Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 3401–3420 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

HighPublished 04 Aug 2025, 21:00 WIB

CVE-2025-36604

CVE-2025-36604

Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T14:00:05.295Z. Updated 2026-02-26T17:50:01.164Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

UnscoredPublished 04 Aug 2025, 20:14 WIB

CVE-2025-8109

GPU DDK - GPU shader shared memory corrupted using ptrace to disrupt GPU operation

Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T13:14:20.850Z. Updated 2025-09-08T19:43:47.586Z.

Showing 3401 to 3420 of 3629.First page Next page

CVSS

—

KEVNot listed

EPSSPresent

Updated09 Sep 2025, 02:43 WIB

Official record

LowPublished 04 Aug 2025, 17:32 WIB

CVE-2025-8515

Intelbras InControl JSON Endpoint operador information disclosure

A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoint. Executing manipulation can lead to information disclosure. It is possible to launch the attack remotely. A high complexity level is associated with this atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T10:32:05.124Z. Updated 2025-10-29T06:53:04.612Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2025, 13:53 WIB

Official record

UnscoredPublished 04 Aug 2025, 17:00 WIB

CVE-2025-0932

Mali GPU Userspace Driver allows access to already freed memory

Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-privileged user process to perform valid GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory.This is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T10:00:57.639Z. Updated 2026-02-26T17:50:02.507Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

CritKEVPublished 04 Aug 2025, 16:14 WIB

CVE-2025-6205

Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-08-04T09:14:42.308Z. Updated 2026-02-26T17:50:03.025Z.

CVSS9.1v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighKEVPublished 04 Aug 2025, 16:14 WIB

CVE-2025-6204

Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025

An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-08-04T09:14:08.343Z. Updated 2026-02-26T17:50:03.655Z.

CVSS8v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 04 Aug 2025, 15:34 WIB

CVE-2025-8341

SSRF in Infinity Datasource Plugin

Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a speciall…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T08:34:50.669Z. Updated 2025-08-04T16:13:49.206Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated04 Aug 2025, 23:13 WIB

Official record

HighPublished 04 Aug 2025, 15:04 WIB

CVE-2025-41691

CODESYS Control DoS via Unauthenticated NULL Pointer Dereference

An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T08:04:34.981Z. Updated 2025-08-04T16:32:30.773Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated04 Aug 2025, 23:32 WIB

Official record

HighPublished 04 Aug 2025, 15:04 WIB

CVE-2025-41659

CODESYS Control PKI Exposure Enables Remote Certificate Access

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T08:04:04.597Z. Updated 2025-08-04T16:35:32.484Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated04 Aug 2025, 23:35 WIB

Official record

MedPublished 04 Aug 2025, 15:03 WIB

CVE-2025-41658

CODESYS Toolkit Exposes Sensitive Files via Default Permissions

CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T08:03:26.511Z. Updated 2025-08-04T11:52:37.949Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated04 Aug 2025, 18:52 WIB

Official record

UnscoredPublished 04 Aug 2025, 13:20 WIB

CVE-2025-20702

CVE-2025-20702

In the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T06:20:40.458Z. Updated 2026-02-26T17:50:04.037Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

UnscoredPublished 04 Aug 2025, 13:20 WIB

CVE-2025-20701

CVE-2025-20701

In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T06:20:32.057Z. Updated 2026-09-08T15:08:19.238Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Sep 2026, 22:08 WIB

Official record

UnscoredPublished 04 Aug 2025, 13:19 WIB

CVE-2025-20700

CVE-2025-20700

In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T06:19:06.133Z. Updated 2026-02-26T17:50:06.021Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 04 Aug 2025, 12:17 WIB

CVE-2025-48499

CVE-2025-48499

Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon) packet may cause a denial-of-service (DoS) condition on an affected MFP. Resetting the MFP is required to recover from the denial-of-service (DoS) condition.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T05:17:01.537Z. Updated 2025-08-07T16:05:44.214Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 23:05 WIB

Official record

UnscoredPublished 04 Aug 2025, 08:49 WIB

CVE-2025-20698

CVE-2025-20698

In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915400; Issue ID: MSV-3793.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T01:49:50.189Z. Updated 2026-02-26T17:50:06.437Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

UnscoredPublished 04 Aug 2025, 08:49 WIB

CVE-2025-20697

CVE-2025-20697

In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915681; Issue ID: MSV-3795.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T01:49:48.567Z. Updated 2026-02-26T17:50:06.885Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

UnscoredPublished 04 Aug 2025, 08:49 WIB

CVE-2025-20696

CVE-2025-20696

In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T01:49:46.880Z. Updated 2025-08-04T13:47:57.557Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Aug 2025, 20:47 WIB

Official record

UnscoredPublished 04 Aug 2025, 07:00 WIB

CVE-2024-45183

CVE-2024-45183

An issue was discovered in Samsung Mobile Processor Exynos 2100, 1280, 2200, 1330, 1380, 1480, and 2400. A lack of a JPEG length check leads to an out-of-bound write.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-08-04T19:41:10.422Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Aug 2025, 02:41 WIB

Official record

UnscoredPublished 04 Aug 2025, 07:00 WIB

CVE-2025-26065

CVE-2025-26065

A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a visiting Wi-Fi network.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2025-11-03T19:45:20.059Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:45 WIB

Official record

UnscoredPublished 04 Aug 2025, 07:00 WIB

CVE-2025-44643

CVE-2025-44643

Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password property in the ripd.conf configuration file sets a hardcoded weak password, posing a security risk. An attacker with network access could exploit this to gain una…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-04T00:00:00.000Z. Updated 2026-07-05T01:06:40.286Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:06 WIB

Official record