Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 4081–4100 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56139

CVE-2025-56139

LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user replaces the original URL in a post or comment before publishing. As a result, the stale preview remains visible while the clickable link points to a different URL, which can be malic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-03T20:16:03.564Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:16 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56435

CVE-2025-56435

SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on the parameter id.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-03T20:03:55.308Z.

Showing 4081 to 4100 of 4319.First page Next page

CVSS

—

KEVNot listed

EPSSPresent

Updated04 Sep 2025, 03:03 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56498

CVE-2025-56498

An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-03T20:03:01.578Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:03 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56608

CVE-2025-56608

The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-03T19:09:03.703Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Sep 2025, 02:09 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56689

CVE-2025-56689

One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authentication (MFA) bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying the same response. NO…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-16T15:30:56.644Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Sep 2025, 22:30 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56752

CVE-2025-56752

A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanisms, providing them with unrestricted access to alter administrative settings and potentially seize control of affected devices via crafted HTTP POST request to /user.cgi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-03T17:48:21.937Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Sep 2025, 00:48 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56760

CVE-2025-56760

When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-04T14:28:46.253Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Sep 2025, 21:28 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56761

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an adm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-04T14:27:45.512Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Sep 2025, 21:27 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-56803

CVE-2025-56803

Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An attacker can execute arbitrary OS commands by setting a crafted build field in the plugin's manifest.json. This field is passed to child_process.exec without validation, leading to possible RCE. NOTE: thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-09-08T18:25:25.655Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Sep 2025, 01:25 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57052

CVE-2025-57052

cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-11-03T18:13:42.953Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 01:13 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57146

CVE-2025-57146

phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2026-04-06T14:04:43.136Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:04 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57147

CVE-2025-57147

A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2026-04-06T14:15:59.722Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:15 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57148

CVE-2025-57148

phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2026-04-06T14:07:56.817Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:07 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57149

CVE-2025-57149

phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2026-04-06T14:19:08.917Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:19 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57150

CVE-2025-57150

phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2026-04-06T14:12:41.309Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:12 WIB

Official record

UnscoredPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57151

CVE-2025-57151

phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2026-04-06T14:01:03.543Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Apr 2026, 21:01 WIB

Official record

HighPublished 03 Sep 2025, 07:00 WIB

CVE-2025-57833

CVE-2025-57833

An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias().

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T00:00:00.000Z. Updated 2025-11-04T21:13:19.662Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:13 WIB

Official record

HighPublished 03 Sep 2025, 06:39 WIB

CVE-2025-54588

Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free (UAF) vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic Forward Proxy implementa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T23:39:07.429Z. Updated 2025-09-03T20:27:46.781Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 03:27 WIB

Official record

MedPublished 03 Sep 2025, 06:32 WIB

CVE-2025-9841

code-projects Mobile Shop Management System AddNewProduct.php unrestricted upload

A security vulnerability has been detected in code-projects Mobile Shop Management System 1.0. This affects an unknown function of the file AddNewProduct.php. The manipulation of the argument ProductImage leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T23:32:06.541Z. Updated 2025-09-03T18:51:27.843Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 01:51 WIB

Official record

MedPublished 03 Sep 2025, 06:22 WIB

CVE-2025-9260

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions 5.1.16 to 6.1.1 via deserialization of untrusted input in the parseUserProperties function. This makes it possible for authenticated attackers, with Subscribe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T23:22:45.796Z. Updated 2025-09-03T18:57:31.656Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 01:57 WIB

Official record