Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 3261–3280 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 06 Jul 2025, 06:32 WIB

CVE-2025-7075

BlackVue Dashcam 590X HTTP Endpoint upload.cgi unrestricted upload

A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /upload.cgi of the component HTTP Endpoint. The manipulation leads to unrestricted upload. The attack needs to be done within the local network. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-05T23:32:05.317Z. Updated 2025-07-07T16:06:08.987Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Jul 2025, 23:06 WIB

Official record

MedPublished 05 Jul 2025, 16:02 WIB

CVE-2025-7074

vercel hyper rimraf-standalone.js ignoreMap redos

A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3261 to 3280 of 3774.First page Next page

Published 2025-07-05T09:02:05.339Z. Updated 2025-07-07T16:06:53.818Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Jul 2025, 23:06 WIB

Official record

MedPublished 05 Jul 2025, 07:00 WIB

CVE-2023-50786

CVE-2023-50786

Dradis through 4.16.0 allows referencing external images (resources) over HTTPS, instead of forcing the use of embedded (uploaded) images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-05T00:00:00.000Z. Updated 2025-07-07T18:35:07.867Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated08 Jul 2025, 01:35 WIB

Official record

HighPublished 05 Jul 2025, 07:00 WIB

CVE-2025-47227

CVE-2025-47227

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-05T00:00:00.000Z. Updated 2025-07-07T18:35:57.991Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Jul 2025, 01:35 WIB

Official record

MedPublished 05 Jul 2025, 07:00 WIB

CVE-2025-47228

CVE-2025-47228

In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows authenticated attackers to execute system commands via crafted HTTP requests.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-05T00:00:00.000Z. Updated 2025-07-07T18:34:55.971Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated08 Jul 2025, 01:34 WIB

Official record

HighPublished 05 Jul 2025, 07:00 WIB

CVE-2025-53603

CVE-2025-53603

In Alinto SOPE SOGo 2.0.2 through 5.12.2, sope-core/NGExtensions/NGHashMap.m allows a NULL pointer dereference and SOGo crash via a request in which a parameter in the query string is a duplicate of a parameter in the POST body.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-05T00:00:00.000Z. Updated 2026-01-26T16:05:42.743Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Jan 2026, 23:05 WIB

Official record

MedPublished 05 Jul 2025, 07:00 WIB

CVE-2025-53604

CVE-2025-53604

The web-push crate before 0.10.3 for Rust allows a denial of service (memory consumption) in the built-in clients via a large integer in a Content-Length header.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-05T00:00:00.000Z. Updated 2025-07-08T14:35:55.692Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated08 Jul 2025, 21:35 WIB

Official record

MedPublished 05 Jul 2025, 07:00 WIB

CVE-2025-53605

CVE-2025-53605

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-05T00:00:00.000Z. Updated 2025-07-08T14:35:48.796Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated08 Jul 2025, 21:35 WIB

Official record

CritPublished 05 Jul 2025, 05:12 WIB

CVE-2025-48952

NetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHP

NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T22:12:54.601Z. Updated 2025-07-08T13:51:33.982Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated08 Jul 2025, 20:51 WIB

Official record

HighPublished 05 Jul 2025, 05:05 WIB

CVE-2025-53366

MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T22:05:02.975Z. Updated 2025-07-08T13:52:28.447Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Jul 2025, 20:52 WIB

Official record

HighPublished 05 Jul 2025, 05:03 WIB

CVE-2025-53365

MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T22:03:46.893Z. Updated 2025-07-08T13:53:36.518Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated08 Jul 2025, 20:53 WIB

Official record

MedPublished 05 Jul 2025, 04:32 WIB

CVE-2025-7070

IROAD Dashcam Q9 MFA Pairing Request allocation of resources

A vulnerability has been found in IROAD Dashcam Q9 up to 20250624 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component MFA Pairing Request Handler. The manipulation leads to allocation of resources. The attack needs to be done within the local network. The vendor wa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T21:32:07.349Z. Updated 2025-07-08T13:55:13.799Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Jul 2025, 20:55 WIB

Official record

MedPublished 05 Jul 2025, 04:02 WIB

CVE-2025-7069

HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflow

A vulnerability, which was classified as problematic, was found in HDF5 1.14.6. Affected is the function H5FS__sect_link_size of the file src/H5FSsection.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T21:02:06.876Z. Updated 2025-07-08T13:38:56.989Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated08 Jul 2025, 20:38 WIB

Official record

MedPublished 05 Jul 2025, 03:32 WIB

CVE-2025-7068

HDF5 H5FL.c H5FL__malloc memory leak

A vulnerability, which was classified as problematic, has been found in HDF5 1.14.6. This issue affects the function H5FL__malloc of the file src/H5FL.c. The manipulation leads to memory leak. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T20:32:06.420Z. Updated 2025-07-08T13:56:18.646Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated08 Jul 2025, 20:56 WIB

Official record

MedPublished 05 Jul 2025, 01:02 WIB

CVE-2025-7067

HDF5 H5FScache.c H5FS__sinfo_serialize_node_cb heap-based overflow

A vulnerability classified as problematic was found in HDF5 1.14.6. This vulnerability affects the function H5FS__sinfo_serialize_node_cb of the file src/H5FScache.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T18:02:05.802Z. Updated 2025-07-08T13:57:09.724Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated08 Jul 2025, 20:57 WIB

Official record

UnscoredPublished 05 Jul 2025, 00:39 WIB

CVE-2025-53485

SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes

SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation text. While partially broken in newer MediaWiki versions, the check is still missing. This issue affects Mediawiki - SecurePoll extension: from 1.39.X befor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T17:39:36.272Z. Updated 2025-07-08T17:38:04.023Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jul 2025, 00:38 WIB

Official record

UnscoredPublished 05 Jul 2025, 00:34 WIB

CVE-2025-53484

SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input

User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T17:34:24.470Z. Updated 2025-07-08T17:38:09.511Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jul 2025, 00:38 WIB

Official record

UnscoredPublished 05 Jul 2025, 00:28 WIB

CVE-2025-53483

SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery

ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T17:28:40.374Z. Updated 2025-07-08T17:38:14.909Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jul 2025, 00:38 WIB

Official record

UnscoredPublished 04 Jul 2025, 23:01 WIB

CVE-2025-53482

IPInfo: Message key XSS through several IPInfo messages in infobox and popup

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T16:01:46.252Z. Updated 2025-07-08T17:38:20.332Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jul 2025, 00:38 WIB

Official record

UnscoredPublished 04 Jul 2025, 22:47 WIB

CVE-2025-53481

Denial of service vector on ipinfo/v0/norevision

Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T15:47:46.299Z. Updated 2025-07-08T17:38:27.242Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Jul 2025, 00:38 WIB

Official record