Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 361–380 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-28172

CVE-2025-28172

Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2026-07-05T01:03:52.768Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:03 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-44136

CVE-2025-44136

MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-07-29T17:34:31.951Z.

Showing 361 to 380 of 3774.First page Next page

CVSS—

KEVNot listed

EPSSPresent

Updated30 Jul 2025, 00:34 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-44137

CVE-2025-44137

MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2026-01-20T20:30:09.461Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Jan 2026, 03:30 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-45346

CVE-2025-45346

SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-07-29T20:04:18.827Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Jul 2025, 03:04 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-46059

CVE-2025-46059

langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability allows attackers to execute arbitrary code and compromise the application via a crafted email message. NOTE: this is disputed by the Supplier because the code-execution issue was i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-08-03T23:20:43.149Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Aug 2025, 06:20 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-50738

CVE-2025-50738

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-08-22T15:36:04.032Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Aug 2025, 22:36 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-51044

CVE-2025-51044

phpgurukul Nipah virus (NiV) Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to insufficient validation of user input for the " govtissuedid" parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-07-29T19:39:08.186Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Jul 2025, 02:39 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-51045

CVE-2025-51045

Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerability is attributed to the insufficient validation of user input for the username parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-07-29T19:36:07.639Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Jul 2025, 02:36 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-51970

CVE-2025-51970

A SQL Injection vulnerability exists in the action.php endpoint of PuneethReddyHC Online Shopping System Advanced 1.0 due to improper sanitization of user-supplied input in the keyword POST parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-08-28T13:45:03.363Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2025, 20:45 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-52284

CVE-2025-52284

Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184C0 function via the tz parameter. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-09-15T14:48:12.641Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Sep 2025, 21:48 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-52358

CVE-2025-52358

A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's browser session.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-07-29T13:55:44.521Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jul 2025, 20:55 WIB

Official record

UnscoredPublished 29 Jul 2025, 07:00 WIB

CVE-2025-52490

CVE-2025-52490

An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-29T00:00:00.000Z. Updated 2025-07-29T20:27:03.220Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Jul 2025, 03:27 WIB

Official record

UnscoredPublished 29 Jul 2025, 06:34 WIB

CVE-2025-54769

KL-001-2025-016: Xorux LPAR2RRD File Upload Directory Traversal

An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This can be used to overwrite existing PERL modules within the application to achieve remote code execution (RCE) by an attacker.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T23:34:38.972Z. Updated 2025-11-03T20:06:37.868Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:06 WIB

Official record

UnscoredPublished 29 Jul 2025, 06:31 WIB

CVE-2025-54768

KL-001-2025-015: Xorux LPAR2RRD Read Only User Log Download Exposing Sensitive Information

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to download logs from the appliance configuration, exposing sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T23:31:09.836Z. Updated 2025-11-03T20:06:36.441Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:06 WIB

Official record

UnscoredPublished 29 Jul 2025, 06:28 WIB

CVE-2025-54767

KL-001-2025-014: Xorux LPAR2RRD Read Only User Denial of Service

An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T23:28:27.996Z. Updated 2025-11-03T20:06:35.060Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:06 WIB

Official record

UnscoredPublished 29 Jul 2025, 06:25 WIB

CVE-2025-54765

KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include granting themselves admi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T23:25:12.409Z. Updated 2025-11-03T20:06:32.315Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:06 WIB

Official record

UnscoredPublished 29 Jul 2025, 06:16 WIB

CVE-2025-54766

KL-001-2025-012: Xorux XorMon-NG Read Only User Export Device Configuration Exposing Sensitive Information

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to export the appliance configuration, exposing sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T23:16:13.316Z. Updated 2025-11-03T20:06:33.686Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:06 WIB

Official record

MedPublished 29 Jul 2025, 03:34 WIB

CVE-2025-54429

Polkadot Frontier's constructing smart contract can bypass precompile address bounding

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for safety. For precompiles to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T20:34:56.710Z. Updated 2025-07-28T20:46:59.149Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:46 WIB

Official record

CritPublished 29 Jul 2025, 03:28 WIB

CVE-2025-54428

RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)

RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a valid MongoDB Atlas URI with embedded username and password was accidentally committed to the public repository. This could allow unauthorized access to producti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T20:28:02.575Z. Updated 2025-07-28T20:36:02.377Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:36 WIB

Official record

MedPublished 29 Jul 2025, 03:20 WIB

CVE-2025-54427

Polkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas price

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inherent extrinsic, meaning only the block producer can call it. To ensure correctness, the ProvideInherent trait should be implemented for each inherent, which includes the check_inher…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T20:20:04.064Z. Updated 2025-07-28T20:38:02.249Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:38 WIB

Official record