Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 381–400 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

CritPublished 29 Jul 2025, 03:08 WIB

CVE-2025-54426

Polkadot Frontier contains silent failure in Curve25519 arithmetic precompiles with malformed points

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519ScalarMul precompiles incorrectly handle invalid Ristretto point representations. Instead of returning an error, they silently treat invalid input bytes as the Ri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T20:08:22.886Z. Updated 2025-07-28T20:26:18.866Z.

CVSS9.9v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:26 WIB

Official record

MedPublished 29 Jul 2025, 02:53 WIB

CVE-2025-54423

copyparty has a DOM-Based XSS vulnerability when displaying multimedia metadata

copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 381 to 400 of 3774.First page Next page

Published 2025-07-28T19:53:24.109Z. Updated 2025-07-28T20:20:15.875Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:20 WIB

Official record

CritPublished 29 Jul 2025, 02:47 WIB

CVE-2025-54419

Node-SAML Contains SAML Signature Verification Vulnerability

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML asser…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T19:47:46.584Z. Updated 2025-07-28T20:39:07.897Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:39 WIB

Official record

HighPublished 29 Jul 2025, 01:42 WIB

CVE-2025-8194

Tarfile infinite loop during parsing with negative member offset

There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T18:42:44.847Z. Updated 2026-07-31T14:01:18.178Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated31 Jul 2026, 21:01 WIB

Official record

LowPublished 29 Jul 2025, 01:16 WIB

CVE-2025-8283

Netavark: podman: netavark may resolve hostnames to unexpected hosts

A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T18:16:07.853Z. Updated 2026-09-01T12:08:32.766Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 19:08 WIB

Official record

MedPublished 29 Jul 2025, 00:46 WIB

CVE-2025-43023

HP Linux Imaging and Printing Software - Use of DSA Key

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the use of a weak code signing key, Digital Signature Algorithm (DSA).

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T17:46:46.398Z. Updated 2025-11-04T21:10:27.277Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:10 WIB

Official record

CritPublished 29 Jul 2025, 00:30 WIB

CVE-2025-54299

Extension - nobossextensions.com - Stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla

A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T17:30:00.460Z. Updated 2025-08-05T04:44:35.757Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 11:44 WIB

Official record

CritPublished 29 Jul 2025, 00:29 WIB

CVE-2025-54298

Extension - firecoders.com - Stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla

A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T17:29:32.441Z. Updated 2025-07-31T16:18:02.912Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 23:18 WIB

Official record

MedPublished 28 Jul 2025, 23:34 WIB

CVE-2025-7676

DLL hijacking of all PE32 executables on Windows 11 for ARM CPUs

DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt to load Base DLLs that would ordinarily not be loaded from the applica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:34:28.584Z. Updated 2025-07-28T17:18:40.248Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:18 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54538

CVE-2025-54538

In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:47.459Z. Updated 2025-07-28T17:23:48.567Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:23 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54537

CVE-2025-54537

In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:46.792Z. Updated 2025-07-28T17:28:27.931Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:28 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54536

CVE-2025-54536

In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:46.257Z. Updated 2025-07-28T17:28:51.312Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:28 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54535

CVE-2025-54535

In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:45.628Z. Updated 2025-07-28T17:29:53.025Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:29 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54534

CVE-2025-54534

In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:44.842Z. Updated 2025-07-28T17:31:26.157Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:31 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54533

CVE-2025-54533

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:44.053Z. Updated 2025-07-28T17:31:53.566Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:31 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54532

CVE-2025-54532

In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:43.516Z. Updated 2025-07-28T17:27:43.634Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:27 WIB

Official record

HighPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54531

CVE-2025-54531

In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:42.843Z. Updated 2026-02-26T17:50:14.140Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54530

CVE-2025-54530

In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:42.098Z. Updated 2026-02-26T17:50:14.327Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

LowPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54529

CVE-2025-54529

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:40.171Z. Updated 2025-07-28T17:43:24.941Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:43 WIB

Official record

MedPublished 28 Jul 2025, 23:20 WIB

CVE-2025-54528

CVE-2025-54528

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T16:20:39.378Z. Updated 2025-07-28T17:41:56.186Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:41 WIB

Official record