Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 3441–3460 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

MedPublished 04 Jun 2025, 02:31 WIB

CVE-2025-5523

enilu web-flash File Upload upload fileService.upload cross site scripting

A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T19:31:20.057Z. Updated 2025-06-03T20:15:24.579Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 03:15 WIB

Official record

MedPublished 04 Jun 2025, 02:27 WIB

CVE-2025-35036

hibernate-validator insecure default Expression Language interpolation

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as of 6.2.0 and 7.0.0 no l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3441 to 3460 of 3682.First page Next page

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T19:27:42.900Z. Updated 2025-06-05T18:41:26.981Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated06 Jun 2025, 01:41 WIB

Official record

MedPublished 04 Jun 2025, 02:00 WIB

CVE-2025-5522

jack0240 魏 bskms 蓝天幼儿园管理系统 User Creation addUser improper authorization

A vulnerability was found in jack0240 魏 bskms 蓝天幼儿园管理系统 up to dffe6640b5b54d8e29da6f060e0493fea74b3fad. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sa/addUser of the component User Creation Handler. The manipulation leads to improper authorization. The attack may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T19:00:22.162Z. Updated 2025-06-03T19:11:52.108Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 02:11 WIB

Official record

MedPublished 04 Jun 2025, 01:31 WIB

CVE-2025-5521

WuKongOpenSource WukongCRM updataPassword cross-site request forgery

A vulnerability was found in WuKongOpenSource WukongCRM 9.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/user/updataPassword. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T18:31:04.266Z. Updated 2025-06-03T20:10:22.509Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 03:10 WIB

Official record

HighPublished 04 Jun 2025, 01:27 WIB

CVE-2025-48998

Dataease MYSQL JDBC File Reading Vulnerability

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass of the patch for CVE-2025-27103 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.10. No known workarounds ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T18:27:43.310Z. Updated 2025-06-03T20:11:35.811Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 03:11 WIB

Official record

HighPublished 04 Jun 2025, 01:21 WIB

CVE-2025-48997

Multer vulnerable to Denial of Service via unhandled exception

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled except…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T18:21:59.527Z. Updated 2025-06-03T18:30:13.178Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 01:30 WIB

Official record

MedPublished 04 Jun 2025, 01:19 WIB

CVE-2025-48953

Umbraco Vulnerable to By-Pass of Configured Allowed Extensions for File Uploads

Umbraco is an ASP.NET content management system (CMS). Starting in version 14.0.0 and prior to versions 15.4.2 and 16.0.0, it's possible to upload a file that doesn't adhere with the configured allowable file extensions via a manipulated API request. The issue is patched in versions 15.4.2 and 16.0.0. No known workarou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T18:19:28.771Z. Updated 2025-06-03T18:31:44.345Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated04 Jun 2025, 01:31 WIB

Official record

MedPublished 04 Jun 2025, 01:16 WIB

CVE-2025-48950

MaxKB Python Sandbox Bypass in Function Library

MaxKB is an open-source AI assistant for enterprise. Prior to version 1.10.8-lts, Sandbox only restricts the execution permissions of binary files in common directories, such as `/bin,/usr/bin`, etc. Therefore, attackers can exploit some files with execution permissions in non blacklisted directories to carry out attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T18:16:09.060Z. Updated 2025-06-03T18:36:25.824Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 01:36 WIB

Official record

MedPublished 04 Jun 2025, 01:00 WIB

CVE-2025-5520

Open5GS AMF/MME emm_state_authentication assertion

A vulnerability was found in Open5GS up to 2.7.3. It has been classified as problematic. Affected is the function gmm_state_authentication/emm_state_authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack remotely. The exploit has been disclosed to the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T18:00:22.302Z. Updated 2025-06-03T18:21:12.742Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 01:21 WIB

Official record

MedPublished 04 Jun 2025, 01:00 WIB

CVE-2025-5516

TOTOLINK X2000R URL Filtering Page formFilter cross site scripting

A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108. This affects an unknown part of the file /boafrm/formFilter of the component URL Filtering Page. The manipulation of the argument URL Address leads to cross site scripting. It is possible to initiate the attack remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T18:00:18.786Z. Updated 2025-06-03T18:21:49.966Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 01:21 WIB

Official record

MedPublished 04 Jun 2025, 00:41 WIB

CVE-2025-30360

webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijackin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T17:41:59.457Z. Updated 2025-06-03T17:58:12.605Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:58 WIB

Official record

MedPublished 04 Jun 2025, 00:39 WIB

CVE-2025-30359

webpack-dev-server users' source code may be stolen when they access a malicious web site

webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when they access a malicious web site. Because the request for classic script by a script tag is not subject to same origin policy, an attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T17:39:16.531Z. Updated 2025-06-03T17:50:03.130Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:50 WIB

Official record

MedPublished 04 Jun 2025, 00:31 WIB

CVE-2025-5515

TOTOLINK X2000R formMapDel command injection

A vulnerability, which was classified as critical, has been found in TOTOLINK X2000R 1.0.0-B20230726.1108. Affected by this issue is some unknown functionality of the file /boafrm/formMapDel. The manipulation of the argument devicemac1 leads to command injection. The attack may be launched remotely. The exploit has bee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T17:31:08.920Z. Updated 2025-06-03T17:52:50.972Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:52 WIB

Official record

MedPublished 04 Jun 2025, 00:31 WIB

CVE-2025-5513

quequnlong shiyi-blog add cross site scripting

A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T17:31:04.892Z. Updated 2025-06-03T17:55:32.831Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:55 WIB

Official record

MedPublished 04 Jun 2025, 00:00 WIB

CVE-2025-5512

quequnlong shiyi-blog Administrator Backend verifyPassword improper authentication

A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T17:00:21.115Z. Updated 2025-06-03T17:30:55.107Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:30 WIB

Official record

MedPublished 04 Jun 2025, 00:00 WIB

CVE-2025-5511

quequnlong shiyi-blog photos improper authorization

A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file /dev api/app/album/photos/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T17:00:19.488Z. Updated 2025-06-03T17:33:48.688Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:33 WIB

Official record

HighPublished 03 Jun 2025, 23:42 WIB

CVE-2025-30167

Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%` directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to create configuration files affec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T16:42:16.357Z. Updated 2026-01-23T16:31:03.690Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated23 Jan 2026, 23:31 WIB

Official record

MedPublished 03 Jun 2025, 23:31 WIB

CVE-2025-5510

quequnlong shiyi-blog optimize server-side request forgery

A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T16:31:04.789Z. Updated 2025-06-03T17:35:16.577Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:35 WIB

Official record

MedPublished 03 Jun 2025, 23:00 WIB

CVE-2025-5509

quequnlong shiyi-blog upload path traversal

A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The manipulation of the argument file/source leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T16:00:21.872Z. Updated 2025-06-03T17:36:32.040Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:36 WIB

Official record

MedPublished 03 Jun 2025, 23:00 WIB

CVE-2025-5508

TOTOLINK A3002RU IP Port Filtering Page cross site scripting

A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic. Affected by this issue is some unknown functionality of the component IP Port Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-03T16:00:20.117Z. Updated 2025-06-03T17:38:04.291Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:38 WIB

Official record