Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 441–460 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

UnscoredPublished 28 Jul 2025, 18:21 WIB

CVE-2025-38473

Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reported null-ptr-deref in l2cap_sock_resume_cb(). [0] l2cap_sock_resume_cb() has a similar problem that was fixed by commit 1bff51ea59a9 ("Bluetooth: fix use-after-free error in lock_so…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T11:21:34.880Z. Updated 2026-05-11T21:28:41.562Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

CritPublished 28 Jul 2025, 18:21 WIB

CVE-2025-38472

netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP: __nf_ct_delete_from_lists+172] [..] #7 [ff539b5a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 441 to 460 of 3774.First page Next page

Published 2025-07-28T11:21:33.977Z. Updated 2026-10-15T21:52:17.084Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

CritPublished 28 Jul 2025, 18:21 WIB

CVE-2025-38471

tls: always refresh the queue when reading sock

In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old skb when checking if all skbs in the queue have matching decr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T11:21:32.927Z. Updated 2026-10-15T01:07:24.522Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record

HighPublished 28 Jul 2025, 18:21 WIB

CVE-2025-38470

net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime

In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remove VLAN 0 when the net device is put administratively up or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T11:21:32.002Z. Updated 2026-10-15T21:52:16.938Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:52 WIB

Official record

UnscoredPublished 28 Jul 2025, 18:21 WIB

CVE-2025-38469

KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports > 1). After the kmalloc_array(), the error paths need to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T11:21:30.992Z. Updated 2026-05-11T21:28:36.841Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:28 WIB

Official record

UnscoredPublished 28 Jul 2025, 18:12 WIB

CVE-2025-38468

net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree

In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T11:12:20.188Z. Updated 2026-10-15T01:07:21.684Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record

CritPublished 28 Jul 2025, 18:05 WIB

CVE-2025-6918

SQLi in Ncvav's Virtual PBX Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This issue affects Virtual PBX Software: before 09.07.2025.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T11:05:16.203Z. Updated 2026-06-05T14:00:39.156Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 21:00 WIB

Official record

MedPublished 28 Jul 2025, 18:02 WIB

CVE-2025-8273

code-projects Exam Form Submission update_s8.php sql injection

A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s8.php. The manipulation of the argument credits leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T11:02:05.676Z. Updated 2025-07-28T14:36:13.375Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 21:36 WIB

Official record

MedPublished 28 Jul 2025, 17:32 WIB

CVE-2025-8272

code-projects Exam Form Submission update_fst.php sql injection

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/update_fst.php. The manipulation of the argument credits leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T10:32:05.691Z. Updated 2025-07-28T14:50:41.728Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 21:50 WIB

Official record

MedPublished 28 Jul 2025, 17:28 WIB

CVE-2025-40730

HTML injection in Vox Media's Chorus CMS

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on beh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T10:28:30.800Z. Updated 2025-07-28T15:18:50.377Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:18 WIB

Official record

MedPublished 28 Jul 2025, 17:02 WIB

CVE-2025-8271

code-projects Exam Form Submission delete_s3.php sql injection

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete_s3.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T10:02:05.388Z. Updated 2025-07-28T15:28:32.896Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:28 WIB

Official record

MedPublished 28 Jul 2025, 16:32 WIB

CVE-2025-8270

code-projects Exam Form Submission delete_s2.php sql injection

A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete_s2.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T09:32:06.184Z. Updated 2025-07-28T15:29:46.349Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:29 WIB

Official record

MedPublished 28 Jul 2025, 16:02 WIB

CVE-2025-8269

code-projects Exam Form Submission delete_s1.php sql injection

A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete_s1.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the pu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T09:02:15.193Z. Updated 2025-07-28T15:33:00.219Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:33 WIB

Official record

MedPublished 28 Jul 2025, 15:47 WIB

CVE-2025-27802

Stored Cross-Site Scripting in Episerver Content Management System (CMS) Edit Preview

The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. RTE properties (text fields), which could be used in the "Edit" section of the CMS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T08:47:43.486Z. Updated 2025-11-03T19:46:27.417Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:46 WIB

Official record

MedPublished 28 Jul 2025, 15:40 WIB

CVE-2025-27801

Stored Cross-Site Scripting in Episerver Content Management System (CMS) Media Selection Preview

The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. ContentReference properties, which could be used in the "Edit" section of the CM…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T08:40:15.815Z. Updated 2025-11-03T19:46:25.984Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:46 WIB

Official record

MedPublished 28 Jul 2025, 15:33 WIB

CVE-2025-27800

Stored Cross-Site Scripting in Episerver Content Management System (CMS) Admin Dashboard

The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authenticated attacker to execute malicious JavaScript code in the victim's browser. The Admin dashboard offered the functionality to add gadgets to the dashboard. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T08:33:24.304Z. Updated 2025-11-03T19:46:24.615Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:46 WIB

Official record

MedPublished 28 Jul 2025, 15:32 WIB

CVE-2025-8266

yanyutao0402 ChanCMS collect.js getArticle deserialization

A vulnerability has been found in yanyutao0402 ChanCMS up to 3.1.2 and classified as critical. Affected by this vulnerability is the function getArticle of the file app/modules/cms/controller/collect.js. The manipulation of the argument targetUrl leads to deserialization. The attack can be launched remotely. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T08:32:15.139Z. Updated 2025-07-28T16:59:30.165Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:59 WIB

Official record

MedPublished 28 Jul 2025, 15:02 WIB

CVE-2025-8265

299Ko CMS File Management view unrestricted upload

A vulnerability classified as critical has been found in 299Ko CMS 2.0.0. This affects an unknown part of the file /admin/filemanager/view of the component File Management. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T08:02:05.608Z. Updated 2025-07-28T17:02:41.864Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:02 WIB

Official record

MedPublished 28 Jul 2025, 14:02 WIB

CVE-2025-8262

yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expression complexity. It is possible to launch the attack remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T07:02:05.616Z. Updated 2025-07-28T17:16:45.501Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:16 WIB

Official record

MedPublished 28 Jul 2025, 13:32 WIB

CVE-2025-8261

Vaelsys VaelsysV4 User Creation vgrid_server.php improper authorization

A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-28T06:32:05.645Z. Updated 2026-04-15T07:13:54.724Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Apr 2026, 14:13 WIB

Official record