. Updated 2025-07-10T20:26:58.612Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:26 WIB

Official record

HighPublished 11 Jul 2025, 02:38 WIB

CVE-2025-53633

Chall-Manager's scenario decoding process does not check for zip bombs

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:38:19.564Z. Updated 2025-07-10T20:02:40.218Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:02 WIB

Official record

HighPublished 11 Jul 2025, 02:36 WIB

CVE-2025-53632

Chall-Manager's scenario decoding process does not check for zip slips

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file to write is not checked, potentially leading to zip slips. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:36:47.463Z. Updated 2025-07-10T20:31:48.462Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:31 WIB

Official record

HighPublished 11 Jul 2025, 02:32 WIB

CVE-2025-53630

Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.

Excerpt language: en.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:32:45.296Z. Updated 2025-07-10T20:31:07.240Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:31 WIB

Official record

MedPublished 11 Jul 2025, 02:32 WIB

CVE-2025-7412

code-projects Library System profile.php unrestricted upload

A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/student/profile.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:32:06.284Z. Updated 2025-07-10T20:30:11.750Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated11 Jul 2025, 03:30 WIB

Official record

CritPublished 11 Jul 2025, 02:16 WIB

CVE-2025-34100

BuilderEngine 3.5.0 RCE via Unauthenticated Arbitrary File Upload

An unrestricted file upload vulnerability exists in BuilderEngine 3.5.0 via the integration of the elFinder 2.0 file manager and its use of the jQuery File Upload plugin. The plugin fails to properly validate or restrict file types or locations during upload operations, allowing an attacker to upload a malicious .php f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:16:28.782Z. Updated 2026-04-07T14:09:29.072Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record

CritPublished 11 Jul 2025, 02:16 WIB

CVE-2025-34102

CryptoLog Unauthenticated RCE via SQL Injection and Command Injection

A remote code execution vulnerability exists in CryptoLog (PHP version, discontinued since 2009) due to a chained exploitation of SQL injection and command injection vulnerabilities. An unauthenticated attacker can gain shell access as the web server user by first exploiting a SQL injection flaw in login.php to bypass …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-10T19:16:01.206Z. Updated 2026-04-07T14:09:31.908Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:09 WIB

Official record