Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 3261–3280 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

CritPublished 06 Aug 2025, 03:06 WIB

CVE-2012-10027

WordPress Plugin WP-Property <= 1.35.0 PHP File Upload

WP-Property plugin for WordPress up to and including version 1.35.0 contains an unauthenticated file upload vulnerability in the third-party `uploadify.php` script. A remote attacker can upload arbitrary PHP files to a temporary directory without authentication, leading to remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:06:43.138Z. Updated 2026-05-26T11:51:29.834Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 18:51 WIB

Official record

CritPublished 06 Aug 2025, 03:06 WIB

CVE-2012-10026

WordPress Plugin Asset-Manager <= 2.0 PHP File Upload

The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php. The endpoint fails to properly validate and restrict uploaded file types, allowing remote attackers to upload malicious PHP scripts to a predictable temporary directory. Once uploaded,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3261 to 3280 of 3629.First page Next page

Published 2025-08-05T20:06:23.563Z. Updated 2026-07-15T01:23:13.826Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

CritPublished 06 Aug 2025, 03:06 WIB

CVE-2012-10025

WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion

The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php. When the PHP configuration directive allow_url_include is enabled (default: Off), an unauthenticated attacker can exploit the acf_abspath POST parameter to include a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:06:00.838Z. Updated 2026-05-15T11:13:52.958Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:13 WIB

Official record

CritPublished 06 Aug 2025, 03:05 WIB

CVE-2012-10035

Turbo FTP Server 1.30.823/826 PORT Command Buffer Overflow

Turbo FTP Server versions 1.30.823 and 1.30.826 contain a buffer overflow vulnerability in the handling of the PORT command. By sending a specially crafted payload, an unauthenticated remote attacker can overwrite memory structures and execute arbitrary code with SYSTEM privileges.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:05:31.584Z. Updated 2026-04-07T14:02:31.896Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

HighPublished 06 Aug 2025, 03:05 WIB

CVE-2013-10065

Sysax Multi-Server <= 6.10 SSHD Key Exchange DoS

A denial-of-service vulnerability exists in Sysax Multi-Server version 6.10 via its SSH daemon. A specially crafted SSH key exchange packet can trigger a crash in the service, resulting in loss of availability. The flaw is triggered during the handling of malformed key exchange data, including a non-standard byte (\x28…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:05:06.769Z. Updated 2025-11-21T00:20:54.941Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Nov 2025, 07:20 WIB

Official record

CritPublished 06 Aug 2025, 03:04 WIB

CVE-2013-10070

PHP-Charts v1.0 PHP Code Execution

PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution under the web server's …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:04:44.526Z. Updated 2026-04-07T14:03:21.064Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

HighPublished 06 Aug 2025, 03:04 WIB

CVE-2012-10028

Netwin SurgeFTP <= v23c8 Authenticated RCE

Netwin SurgeFTP version 23c8 and prior contains a vulnerability in its web-based administrative console that allows authenticated users to execute arbitrary system commands via crafted POST requests to `surgeftpmgr.cgi`. This can lead to full remote code execution on the underlying system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:04:20.181Z. Updated 2026-05-15T11:13:55.331Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:13 WIB

Official record

CritPublished 06 Aug 2025, 03:03 WIB

CVE-2012-10033

Narcissus backend.php Image Configuration Command Injection

Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow. Specifically, the backend.php script fails to sanitize the release parameter before passing it to the configure_image() function. This function invokes PHP’s passthru() with the unsanitized input, allowing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:03:59.143Z. Updated 2026-07-28T01:46:25.317Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 06 Aug 2025, 03:03 WIB

CVE-2012-10029

Nagios XI Network Monitor Graph Explorer Component < 1.3 Authenticated Command Injection

Nagios XI Network Monitor prior to Graph Explorer component version 1.3 contains a command injection vulnerability in `visApi.php`. An authenticated user can inject system commands via unsanitized parameters such as `host`, resulting in remote code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:03:35.395Z. Updated 2026-05-15T11:13:56.158Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:13 WIB

Official record

HighPublished 06 Aug 2025, 03:03 WIB

CVE-2012-10032

Maxthon3 about:history XCS Trusted Zone Code Execution

Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly handles injected script content, allowing attackers to execute arbitrary JavaScript in a privileged context. This flaw enables modification of browser configurati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:03:14.736Z. Updated 2026-07-28T01:46:24.622Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

