Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 3621–3640 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

UnscoredPublished 02 Jun 2025, 13:00 WIB

CVE-2025-1485

Real Cookie Banner < 5.1.6 - Admin+ Stored XSS

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T06:00:01.621Z. Updated 2025-06-02T15:46:10.440Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jun 2025, 22:46 WIB

Official record

MedPublished 02 Jun 2025, 12:31 WIB

CVE-2025-5431

AssamLook CMS department-profile.php sql injection

A vulnerability, which was classified as critical, was found in AssamLook CMS 1.0. Affected is an unknown function of the file /department-profile.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3621 to 3640 of 3682.First page Next page

Published 2025-06-02T05:31:04.392Z. Updated 2025-06-02T13:08:06.024Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 20:08 WIB

Official record

MedPublished 02 Jun 2025, 12:00 WIB

CVE-2025-5430

AssamLook CMS product.php sql injection

A vulnerability, which was classified as critical, has been found in AssamLook CMS 1.0. This issue affects some unknown processing of the file /product.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T05:00:18.238Z. Updated 2025-06-02T13:08:34.679Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 20:08 WIB

Official record

MedPublished 02 Jun 2025, 11:31 WIB

CVE-2025-5429

juzaweb CMS Plugins Page install access control

A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of the component Plugins Page. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T04:31:04.885Z. Updated 2025-06-02T13:40:50.044Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 20:40 WIB

Official record

UnscoredPublished 02 Jun 2025, 11:19 WIB

CVE-2025-25179

GPU DDK - Freelist GPU VA can be remapped to another reservation/PMR to trigger GPU arbitrary write to physical memory

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T04:19:18.316Z. Updated 2025-06-02T14:13:18.466Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jun 2025, 21:13 WIB

Official record

MedPublished 02 Jun 2025, 11:00 WIB

CVE-2025-5428

juzaweb CMS Error Logs Page log-viewer access control

A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the component Error Logs Page. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T04:00:18.636Z. Updated 2025-06-02T13:09:06.877Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 20:09 WIB

Official record

MedPublished 02 Jun 2025, 10:31 WIB

CVE-2025-5427

juzaweb CMS Permalinks Page permalinks access control

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin-cp/permalinks of the component Permalinks Page. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been discl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T03:31:04.377Z. Updated 2025-06-02T03:45:40.356Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:45 WIB

Official record

HighPublished 02 Jun 2025, 10:24 WIB

CVE-2024-11857

Realtek Bluetooth HCI Adaptor - Privilege Escalation

Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as a specific file, causing the product to delete arbitrary files pointed to by the link. Subsequently, attackers can leverage arbitrary file deletion to privilege…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T03:24:16.905Z. Updated 2025-06-02T03:46:40.908Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:46 WIB

Official record

MedPublished 02 Jun 2025, 10:00 WIB

CVE-2025-5426

juzaweb CMS Menu Page menus access control

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin-cp/menus of the component Menu Page. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T03:00:14.266Z. Updated 2025-06-02T03:10:33.505Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:10 WIB

Official record

MedPublished 02 Jun 2025, 09:31 WIB

CVE-2025-5425

juzaweb CMS Theme Editor Page default access control

A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor Page. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:31:04.441Z. Updated 2025-06-02T03:11:20.488Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:11 WIB

Official record

UnscoredPublished 02 Jun 2025, 09:29 WIB

CVE-2025-20678

CVE-2025-20678

In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01394606…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:29:47.843Z. Updated 2026-02-17T14:31:25.129Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Feb 2026, 21:31 WIB

Official record

UnscoredPublished 02 Jun 2025, 09:29 WIB

CVE-2025-20677

CVE-2025-20677

In Bluetooth driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412256; Issue ID: MSV-3284.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:29:46.322Z. Updated 2025-06-03T17:38:33.780Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:38 WIB

Official record

UnscoredPublished 02 Jun 2025, 09:29 WIB

CVE-2025-20676

CVE-2025-20676

In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412240; Issue ID: MSV-3293.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:29:44.789Z. Updated 2025-06-03T17:40:16.458Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Jun 2025, 00:40 WIB

Official record

UnscoredPublished 02 Jun 2025, 09:29 WIB

CVE-2025-20675

CVE-2025-20675

In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413201; Issue ID: MSV-3302.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:29:43.181Z. Updated 2025-06-02T15:46:23.715Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jun 2025, 22:46 WIB

Official record

UnscoredPublished 02 Jun 2025, 09:29 WIB

CVE-2025-20674

CVE-2025-20674

In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413202; Issue ID: MSV-3303.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:29:41.639Z. Updated 2026-02-26T18:27:45.983Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:27 WIB

Official record

UnscoredPublished 02 Jun 2025, 09:29 WIB

CVE-2025-20673

CVE-2025-20673

In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00413200; Issue ID: MSV-3304.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:29:40.056Z. Updated 2025-06-02T15:46:35.123Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jun 2025, 22:46 WIB

Official record

UnscoredPublished 02 Jun 2025, 09:29 WIB

CVE-2025-20672

CVE-2025-20672

In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412257; Issue ID: MSV-3292.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:29:38.368Z. Updated 2026-02-26T18:27:46.417Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:27 WIB

Official record

MedPublished 02 Jun 2025, 09:00 WIB

CVE-2025-5424

juzaweb CMS Media Page media access control

A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the component Media Page. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T02:00:16.127Z. Updated 2025-06-02T03:26:48.633Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:26 WIB

Official record

MedPublished 02 Jun 2025, 08:31 WIB

CVE-2025-5423

juzaweb CMS General Setting Page general access control

A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/system/general of the component General Setting Page. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T01:31:04.401Z. Updated 2025-06-02T03:28:05.055Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:28 WIB

Official record

MedPublished 02 Jun 2025, 08:00 WIB

CVE-2025-5422

juzaweb CMS Email Logs Page email access control

A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of the component Email Logs Page. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-02T01:00:24.461Z. Updated 2025-06-02T03:28:50.384Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Jun 2025, 10:28 WIB

Official record