Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 3861–3880 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

HighPublished 04 Sep 2025, 16:22 WIB

CVE-2025-6085

Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload

The Make Connector plugin for WordPress is vulnerable to arbitrary file uploads due to misconfigured file type validation in the 'upload_media' function in all versions up to, and including, 1.5.10. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T09:22:24.861Z. Updated 2026-04-08T17:20:50.394Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 04 Sep 2025, 16:22 WIB

CVE-2025-9616

PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update

The PopAd plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the PopAd_reset_cookie_time function. This makes it possible for unauthenticated attackers to reset cookie time settings via a forged request gr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3861 to 3880 of 4319.First page Next page

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T09:22:24.265Z. Updated 2026-04-08T17:04:20.500Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

HighPublished 04 Sep 2025, 15:34 WIB

CVE-2025-2411

OTP Bypass in Akinsoft's TaskPano

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano allows Authentication Bypass. This issue affects TaskPano: from s1.06.04 before v1.06.06.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T08:34:34.583Z. Updated 2026-06-06T06:08:41.135Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:08 WIB

Official record

MedPublished 04 Sep 2025, 15:31 WIB

CVE-2024-13073

XSS in Akinsoft's TaskPano

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft TaskPano allows Cross-Site Scripting (XSS). This issue affects TaskPano: s1.06.04.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T08:31:36.871Z. Updated 2026-06-01T12:27:56.262Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:27 WIB

Official record

HighPublished 04 Sep 2025, 15:07 WIB

CVE-2025-6984

Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T08:07:41.996Z. Updated 2025-09-04T20:07:31.531Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated05 Sep 2025, 03:07 WIB

Official record

HighPublished 04 Sep 2025, 14:44 WIB

CVE-2025-2417

OTP Bypass in Akinsoft's e-Mutabakat

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft e-Mutabakat allows Authentication Bypass. This issue affects e-Mutabakat: from 2.02.06 before v2.02.06.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T07:44:08.515Z. Updated 2026-06-06T05:55:27.167Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 12:55 WIB

Official record

MedPublished 04 Sep 2025, 14:40 WIB

CVE-2024-13071

XSS in Akinsoft's e-Mutabakat

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft e-Mutabakat allows Cross-Site Scripting (XSS). This issue affects e-Mutabakat: from 2.02.05 before v2.02.06.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T07:40:22.506Z. Updated 2026-08-04T15:56:42.317Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 22:56 WIB

Official record

MedPublished 04 Sep 2025, 13:15 WIB

CVE-2025-9467

Possibility to bypass file upload validation on the server-side

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 - 7.7.47 Vaadin 8.0.0 …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T06:15:47.336Z. Updated 2026-09-14T13:12:33.699Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Sep 2026, 20:12 WIB

Official record

UnscoredPublished 04 Sep 2025, 12:17 WIB

CVE-2025-36887

CVE-2025-36887

In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T05:17:19.856Z. Updated 2026-02-26T17:49:38.884Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 12:10 WIB

CVE-2024-56190

CVE-2024-56190

In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T05:10:34.652Z. Updated 2026-02-26T17:49:39.203Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 12:10 WIB

CVE-2024-56189

CVE-2024-56189

In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure post authentication with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T05:10:07.134Z. Updated 2025-09-08T17:25:07.571Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Sep 2025, 00:25 WIB

Official record

UnscoredPublished 04 Sep 2025, 12:00 WIB

CVE-2025-36909

CVE-2025-36909

Information disclosure

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T05:00:27.322Z. Updated 2025-09-04T20:06:36.266Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Sep 2025, 03:06 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:59 WIB

CVE-2025-36908

CVE-2025-36908

In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:59:49.039Z. Updated 2026-02-26T17:49:39.369Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:59 WIB

CVE-2025-36907

CVE-2025-36907

In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege via USB fastboot, after a bootloader unlock, with no additional execution privileges needed. User interaction is needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:59:31.475Z. Updated 2026-02-26T17:49:39.947Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:59 WIB

CVE-2025-36906

CVE-2025-36906

In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:59:15.554Z. Updated 2026-02-26T17:49:40.297Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:58 WIB

CVE-2025-36905

CVE-2025-36905

In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:58:58.463Z. Updated 2026-02-26T17:49:40.629Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:58 WIB

CVE-2025-36904

CVE-2025-36904

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:58:29.302Z. Updated 2026-02-26T17:49:40.954Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:58 WIB

CVE-2025-36903

CVE-2025-36903

In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:58:03.609Z. Updated 2026-02-26T17:49:41.114Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:57 WIB

CVE-2025-36902

CVE-2025-36902

In syna_cdev_ioctl_store_pid() of syna_tcm2_sysfs.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:57:39.376Z. Updated 2026-02-26T17:49:41.448Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

UnscoredPublished 04 Sep 2025, 11:56 WIB

CVE-2025-36901

CVE-2025-36901

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-04T04:56:59.054Z. Updated 2026-02-26T17:49:41.796Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record