Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 3321–3340 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

MedPublished 05 Aug 2025, 10:32 WIB

CVE-2025-8543

Portabilis i-Educar educar_raca_cad.php cross site scripting

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php. The manipulation of the argument nm_raca leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T03:32:05.099Z. Updated 2025-08-07T06:34:40.688Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 13:34 WIB

Official record

MedPublished 05 Aug 2025, 10:02 WIB

CVE-2025-8542

Portabilis i-Educar empresas_cad.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empresas_cad.php. The manipulation of the argument fantasia/razao_social leads to cross site scripting. The attack may be initiated remotely. The exploit has been dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3321 to 3340 of 3629.First page Next page

Published 2025-08-05T03:02:04.978Z. Updated 2025-08-07T06:34:32.115Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 13:34 WIB

Official record

MedPublished 05 Aug 2025, 09:32 WIB

CVE-2025-8541

Portabilis i-Educar public_uf_cad.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/public_uf_cad.php. The manipulation of the argument nome leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T02:32:05.288Z. Updated 2025-08-07T06:34:22.075Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 13:34 WIB

Official record

CritPublished 05 Aug 2025, 09:28 WIB

CVE-2025-53417

File Parsing Deserialization of Untrusted Data in DTM Soft

DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T02:28:22.839Z. Updated 2025-08-05T13:37:21.204Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 20:37 WIB

Official record

MedPublished 05 Aug 2025, 09:02 WIB

CVE-2025-8540

Portabilis i-Educar public_municipio_cad.php cross site scripting

A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municipio_cad.php. The manipulation of the argument nome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T02:02:05.837Z. Updated 2025-08-07T06:34:15.335Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated07 Aug 2025, 13:34 WIB

Official record

MedPublished 05 Aug 2025, 08:32 WIB

CVE-2025-8539

Portabilis i-Educar public_distrito_cad.php cross site scripting

A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation of the argument nome causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T01:32:05.492Z. Updated 2026-09-15T02:10:31.740Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated15 Sep 2026, 09:10 WIB

Official record

MedPublished 05 Aug 2025, 08:04 WIB

CVE-2025-8538

Portabilis i-Educar novo cross site scripting

A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation of the argument name/description results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T01:04:26.271Z. Updated 2026-09-15T02:10:17.864Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated15 Sep 2026, 09:10 WIB

Official record

MedPublished 05 Aug 2025, 07:32 WIB

CVE-2025-8537

Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resources

A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of the file Mp4Decrypt.cpp of the component mp4decrypt. The manipulation leads to allocation of resources. It is possible to launch the attack remotely. The complexit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:32:06.097Z. Updated 2025-08-05T13:46:44.809Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 20:46 WIB

Official record

MedPublished 05 Aug 2025, 07:17 WIB

CVE-2025-52892

EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache

EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim rou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:17:16.047Z. Updated 2025-08-05T13:48:45.234Z.

CVSS4.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 20:48 WIB

Official record

HighPublished 05 Aug 2025, 07:14 WIB

CVE-2025-53544

Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0.97.0, a brute-force protection bypass in the initial sync seed retrieval endpoint allows unauthenticated attackers to guess the login password without triggerin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:14:33.857Z. Updated 2025-08-05T13:55:55.320Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 20:55 WIB

Official record

CritPublished 05 Aug 2025, 07:12 WIB

CVE-2025-54119

ADOdb's sqlite3 driver allows SQL injection

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database and calls the metaColumn…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:12:52.505Z. Updated 2025-11-03T17:45:02.291Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 00:45 WIB

Official record

HighPublished 05 Aug 2025, 07:12 WIB

CVE-2025-54130

Cursor Agent is vulnerable prompt injection via Editor Special Files

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive editor files, such as the .vscode/settings.json file don't already…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:12:28.632Z. Updated 2025-08-05T13:57:58.596Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 20:57 WIB

Official record

HighPublished 05 Aug 2025, 07:11 WIB

CVE-2025-54135

Cursor Agent is vulnerable to prompt injection via MCP Special Files

Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it requires approval but creating a new one doesn't. Hence, if sensitive MCP files, such as the .cursor/mcp.json file don't already exist in th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:11:07.363Z. Updated 2025-08-05T13:58:39.517Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 20:58 WIB

Official record

MedPublished 05 Aug 2025, 07:10 WIB

CVE-2025-54387

IPX is Vulnerable to Path Traversal via Prefix Matching Bypass

IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed directories do not end with a path separator. This occurs because…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:10:26.442Z. Updated 2025-08-05T14:11:59.162Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:11 WIB

Official record

HighPublished 05 Aug 2025, 07:08 WIB

CVE-2025-54780

glpi-screenshot-plugin exposes local files in /ajax/screenshot.php

The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /ajax/screenshot.php endpoint to leak files from the system or use PHP wrappers. This is fixed in version 2.0.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:08:37.728Z. Updated 2025-08-05T14:14:53.642Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:14 WIB

Official record

HighPublished 05 Aug 2025, 07:08 WIB

CVE-2025-54794

Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access

Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it possible to bypass directory restrictions and access files outside the CWD. Successful exploitation depends on the presence of (or ability to create) a directory …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:08:13.864Z. Updated 2025-08-05T14:17:31.870Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:17 WIB

Official record

HighPublished 05 Aug 2025, 07:07 WIB

CVE-2025-54795

Claude Code echo command allowed bypass of user approval prompt for command execution

Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. This is fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:07:29.465Z. Updated 2025-08-05T14:21:47.500Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:21 WIB

Official record

CritPublished 05 Aug 2025, 07:06 WIB

CVE-2025-54802

pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)

pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in pyLoad-ng CNL Blueprint via package parameter, allowing Arbitrary File Write which leads to Remote Code Execution (RCE). The addcrypted endpoint in pyload-ng suf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:06:48.834Z. Updated 2025-08-05T14:29:43.201Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:29 WIB

Official record

HighPublished 05 Aug 2025, 07:06 WIB

CVE-2025-54803

js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed in version 1.0.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:06:15.916Z. Updated 2025-08-05T14:31:35.284Z.

CVSS7.9v4.0KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:31 WIB

Official record

MedPublished 05 Aug 2025, 07:05 WIB

CVE-2025-54804

Russh is missing an overflow check during channel windows adjust

Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-05T00:05:20.971Z. Updated 2025-08-05T14:44:05.415Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 21:44 WIB

Official record