Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates
3,774 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.
CVE-2025-54527
In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass security restrictions
Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T16:20:38.600Z. Updated 2025-07-28T17:26:29.884Z.
Privilege Management for Windows - Elevation of Privilege
Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.
Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T15:40:28.381Z. Updated 2025-07-28T17:22:45.226Z.
Privilege Management for Windows - Elevation of Privilege
Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user registry under certain conditions. This allows users with the ability to edit their user profile files to elevate their privileges to administrator.
Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T15:40:14.633Z. Updated 2025-07-28T17:22:18.590Z.
IBM Informix Dynamic Server HTML injection
IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T15:27:37.588Z. Updated 2025-07-28T17:20:17.395Z.
IBM Informix Dynamic Server information disclosure
IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T15:26:35.209Z. Updated 2025-07-28T17:19:52.455Z.
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing (`imagick` as the image library) and either allow file uploads with user-controlled filenames and process uploaded images using t…
Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T14:47:20.887Z. Updated 2025-07-28T17:19:14.503Z.
CVE-2025-53696
iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected.
Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T14:43:01.059Z. Updated 2025-08-19T14:43:13.549Z.
CVE-2025-53695
OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware.
Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T14:05:36.623Z. Updated 2025-08-19T14:43:14.865Z.
Missing Authentication for Critical Function in GitLab Language Server
Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution
Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T14:04:28.764Z. Updated 2025-07-28T14:23:37.024Z.
CVE-2025-26469
An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840. A specially crafted application can decrypt credentials stored in a configuration-related registry key. An attacker can execute a malicious script or application to exploit…
Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T13:36:21.156Z. Updated 2025-11-03T19:45:27.179Z.
CVE-2025-27724
A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted .php file can lead to elevated capabilities. An attacker can upload a malicious file to trigger this vulnerability.
Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T13:36:19.725Z. Updated 2025-11-03T19:46:23.225Z.
CVE-2025-32731
A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T13:36:18.137Z. Updated 2025-11-03T19:53:37.817Z.
CVE-2025-24485
A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead to SSRF. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T13:36:15.487Z. Updated 2025-11-03T19:44:47.144Z.
Glib: glib crash after long command line
A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T12:40:29.298Z. Updated 2026-06-30T10:40:21.299Z.
bsc Peru Cocktails App bsc.devy.peru_cocktails AndroidManifest.xml improper export of android application components
A vulnerability, which was classified as problematic, has been found in bsc Peru Cocktails App 1.0.0 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component bsc.devy.peru_cocktails. The manipulation leads to improper export of android application components. It …
Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T12:02:05.803Z. Updated 2025-07-28T13:28:40.227Z.
Campcodes Online Recruitment Management System ajax.php sql injection
A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=save_recruitment_status. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. …
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T11:32:06.220Z. Updated 2025-07-28T14:31:37.296Z.
Privilege Escalation in Beamsec PhishPro
Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2.
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T11:25:44.208Z. Updated 2026-06-05T14:09:21.577Z.
usb: gadget: configfs: Fix OOB read on empty string write
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to either 'qw_sign' or 'landingPage' sysfs attributes, the store functions attempt to access page[l - 1] before validating that the length 'l' is greater than zero…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T11:22:05.855Z. Updated 2026-05-11T21:29:09.774Z.
dm-bufio: fix sched in atomic context
In the Linux kernel, the following vulnerability has been resolved: dm-bufio: fix sched in atomic context If "try_verify_in_tasklet" is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP is enabled for dm-bufio. However, when bufio tries to evict buffers, there is a chance to trigger scheduling in spin_lock_bh, the followin…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T11:22:05.091Z. Updated 2026-05-11T21:29:08.636Z.
HID: core: ensure the allocated report buffer can contain the reserved report ID
In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the report ID is not used, the low level transport drivers expect the first byte to be 0. However, currently the allocated buffer not account for that extra byte, m…
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-07-28T11:22:04.169Z. Updated 2026-08-05T12:02:24.110Z.