Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 381–400 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 25 Nov 2025, 03:31 WIB

CVE-2024-14007

TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions prior to 1.3.4 contain an authentication bypass in the NVMS-9000 control protocol. By sending a single crafted TCP payload to an exposed NVMS-9000 control port, an unauthenticated remote attacker can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T20:31:02.227Z. Updated 2025-11-25T13:07:25.360Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Nov 2025, 20:07 WIB

Official record

CritPublished 25 Nov 2025, 03:30 WIB

CVE-2018-25126

TVT NVMS-9000 Hard-coded API Credentials & Command Injection

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS command injection flaw in its configuration services. The web/API interface accepts HTTP/XML requests authenticated with a fixed vendor credential string and passes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 381 to 400 of 3020.First page Next page

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T20:30:45.278Z. Updated 2025-11-25T13:06:45.928Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Nov 2025, 20:06 WIB

Official record

MedPublished 25 Nov 2025, 03:29 WIB

CVE-2025-36150

IBM Concert Information Disclosure

IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T20:29:19.183Z. Updated 2025-11-24T20:58:29.449Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 03:58 WIB

Official record

HighPublished 25 Nov 2025, 02:45 WIB

CVE-2025-0005

CVE-2025-0005

Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in crash or denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T19:45:12.857Z. Updated 2025-11-24T20:33:49.469Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 03:33 WIB

Official record

HighPublished 25 Nov 2025, 02:42 WIB

CVE-2025-52539

CVE-2025-52539

A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced extensible interface (AXI), potentially resulting in loss of confidentiality, integrity, and/or availability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T19:42:46.919Z. Updated 2025-11-24T20:31:53.040Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 03:31 WIB

Official record

MedPublished 25 Nov 2025, 01:29 WIB

CVE-2025-13466

body-parser vulnerable to denial of service when url encoding is used

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slow…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T18:29:36.725Z. Updated 2025-11-24T18:57:00.939Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated25 Nov 2025, 01:57 WIB

Official record

MedPublished 25 Nov 2025, 01:25 WIB

CVE-2025-36112

IBM Sterling B2B Integrator and IBM Sterling File Gateway information disclosure

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP configuration information to an unauthorized user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T18:25:03.423Z. Updated 2025-11-24T18:58:40.859Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 01:58 WIB

Official record

HighPublished 25 Nov 2025, 01:08 WIB

CVE-2025-13609

Keylime: keylime: registrar allows identity takeover via duplicate uuid registration

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T18:08:56.048Z. Updated 2026-06-29T20:29:58.428Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 03:29 WIB

Official record

HighPublished 24 Nov 2025, 22:59 WIB

CVE-2025-40213

Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T15:59:44.000Z. Updated 2026-10-21T12:37:53.837Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 24 Nov 2025, 22:31 WIB

CVE-2025-10555

Stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T15:31:54.111Z. Updated 2025-11-24T16:02:51.305Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated24 Nov 2025, 23:02 WIB

Official record

HighPublished 24 Nov 2025, 22:31 WIB

CVE-2025-10554

Stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x

A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T15:31:39.739Z. Updated 2025-11-24T17:59:51.057Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 00:59 WIB

Official record

HighPublished 24 Nov 2025, 22:11 WIB

CVE-2025-44018

CVE-2025-44018

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T15:11:02.641Z. Updated 2025-11-24T17:03:28.621Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated25 Nov 2025, 00:03 WIB

Official record

UnscoredPublished 24 Nov 2025, 21:42 WIB

CVE-2025-12978

CVE-2025-12978

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact key-length matching. This allows crafted inputs where a tag prefix is incorrectly treated as a full match. A remote attacker with authenticated or exposed access to these input en…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T14:42:06.305Z. Updated 2026-01-07T15:36:44.975Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Jan 2026, 22:36 WIB

Official record

UnscoredPublished 24 Nov 2025, 21:41 WIB

CVE-2025-12969

CVE-2025-12969

Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain configuration conditions. This allows remote attackers with network access to the Fluent Bit instance exposing the forward input to send unauthenticated data. By bypassing authentication controls, atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T14:41:05.630Z. Updated 2026-01-07T15:36:49.065Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Jan 2026, 22:36 WIB

Official record

UnscoredPublished 24 Nov 2025, 21:40 WIB

CVE-2025-12972

CVE-2025-12972

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option is omitted, the plugin uses untrusted tag input to construct file paths. This allows attackers with network access to craft tags containing path traversal sequences that cause Fluent Bit to write files…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T14:40:36.275Z. Updated 2026-01-07T15:36:38.556Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Jan 2026, 22:36 WIB

Official record

UnscoredPublished 24 Nov 2025, 21:40 WIB

CVE-2025-12977

CVE-2025-12977

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters such as newlines or ../ that are treated as valid tags. Because tags inf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T14:40:12.642Z. Updated 2026-01-07T15:36:34.434Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Jan 2026, 22:36 WIB

Official record

UnscoredPublished 24 Nov 2025, 21:39 WIB

CVE-2025-12970

CVE-2025-12970

The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer without validating length. An attacker who can create containers or control container names, can supply a long name that overflows the buffer, leading to process crash or arbitrary code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T14:39:52.569Z. Updated 2026-01-07T15:36:41.505Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Jan 2026, 22:36 WIB

Official record

HighPublished 24 Nov 2025, 21:22 WIB

CVE-2025-11921

iStat Menus 7.10.4 - Local Privilege Escalation

iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via command injection.This issue affects iStats: 7.10.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T14:22:12.801Z. Updated 2025-12-19T15:54:37.784Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated19 Dec 2025, 22:54 WIB

Official record

UnscoredPublished 24 Nov 2025, 20:47 WIB

CVE-2025-65998

Apache Syncope: Default AES key used for internal password encryption

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal da…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T13:47:03.979Z. Updated 2025-11-24T15:36:14.583Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Nov 2025, 22:36 WIB

Official record

CritPublished 24 Nov 2025, 20:04 WIB

CVE-2025-40212

nfsd: fix refcount leak in nfsd_set_fh_dentry()

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nfsd exports a "pseudo root filesystem" which is used by NFSv4 to find the various exported filesystems using LOOKUP requests from a known root filehandle. NFSv3 uses the MOUNT protocol to find those e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-24T13:04:20.888Z. Updated 2026-08-05T12:08:37.417Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:08 WIB

Official record