Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 341–360 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

CritPublished 25 Nov 2025, 09:26 WIB

CVE-2025-6389

Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback

The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. This is due to the function accepting user input and then passing that through call_user_func(). This makes it possible for unauthenticated a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T02:26:49.836Z. Updated 2026-04-08T17:17:17.744Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record

HighPublished 25 Nov 2025, 09:03 WIB

CVE-2025-59373

CVE-2025-59373

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more information, plea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 341 to 360 of 3020.First page Next page

Published 2025-11-25T02:03:36.980Z. Updated 2025-11-25T14:36:36.749Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated25 Nov 2025, 21:36 WIB

Official record

HighPublished 25 Nov 2025, 07:30 WIB

CVE-2025-65951

Inside Track / Entropy Derby Timelock Encryption Bypassed via Pre-Computed VDF Output Leakage

Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption system fails to enforce sequential delay against the betting operator. Bettors pre-compute the entire Wesolowski VDF and include vdfOutputHex in their encrypted bet ticket, allowing t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:30:14.735Z. Updated 2025-11-25T14:34:57.964Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 21:34 WIB

Official record

MedPublished 25 Nov 2025, 07:23 WIB

CVE-2025-65944

Sentry-Javascript deals with leaked sensitive headers when `sendDefaultPii` is set to `true`

Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP headers, including the Cookie header, to Sentry. Those headers would be stored within …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:23:53.215Z. Updated 2025-11-25T14:33:37.980Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Nov 2025, 21:33 WIB

Official record

HighPublished 25 Nov 2025, 07:01 WIB

CVE-2025-64761

OpenBao Privileged Operator Identity Group Root Escalation

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could use the identity group subsystem to add a root policy to a group identity group, escalating their or another user's permissions in the system. Specifically this is an issue when: an operator in the ro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:01:17.986Z. Updated 2026-02-26T16:07:37.676Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated26 Feb 2026, 23:07 WIB

Official record

CritPublished 25 Nov 2025, 07:00 WIB

CVE-2025-9803

Improper Authentication in lunary-ai/lunary

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth integration. The application fails to verify the 'aud' (audience) field in the access token issued by Google, which is crucial for ensuring the token is intended for the application. This oversight al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:35.380Z. Updated 2025-11-25T18:35:17.845Z.

CVSS9.3v3.0KEVNot listedEPSSPresentUpdated26 Nov 2025, 01:35 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-51741

CVE-2025-51741

An issue was discovered in Veal98 Echo Open-Source Community System 2.2 thru 2.3 allowing an unauthenticated attacker to cause the server to send email verification messages to arbitrary users via the /sendEmailCodeForResetPwd endpoint potentially causing a denial of service to the server or the downstream users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2026-07-05T01:18:24.275Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:18 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-51742

CVE-2025-51742

An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-26T14:38:22.937Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 21:38 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-51743

CVE-2025-51743

An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-26T14:39:42.762Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 21:39 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-51744

CVE-2025-51744

An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-26T14:40:42.351Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 21:40 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-51745

CVE-2025-51745

An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-26T14:42:33.988Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 21:42 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-51746

CVE-2025-51746

An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-26T14:59:05.472Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 21:59 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-60739

CVE-2025-60739

Cross Site Request Forgery (CSRF) vulnerability in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before, Logic Version v6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /bh_web_backend component

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-25T16:37:25.214Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Nov 2025, 23:37 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-61167

CVE-2025-61167

SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parameters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2026-07-05T16:11:13.374Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:11 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-61168

CVE-2025-61168

An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2026-07-05T16:11:17.493Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:11 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-63729

CVE-2025-63729

An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-25T16:54:16.174Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Nov 2025, 23:54 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-63735

CVE-2025-63735

A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the the captive-portal endpoint selfguestpass/guestAccessSubmit.jsp.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-26T14:49:35.101Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 21:49 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-64049

CVE-2025-64049

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-25T15:57:41.553Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Nov 2025, 22:57 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-64050

CVE-2025-64050

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-25T15:51:09.606Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Nov 2025, 22:51 WIB

Official record

UnscoredPublished 25 Nov 2025, 07:00 WIB

CVE-2025-64061

CVE-2025-64061

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user, regardless of their privilege level (including standard or low-privileged users), can make a GET request to this endpoint and retrieve a complete, unfiltered l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-25T00:00:00.000Z. Updated 2025-11-25T19:16:45.700Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Nov 2025, 02:16 WIB

Official record