Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 381–400 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

MedPublished 27 Jun 2025, 07:00 WIB

CVE-2025-6738

huija bicycleSharingServer UserServiceImpl.java userDao.selectUserByUserNameLike sql injection

A vulnerability, which was classified as critical, has been found in huija bicycleSharingServer up to 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. Affected by this issue is the function userDao.selectUserByUserNameLike of the file UserServiceImpl.java. The manipulation of the argument Username leads to sql injection. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:17.281Z. Updated 2025-06-27T13:47:31.583Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 20:47 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-44163

CVE-2025-44163

RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell executi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 381 to 400 of 3682.First page Next page

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T20:01:03.722Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jun 2025, 03:01 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-44557

CVE-2025-44557

A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing process and authentication via a crafted pairing_failed packet.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-07-02T14:22:39.151Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jul 2025, 21:22 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-44559

CVE-2025-44559

An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a Denial of Service (DoS) via sending a specific sequence of crafted control packets.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2026-07-05T16:06:02.061Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:06 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-45729

CVE-2025-45729

D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2026-07-01T17:03:57.281Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Jul 2026, 00:03 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-45737

CVE-2025-45737

An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending crafted IOCTL commands to the NeacSafe64.sys component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T19:51:37.950Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jun 2025, 02:51 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-45851

CVE-2025-45851

An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST request to the endpoint /ISAPI/Security/challenge. The vendor has stated that upgrading to V5.7.23_SP2 fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-30T16:25:49.829Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Jun 2025, 23:25 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-46415

CVE-2025-46415

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Excerpt language: en.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T19:57:56.693Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated28 Jun 2025, 02:57 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-46416

CVE-2025-46416

The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T15:49:08.285Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 22:49 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47818

CVE-2025-47818

Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:22:58.439Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:22 WIB

Official record

MedPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47819

CVE-2025-47819

Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:24:24.424Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:24 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47820

CVE-2025-47820

Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:26:12.446Z.

CVSS2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:26 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47821

CVE-2025-47821

Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:27:32.117Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:27 WIB

Official record

MedPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47822

CVE-2025-47822

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:12:06.946Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:12 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47823

CVE-2025-47823

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:13:25.835Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:13 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47824

CVE-2025-47824

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:10:30.962Z.

CVSS2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:10 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-50367

CVE-2025-50367

A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php. The name field fails to properly sanitize user input, allowing an attacker to inject malicious JavaScript.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T20:03:39.702Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jun 2025, 03:03 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-50369

CVE-2025-50369

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authorized admin to delete medical card records by sending a simple GET request without verifying the origin of the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T20:04:31.127Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jun 2025, 03:04 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-50370

CVE-2025-50370

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authenticated admin to delete inquiry records via a simple GET request, without requiring a CSRF token or valid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T20:05:20.588Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jun 2025, 03:05 WIB

Official record

UnscoredPublished 27 Jun 2025, 07:00 WIB

CVE-2025-50528

CVE-2025-50528

A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T19:59:17.319Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jun 2025, 02:59 WIB

Official record