Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 3581–3600 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

UnscoredPublished 03 Jul 2025, 15:35 WIB

CVE-2025-38105

ALSA: usb-audio: Kill timer properly at removal

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare case, the driver might be freed without the disconnect call. This leaves the timer in an active state while the assigned object is released …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:35:15.301Z. Updated 2026-10-15T01:06:33.295Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:06 WIB

Official record

UnscoredPublished 03 Jul 2025, 15:35 WIB

CVE-2025-38103

HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()

In the Linux kernel, the following vulnerability has been resolved: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() Update struct hid_descriptor to better reflect the mandatory and optional parts of the HID Descriptor as per USB HID 1.11 specification. Note: the kernel currently does not parse an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3581 to 3600 of 3774.First page Next page

Published 2025-07-03T08:35:13.941Z. Updated 2026-05-23T15:58:59.055Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:58 WIB

Official record

HighPublished 03 Jul 2025, 15:35 WIB

CVE-2025-38102

VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify

In the Linux kernel, the following vulnerability has been resolved: VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify During our test, it is found that a warning can be trigger in try_grab_folio as follow: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1678 at mm/gup.c:147 try_gr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:35:12.255Z. Updated 2026-10-15T21:52:08.219Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

HighPublished 03 Jul 2025, 15:35 WIB

CVE-2025-38101

ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set() Enlarge the critical section in ring_buffer_subbuf_order_set() to ensure that error handling takes place with per-buffer mutex held, thus preventing list corruption and other concurren…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:35:10.844Z. Updated 2026-08-05T11:59:32.011Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:59 WIB

Official record

UnscoredPublished 03 Jul 2025, 15:35 WIB

CVE-2025-38100

x86/iopl: Cure TIF_IO_BITMAP inconsistencies

In the Linux kernel, the following vulnerability has been resolved: x86/iopl: Cure TIF_IO_BITMAP inconsistencies io_bitmap_exit() is invoked from exit_thread() when a task exists or when a fork fails. In the latter case the exit_thread() cleans up resources which were allocated during fork(). io_bitmap_exit() invoke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:35:09.487Z. Updated 2026-10-15T01:06:32.052Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:06 WIB

Official record

UnscoredPublished 03 Jul 2025, 15:13 WIB

CVE-2025-38099

Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken A SCO connection without the proper voice_setting can cause the controller to lock up.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:13:59.288Z. Updated 2026-05-23T15:58:58.095Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:58 WIB

Official record

HighPublished 03 Jul 2025, 15:13 WIB

CVE-2025-38098

drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink Don't try to operate on a drm_wb_connector as an amdgpu_dm_connector. While dereferencing aconnector->base will "work" it's wrong and might lead to unknown bad t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:13:58.603Z. Updated 2026-08-05T11:59:30.949Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:59 WIB

Official record

HighPublished 03 Jul 2025, 15:13 WIB

CVE-2025-38097

espintcp: remove encap socket caching to avoid reference leak

In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain is: xfrm_state -> enacp_sk -> netns Since the encap socke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:13:57.694Z. Updated 2026-10-15T21:52:08.064Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 03 Jul 2025, 15:13 WIB

CVE-2025-38096

wifi: iwlwifi: don't warn when if there is a FW error

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: don't warn when if there is a FW error iwl_trans_reclaim is warning if it is called when the FW is not alive. But if it is called when there is a pending restart, i.e. after a FW error, there is no need to warn, instead - return silent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T08:13:57.007Z. Updated 2026-10-21T12:36:44.646Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:36 WIB

Official record

HighPublished 03 Jul 2025, 14:44 WIB

CVE-2025-38095

dma-buf: insert memory barrier before updating num_fences

In the Linux kernel, the following vulnerability has been resolved: dma-buf: insert memory barrier before updating num_fences smp_store_mb() inserts memory barrier after storing operation. It is different with what the comment is originally aiming so Null pointer dereference can be happened if memory update is reorde…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T07:44:18.214Z. Updated 2026-10-15T21:52:07.906Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 03 Jul 2025, 14:44 WIB

CVE-2025-38094

net: cadence: macb: Fix a possible deadlock in macb_halt_tx.

In the Linux kernel, the following vulnerability has been resolved: net: cadence: macb: Fix a possible deadlock in macb_halt_tx. There is a situation where after THALT is set high, TGO stays high as well. Because jiffies are never updated, as we are in a context with interrupts disabled, we never exit that loop and h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T07:44:17.442Z. Updated 2026-05-11T21:21:08.826Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:21 WIB

Official record

MedPublished 03 Jul 2025, 13:44 WIB

CVE-2024-9017

PeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description

The PeepSo Core: Groups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Group Description field in all versions up to, and including, 6.4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T06:44:25.405Z. Updated 2026-04-08T16:45:22.315Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

MedPublished 03 Jul 2025, 11:25 WIB

CVE-2025-5944

Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T04:25:01.278Z. Updated 2025-07-03T13:17:43.130Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated03 Jul 2025, 20:17 WIB

Official record

UnscoredPublished 03 Jul 2025, 07:00 WIB

CVE-2025-43713

CVE-2025-43713

ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license key management and deprecated Windows network authentication. The services are implemented with .NET remoting and can be exploited via well-known deserialization t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T00:00:00.000Z. Updated 2025-07-03T14:08:08.871Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jul 2025, 21:08 WIB

Official record

UnscoredPublished 03 Jul 2025, 07:00 WIB

CVE-2025-45809

CVE-2025-45809

SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key/unblock" API endpoints.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T00:00:00.000Z. Updated 2026-03-12T16:50:20.685Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Mar 2026, 23:50 WIB

Official record

UnscoredPublished 03 Jul 2025, 07:00 WIB

CVE-2025-45938

CVE-2025-45938

Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T00:00:00.000Z. Updated 2025-07-03T14:44:33.889Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jul 2025, 21:44 WIB

Official record

MedPublished 03 Jul 2025, 07:00 WIB

CVE-2025-49618

CVE-2025-49618

In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T00:00:00.000Z. Updated 2025-07-03T13:17:49.348Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated03 Jul 2025, 20:17 WIB

Official record

UnscoredPublished 03 Jul 2025, 07:00 WIB

CVE-2025-50258

CVE-2025-50258

Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via the time parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T00:00:00.000Z. Updated 2025-07-03T13:40:09.239Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jul 2025, 20:40 WIB

Official record

UnscoredPublished 03 Jul 2025, 07:00 WIB

CVE-2025-50260

CVE-2025-50260

Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetFirewallCfg function via the firewallEn parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T00:00:00.000Z. Updated 2025-07-03T14:38:39.813Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jul 2025, 21:38 WIB

Official record

UnscoredPublished 03 Jul 2025, 07:00 WIB

CVE-2025-50262

CVE-2025-50262

Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetQosBand function via the list parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-03T00:00:00.000Z. Updated 2025-07-03T14:41:12.681Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jul 2025, 21:41 WIB

Official record