CritPublished 06 Aug 2025, 03:02 WIB

CVE-2013-10066

Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload

An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3. The application exposes an upload endpoint (users_add.php) that allows attackers to upload files to the /userpictures/ directory without authentication. This flaw enables remote code execution by uploading a PHP payload and invokin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:02:54.434Z. Updated 2026-04-07T14:03:18.089Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

CritPublished 06 Aug 2025, 03:02 WIB

CVE-2013-10067

Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCE

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:02:33.203Z. Updated 2026-04-07T14:03:18.821Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

MedPublished 06 Aug 2025, 03:02 WIB

CVE-2012-10023

FreeFloat FTP Server USER Command Buffer Overflow

A stack-based buffer overflow vulnerability exists in FreeFloat FTP Server version 1.0.0. The server fails to properly validate input passed to the USER command, allowing remote attackers to overwrite memory and potentially execute arbitrary code. The flaw is triggered by sending an overly long username string, which o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:02:08.874Z. Updated 2026-04-07T14:02:23.101Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 06 Aug 2025, 03:01 WIB

CVE-2012-10030

FreeFloat FTP Server Arbitrary File Upload

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories. The server accepts empty credentials, defaults user access to the root of the C:\ drive, and imposes no restrictions on file type or destination path. These…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:01:46.446Z. Updated 2026-04-07T14:02:27.807Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 06 Aug 2025, 03:01 WIB

CVE-2013-10068

Foxit Reader <= 5.4.5.0114 Plugin URL Processing Buffer Overflow

Foxit Reader versions through 5.4.5.0114, including the bundled Foxit Reader Plugin 2.2.1.530, contains a stack-based buffer overflow vulnerability in the npFoxitReaderPlugin.dll module. When a PDF file is loaded from a remote host, an overly long query string in the URL can overflow a buffer, allowing remote attackers…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:01:26.073Z. Updated 2026-05-25T23:40:53.462Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:40 WIB

Official record

CritPublished 06 Aug 2025, 03:01 WIB

CVE-2013-10069

D-Link Devices Unauthenticated RCE

The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in command.php, which improperly handles the cmd POST parameter. A remote attacker can exploit this flaw without authentication to spawn a Telnet ser…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:01:04.000Z. Updated 2026-05-15T11:14:20.275Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

HighPublished 06 Aug 2025, 03:00 WIB

CVE-2012-10034

ClanSphere 2011.3 Local File Inclusion via cs_lang Cookie

ClanSphere 2011.3 is vulnerable to a local file inclusion (LFI) flaw due to improper handling of the cs_lang cookie parameter. The application fails to sanitize user-supplied input, allowing attackers to traverse directories and read arbitrary files outside the web root. The vulnerability is further exacerbated by null…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:00:40.834Z. Updated 2026-04-07T14:02:31.142Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

HighPublished 06 Aug 2025, 03:00 WIB

CVE-2012-10031

BlazeVideo HDTV Player Pro 6.6.0.3 Filename Handling Buffer Overflow

BlazeVideo HDTV Player Pro v6.6.0.3 is vulnerable to a stack-based buffer overflow due to improper handling of user-supplied input embedded in .plf playlist files. When parsing a crafted .plf file, the MediaPlayerCtrl.dll component invokes PathFindFileNameA() to extract a filename from a URL-like string. The returned v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T20:00:15.915Z. Updated 2026-04-07T14:02:28.500Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 06 Aug 2025, 02:58 WIB

CVE-2013-10064

ActFax 5.01 RAW Server Buffer Overflow

A stack-based buffer overflow vulnerability exists in ActFax Server version 5.01. The server's RAW protocol interface fails to safely process user-supplied data in @F506 fax header fields due to insecure usage of strcpy. Remote attackers can exploit this vulnerability by sending specially crafted @F506 fields, potentia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T19:58:41.458Z. Updated 2026-05-14T02:06:21.672Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:06 WIB

Official record

CritPublished 06 Aug 2025, 02:58 WIB

CVE-2014-125113

Dell/Quest KACE K1000 Unauthenticated File Upload RCE

An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547 in the download_agent.php endpoint. An attacker can upload arbitrary PHP files to a temporary web-accessible directory, which are late…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T19:58:17.347Z. Updated 2026-05-14T02:06:24.124Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:06 WIB

Official record