Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 3321–3340 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38193

net_sched: sch_sfq: reject invalid perturb period

In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_period has no range check yet, and this can be used to trigger a race condition fixed in a separate patch. We want to make sure ctl->perturb_period * HZ will not…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:17.285Z. Updated 2026-10-15T21:52:10.998Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38192

net: clear the dst when changing skb protocol

In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can crash the kernel if it indiscriminately flips ingress packets from v4 to v6: BUG: kernel NULL pointer dereference, address: 0000000000000000 ip6_rcv_core (net…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3321 to 3340 of 3774.First page Next page

Published 2025-07-04T13:37:16.642Z. Updated 2026-10-15T21:52:10.856Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38191

ksmbd: fix null pointer dereference in destroy_previous_session

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroy_previous_session If client set ->PreviousSessionId on kerberos session setup stage, NULL pointer dereference error will happen. Since sess->user is not set yet, It can pass the user argument as NULL to d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:15.736Z. Updated 2026-08-05T12:00:16.004Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:00 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38190

atm: Revert atm_account_tx() if copy_from_iter_full() fails.

In the Linux kernel, the following vulnerability has been resolved: atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account skb->truesize to sk->sk_wmem_alloc by atm_account_tx(). It is expected to be reverted by atm_pop_raw() later called by vcc->dev->ops->send(vcc, skb). However,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:15.054Z. Updated 2026-05-11T21:22:59.279Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:22 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38189

drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()`

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` The following kernel Oops was recently reported by Mesa CI: [ 800.139824] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000588 [ 800.148619] Mem ab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:14.428Z. Updated 2026-08-05T12:00:14.943Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:00 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38188

drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE Calling this packet is necessary when we switch contexts because there are various pieces of state used by userspace to synchronize between BR and BV that are persistent across submits and we need to make sur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:13.761Z. Updated 2026-05-11T21:22:56.988Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:22 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38187

drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released after being passed to r535_gsp_rpc_send(). When sending the initial fragment of a large RPC and passing the caller's RPC container, the container will be freed pr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:13.126Z. Updated 2026-10-21T12:36:49.089Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:36 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38186

bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start()

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() Before the commit under the Fixes tag below, bnxt_ulp_stop() and bnxt_ulp_start() were always invoked in pairs. After that commit, the new bnxt_ulp_restart() can be invoked after bnx…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:12.484Z. Updated 2026-05-11T21:22:54.658Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:22 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38185

atm: atmtcp: Free invalid length skb in atmtcp_c_send().

In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcp_c_send(). syzbot reported the splat below. [0] vcc_sendmsg() copies data passed from userspace to skb and passes it to vcc->dev->ops->send(). atmtcp_c_send() accesses skb->data as struct atmtcp_hdr aft…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:11.885Z. Updated 2026-05-11T21:22:53.484Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:22 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38184

tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer

In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun tipc: Started in network mode tipc: Node identity 8af31…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:11.226Z. Updated 2026-10-15T21:52:10.702Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38183

net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get()

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Before calling lan743x_ptp_io_event_clock_get(), the 'channel' value is checked against the maximum value of PCI11X1X_PTP_IO_MAX_CHANNELS(8). This seems correct and a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:10.253Z. Updated 2026-05-11T21:22:51.198Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:22 WIB

Official record

UnscoredPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38182

ublk: santizize the arguments from userspace when adding a device

In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values for queue depth and number of queues we get from userspace when adding a device.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:09.637Z. Updated 2026-05-11T21:22:50.068Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:22 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38181

calipso: Fix null-ptr-deref in calipso_req_{set,del}attr().

In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr-deref in sock_omalloc() while allocating a CALIPSO option. [0] The NULL is of struct sock, which was fetched by sk_to_full_sk() in calipso_req_setattr(). Sin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:08.985Z. Updated 2026-10-15T21:52:10.570Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38180

net: atm: fix /proc/net/atm/lec handling

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and UAF.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:08.258Z. Updated 2026-08-05T12:00:10.648Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:00 WIB

Official record

HighPublished 04 Jul 2025, 20:37 WIB

CVE-2025-38179

smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() This fixes the following problem: [ 749.901015] [ T8673] run fstests cifs/001 at 2025-06-17 09:40:30 [ 750.346409] [ T9870] =====================================================…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:37:07.383Z. Updated 2026-08-05T12:00:09.584Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:00 WIB

Official record

HighPublished 04 Jul 2025, 20:13 WIB

CVE-2025-46733

REE userspace code can panic TAs, leading to fTPM PCR reset and data disclosure

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. In version 4.5.0, using a specially crafted tee-supplicant binary running in REE userspace, an attacker can trigger a panic in a TA that uses the libutee Secu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T13:13:53.815Z. Updated 2025-07-07T16:22:41.136Z.

CVSS7.9v3.1KEVNot listedEPSSPresentUpdated07 Jul 2025, 23:22 WIB

Official record

HighPublished 04 Jul 2025, 19:47 WIB

CVE-2025-38177

sch_hfsc: make hfsc_qlen_notify() idempotent

In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either and not friendly to its callers, like fq_codel_dequeue(). Let's make it idempotent to ease qdisc_tree_reduce_backlog() callers' life: 1. update_vf() decreases c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T12:47:09.127Z. Updated 2026-08-05T12:00:08.513Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:00 WIB

Official record

MedPublished 04 Jul 2025, 19:32 WIB

CVE-2025-7061

Intelbras InControl operador csv injection

A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/operador/. The manipulation leads to csv injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T12:32:04.865Z. Updated 2025-07-07T16:23:17.934Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated07 Jul 2025, 23:23 WIB

Official record

MedPublished 04 Jul 2025, 19:02 WIB

CVE-2025-7066

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau

Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting. This was done by storing the MIME type of a file and allowing only browser preview for MIME types beginning with image (except for image/svg+xml, see CVE-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T12:02:34.287Z. Updated 2025-09-16T11:01:26.893Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated16 Sep 2025, 18:01 WIB

Official record

MedPublished 04 Jul 2025, 18:21 WIB

CVE-2025-6056

CVE-2025-6056

Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate usernames.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-04T11:21:42.979Z. Updated 2025-07-07T16:23:53.982Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated07 Jul 2025, 23:23 WIB

Official record