Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 4161–4180 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

MedPublished 03 Sep 2025, 01:32 WIB

CVE-2025-9829

PHPGurukul Beauty Parlour Management System signup.php sql injection

A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /signup.php. The manipulation of the argument mobilenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:32:07.340Z. Updated 2025-09-02T18:58:43.946Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 01:58 WIB

Official record

MedPublished 03 Sep 2025, 01:29 WIB

CVE-2025-43726

CVE-2025-43726

Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 4161 to 4180 of 4319.First page Next page

Published 2025-09-02T18:29:58.871Z. Updated 2026-02-26T17:49:54.393Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:49 WIB

Official record

HighPublished 03 Sep 2025, 01:22 WIB

CVE-2025-57777

Out Of Bounds Write in displ2.dll when parsing a DSB file with Digilent DASYLab

There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:22:00.738Z. Updated 2025-09-02T19:10:31.598Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 02:10 WIB

Official record

HighPublished 03 Sep 2025, 01:21 WIB

CVE-2025-57775

Heap-based Buffer Overflow when parsing a DSB file with Digilent DASYLab

There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:21:16.129Z. Updated 2025-09-02T19:19:22.961Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 02:19 WIB

Official record

HighPublished 03 Sep 2025, 01:19 WIB

CVE-2025-9188

Deserialization of Untrusted Data when parsing a DSB file with Digilent DASYLab

There is a deserialization of untrusted data vulnerability in Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all versions of DASYLab.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:19:48.923Z. Updated 2025-09-02T19:22:31.352Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 02:22 WIB

Official record

HighPublished 03 Sep 2025, 01:16 WIB

CVE-2025-57778

Out Of Bounds Write to invalid source address when parsing a DSB file with Digilent DASYLab

There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid source address when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:16:54.772Z. Updated 2025-09-02T19:23:38.292Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 02:23 WIB

Official record

HighPublished 03 Sep 2025, 01:16 WIB

CVE-2025-57776

Out Of Bounds Write to invalid address when parsing a DSB file with Digilent DASYLab

There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:16:01.400Z. Updated 2025-09-02T19:26:22.716Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 02:26 WIB

Official record

HighPublished 03 Sep 2025, 01:15 WIB

CVE-2025-57774

Out Of Bounds Write of invalid data when parsing a DSB file with Digilent DASYLab

There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:15:10.516Z. Updated 2025-09-02T19:26:41.041Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 02:26 WIB

Official record

HighPublished 03 Sep 2025, 01:12 WIB

CVE-2025-9189

Out Of Bounds Write when parsing a DSB file with Digilent DASYLab

There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T18:12:43.393Z. Updated 2026-09-03T16:14:10.432Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 23:14 WIB

Official record

MedPublished 03 Sep 2025, 00:02 WIB

CVE-2025-9828

Tenda CP6 uhttp sub_2B7D04 risky encryption

A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as dif…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T17:02:08.742Z. Updated 2025-09-02T20:35:45.362Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 03:35 WIB

Official record

CritPublished 02 Sep 2025, 23:34 WIB

CVE-2025-9696

Use of Hard-coded Credentials in SunPower PVS6

The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the attacker to perform acti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T16:34:35.362Z. Updated 2025-09-02T17:39:59.231Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 00:39 WIB

Official record

HighPublished 02 Sep 2025, 20:37 WIB

CVE-2025-9784

Undertow: undertow madeyoureset http/2 ddos vulnerability

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T13:37:59.772Z. Updated 2026-10-14T16:27:52.637Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Oct 2026, 23:27 WIB

Official record

HighPublished 02 Sep 2025, 20:28 WIB

CVE-2025-2413

OTP Bypass in Akinsoft's ProKuafor

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor allows Authentication Bypass. This issue affects ProKuafor: from s1.02.08 before v1.02.08.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T13:28:21.556Z. Updated 2026-08-04T15:54:34.637Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated04 Aug 2026, 22:54 WIB

Official record

MedPublished 02 Sep 2025, 20:24 WIB

CVE-2025-0670

IDOR in Akinsoft's ProKuafor

Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure. This issue affects ProKuafor: from s1.02.07 before v1.02.08.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T13:24:49.472Z. Updated 2026-06-06T07:15:41.445Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:15 WIB

Official record

MedPublished 02 Sep 2025, 20:19 WIB

CVE-2024-12974

XSS in Akinsoft's ProKuaför

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft ProKuaför allows Cross-Site Scripting (XSS). This issue affects ProKuaför: from s1.02.07 before v1.02.08.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T13:19:38.748Z. Updated 2026-06-01T12:43:25.996Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:43 WIB

Official record

HighPublished 02 Sep 2025, 18:53 WIB

CVE-2024-58259

Rancher affected by unauthenticated Denial of Service

A vulnerability has been identified within Rancher Manager in which it did not enforce request body size limits on certain public (unauthenticated) and authenticated API endpoints. This allows a malicious user to exploit this by sending excessively large payloads, which are fully loaded into memory during processin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T11:53:03.928Z. Updated 2025-09-02T13:28:15.865Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 20:28 WIB

Official record

HighPublished 02 Sep 2025, 18:52 WIB

CVE-2025-2414

OTP Bypass in Akinsoft's OctoCloud

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft OctoCloud allows Authentication Bypass. This issue affects OctoCloud: from s1.09.03 before v1.11.01.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T11:52:30.213Z. Updated 2026-06-06T06:02:14.127Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:02 WIB

Official record

HighPublished 02 Sep 2025, 18:49 WIB

CVE-2024-52284

Rancher Fleet Helm Values are stored inside BundleDeployment in plain text

Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm values containing credentials or other secrets.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T11:49:49.379Z. Updated 2025-09-02T13:31:49.988Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 20:31 WIB

Official record

MedPublished 02 Sep 2025, 18:48 WIB

CVE-2025-0640

IDOR in Akinsoft's OctoCloud

Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure. This issue affects OctoCloud: from s1.09.02 before v1.11.01.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T11:48:09.493Z. Updated 2026-06-06T07:21:20.128Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:21 WIB

Official record

MedPublished 02 Sep 2025, 18:43 WIB

CVE-2024-12973

Host Header Injection in Akinsoft's OctoCloud

Origin Validation Error vulnerability in Akinsoft OctoCloud allows HTTP Response Splitting, CAPEC - 87 - Forceful Browsing. This issue affects OctoCloud: from s1.09.01 before v1.11.01.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-02T11:43:35.654Z. Updated 2026-06-01T12:44:46.147Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:44 WIB

Official record