Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 3341–3360 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 07 Sep 2025, 08:32 WIB

CVE-2025-10067

itsourcecode POS Point of Sale System empty_table.php cross site scripting

A vulnerability was detected in itsourcecode POS Point of Sale System 1.0. The impacted element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/empty_table.php. Performing manipulation of the argument scripts results in cross site scripting. It is possible to initiate the at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-07T01:32:06.941Z. Updated 2025-09-08T17:44:26.640Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 00:44 WIB

Official record

MedPublished 07 Sep 2025, 08:02 WIB

CVE-2025-10066

itsourcecode POS Point of Sale System dymanic_table.php cross site scripting

A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dymanic_table.php. Such manipulation of the argument scripts leads to cross site scripting. The attack may be perform…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3341 to 3360 of 4319.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-07T01:02:07.393Z. Updated 2025-09-08T17:48:48.526Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 00:48 WIB

Official record

MedPublished 07 Sep 2025, 07:37 WIB

CVE-2025-36100

IBM MQ information disclosure

IBM MQ LTS 9.1.0.0 through 9.1.0.29, 9.2.0.0 through 9.2.0.36, 9.3.0.0 through 9.3.0.30 and 9.4.0.0 through 9.4.0.12 and IBM MQ CD 9.3.0.0 through 9.3.5.1 and 9.4.0.0 through 9.4.3.0 Java and JMS stores a password in client configuration files when trace is enabled which can be read by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-07T00:37:00.421Z. Updated 2025-10-09T16:22:51.045Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated09 Oct 2025, 23:22 WIB

Official record

MedPublished 07 Sep 2025, 07:32 WIB

CVE-2025-10065

itsourcecode POS Point of Sale System dom_data_th.php cross site scripting

A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php. This manipulation of the argument scripts causes cross site scripting. The attack is possible to be carried out remotely. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-07T00:32:06.963Z. Updated 2025-09-08T13:12:16.432Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Sep 2025, 20:12 WIB

Official record

MedPublished 07 Sep 2025, 07:02 WIB

CVE-2025-10064

itsourcecode POS Point of Sale System dom_data_two_headers.php cross site scripting

A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_two_headers.php. The manipulation of the argument scripts results in cross site scripting. The attack can be execute…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-07T00:02:05.977Z. Updated 2025-09-08T14:01:59.963Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:01 WIB

Official record

MedPublished 07 Sep 2025, 06:02 WIB

CVE-2025-10063

itsourcecode POS Point of Sale System deferred_table.php cross site scripting

A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datatables/unit_testing/templates/deferred_table.php. The manipulation of the argument scripts leads to cross site scripting. Remote exploitation of the attack is poss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T23:02:07.868Z. Updated 2025-09-08T14:27:31.552Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:27 WIB

Official record

MedPublished 07 Sep 2025, 05:32 WIB

CVE-2025-10062

itsourcecode Student Information Management System login.php sql injection

A vulnerability was determined in itsourcecode Student Information Management System 1.0. This affects an unknown part of the file /admin/login.php. Executing manipulation of the argument uname can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T22:32:06.241Z. Updated 2025-09-08T14:33:58.040Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:33 WIB

Official record

CritPublished 07 Sep 2025, 03:04 WIB

CVE-2025-58443

FOG's authentication bypass leads to full SQL DB dump

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be release…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T20:04:25.442Z. Updated 2025-09-08T14:34:35.606Z.

CVSS9.9v4.0KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:34 WIB

Official record

MedPublished 07 Sep 2025, 02:47 WIB

CVE-2025-58445

Atlantis Exposes Service Version Publicly on /status API Endpoint

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T19:47:33.669Z. Updated 2025-09-08T14:35:06.195Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:35 WIB

Official record

MedPublished 07 Sep 2025, 02:06 WIB

CVE-2025-58446

xgrammar vulnerable to denial of service by huge enum grammar

xgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes large grammars (>100k characters) at very low rates, and can be used for DOS of model providers. This issue is fixed in version 0.1.24.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T19:06:10.141Z. Updated 2025-09-08T17:55:13.537Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Sep 2025, 00:55 WIB

Official record

CritPublished 07 Sep 2025, 01:45 WIB

CVE-2025-58438

internetarchive is vulnerable to Directory Traversal through file downloads

internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory traversal (path traversal) vulnerability in the File.download() method of the internetarchive library. The file.download() method does not properly sanitize user-supplied filenames or validate the fin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T18:45:55.833Z. Updated 2025-11-03T18:13:54.480Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 01:13 WIB

Official record

MedPublished 07 Sep 2025, 01:35 WIB

CVE-2025-0034

CVE-2025-0034

Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_SPATIAL_PART and cause read or write past the end of allocated arrays, potentially resulting in a loss of platform integrity or denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T18:35:44.023Z. Updated 2025-09-08T14:35:31.627Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:35 WIB

Official record

HighPublished 07 Sep 2025, 01:34 WIB

CVE-2025-0032

CVE-2025-0032

Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microcode, potentially resulting in loss of integrity of x86 instruction execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T18:34:33.606Z. Updated 2026-02-26T17:49:08.978Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

LowPublished 07 Sep 2025, 01:29 WIB

CVE-2025-0011

CVE-2025-0011

Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potentially resulting in loss of confidentiality.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T18:29:38.832Z. Updated 2025-09-08T19:56:22.591Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated09 Sep 2025, 02:56 WIB

Official record

MedPublished 07 Sep 2025, 01:26 WIB

CVE-2025-0010

CVE-2025-0010

An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confidentiality, integrity, or availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T18:26:15.118Z. Updated 2025-09-08T19:56:43.287Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Sep 2025, 02:56 WIB

Official record

MedPublished 07 Sep 2025, 01:12 WIB

CVE-2025-0009

CVE-2025-0009

A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a system crash and loss of availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T18:12:45.679Z. Updated 2025-09-08T14:35:46.513Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:35 WIB

Official record

HighPublished 07 Sep 2025, 01:06 WIB

CVE-2024-36354

CVE-2024-36354

Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to bypass SMM isolation potentially resulting in arbitrary code execution at the SMM level.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T18:06:43.084Z. Updated 2026-02-26T17:49:09.189Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

HighPublished 07 Sep 2025, 00:54 WIB

CVE-2024-36352

CVE-2024-36352

Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary writes or denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T17:54:57.932Z. Updated 2025-09-08T14:48:33.628Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:48 WIB

Official record

MedPublished 07 Sep 2025, 00:43 WIB

CVE-2024-36346

CVE-2024-36346

Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input data potentially causing a GPU Reset condition.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T17:43:14.113Z. Updated 2025-09-08T14:49:20.329Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated08 Sep 2025, 21:49 WIB

Official record

HighPublished 07 Sep 2025, 00:42 WIB

CVE-2024-36342

CVE-2024-36342

Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-06T17:42:00.232Z. Updated 2026-02-26T17:49:09.671Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record