Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 3921–3940 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 04 Sep 2025, 03:24 WIB

CVE-2025-8268

Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion

The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files functions in all versions up to, and including, 2.9.5. This makes it possible for unauthenticated attackers to list and delete files uploaded by other users.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T20:24:15.668Z. Updated 2026-04-08T17:19:09.687Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:19 WIB

Official record

CritPublished 04 Sep 2025, 03:19 WIB

CVE-2025-55748

XWiki Platform's configuration files can be accessed through jsx and sx endpoints

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3921 to 3940 of 4319.First page Next page

Published 2025-09-03T20:19:45.501Z. Updated 2025-09-03T20:47:51.121Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:47 WIB

Official record

CritPublished 04 Sep 2025, 03:12 WIB

CVE-2025-55747

XWiki Platform's configuration files can be accessed through the webjars API

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T20:12:12.978Z. Updated 2025-09-03T20:48:27.579Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:48 WIB

Official record

CritKEVPublished 04 Sep 2025, 03:04 WIB

CVE-2025-53690

Sitecore Products ViewState Deserialization Vulnerability

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-09-03T20:04:48.223Z. Updated 2026-02-26T17:49:44.363Z.

CVSS9v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

MedPublished 04 Sep 2025, 03:02 WIB

CVE-2025-9926

projectworlds Travel Management System viewsubcategory.php sql injection

A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulation of the argument t1 causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T20:02:06.607Z. Updated 2025-09-03T20:13:38.964Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:13 WIB

Official record

MedPublished 04 Sep 2025, 02:51 WIB

CVE-2025-55162

Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In versions below 1.32.10 and 1.33.0 through 1.33.6, 1.34.0 through 1.34.4 and 1.35.0, insufficient Session Expiration in the Envoy OAuth2 filter leads to failed logout operations. When configured with __Sec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T19:51:51.024Z. Updated 2025-09-04T14:29:49.494Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 21:29 WIB

Official record

HighPublished 04 Sep 2025, 02:34 WIB

CVE-2025-9365

Fuji Electric FRENIC-Loader 4 Deserialization of Untrusted Data

Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T19:34:41.579Z. Updated 2025-09-03T20:38:21.773Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:38 WIB

Official record

MedPublished 04 Sep 2025, 02:32 WIB

CVE-2025-9925

projectworlds Travel Management System detail.php sql injection

A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation of the argument pid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T19:32:06.882Z. Updated 2025-09-03T20:13:03.083Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:13 WIB

Official record

HighPublished 04 Sep 2025, 02:00 WIB

CVE-2025-36193

IBM Transformation Advisor incorrect permissions

IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Transformation Advisor Operator Catalog image.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T19:00:39.089Z. Updated 2025-09-03T20:08:27.956Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:08 WIB

Official record

MedPublished 04 Sep 2025, 01:32 WIB

CVE-2025-9924

projectworlds Travel Management System enquiry.php sql injection

A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulation of the argument t2 leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T18:32:08.762Z. Updated 2025-09-03T18:50:29.407Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 01:50 WIB

Official record

MedPublished 04 Sep 2025, 01:32 WIB

CVE-2025-9923

Campcodes Sales and Inventory System index.php cross site scripting

A flaw has been found in Campcodes Sales and Inventory System 1.0. This affects an unknown part of the file /index.php. Executing manipulation of the argument page can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T18:32:06.595Z. Updated 2025-09-03T19:51:50.539Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 02:51 WIB

Official record

MedPublished 04 Sep 2025, 00:42 WIB

CVE-2025-20328

CVE-2025-20328

A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no cust…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:42:26.479Z. Updated 2025-09-03T17:58:00.862Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 00:58 WIB

Official record

MedPublished 04 Sep 2025, 00:41 WIB

CVE-2025-20291

CVE-2025-20291

A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to an untrusted website. Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed. This vulnerability existed because of insuff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:41:54.255Z. Updated 2025-09-03T17:56:09.978Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 00:56 WIB

Official record

MedPublished 04 Sep 2025, 00:41 WIB

CVE-2025-20335

Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Arbitrary File Write Vulnerability

A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is due to a lack of proper authentication controls. An attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:41:06.201Z. Updated 2025-09-03T17:56:55.586Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 00:56 WIB

Official record

MedPublished 04 Sep 2025, 00:41 WIB

CVE-2025-20336

Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Disclosure Vulnerability

A vulnerability in the directory permissions of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 could allow an unauthenticated, remote attacker to access sensitive information on an affected device. This vulnerability exists because the product exposes sensitive informat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:41:01.463Z. Updated 2025-09-03T17:57:31.207Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 00:57 WIB

Official record

MedPublished 04 Sep 2025, 00:40 WIB

CVE-2025-20330

Cisco Unified Communications Manager IM and Presence Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:40:43.960Z. Updated 2026-02-26T17:49:45.079Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

MedPublished 04 Sep 2025, 00:40 WIB

CVE-2025-20280

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. This vulnerability exists…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:40:21.391Z. Updated 2025-09-03T17:58:33.904Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 00:58 WIB

Official record

MedPublished 04 Sep 2025, 00:40 WIB

CVE-2025-20326

Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. This vulnerab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:40:11.110Z. Updated 2025-09-03T18:00:30.339Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 01:00 WIB

Official record

MedPublished 04 Sep 2025, 00:40 WIB

CVE-2025-20287

Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management interface. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:40:06.650Z. Updated 2025-09-05T17:07:19.404Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated06 Sep 2025, 00:07 WIB

Official record

MedPublished 04 Sep 2025, 00:39 WIB

CVE-2025-20270

Cisco Evolved Programmable Network Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to obtain sensitive information from an affected system. This vulnerability is due to improper validation of requests to API endpoint…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T17:39:46.331Z. Updated 2025-09-05T17:05:56.337Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated06 Sep 2025, 00:05 WIB

Official record