Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 561–580 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-50985

CVE-2025-50985

diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. Unsanitized GET parameters including maxage, maxindex, index, path, q (query), and doctype are directly echoed into the HTML response, allowing attackers to inject and execute arbitrary JavaS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-27T15:12:25.150Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 22:12 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-50986

CVE-2025-50986

diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings interface. Various configuration fields such as ES_HOST, ES_INDEXREFRESH, ES_PORT, ES_SCROLLSIZE, ES_TRANSLOGSIZE, ES_TRANSLOGSYNCINT, EXCLUDES_FILES, FILE_TYPES[], INCLUDES_DIRS,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 561 to 580 of 3629.First page Next page

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-27T15:03:20.482Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 22:03 WIB

Official record

CritPublished 27 Aug 2025, 07:00 WIB

CVE-2025-50989

CVE-2025-50989

OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-09-12T13:49:13.889Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated12 Sep 2025, 20:49 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-51667

CVE-2025-51667

An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. The /sys-api/role/update interface in the simple-admin-core system has a limited SQL injection vulnerability, which may lead to partial data leakage or disruption of normal system operations.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-27T17:46:49.476Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2025, 00:46 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-52122

CVE-2025-52122

Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitrary code injection for all users that have access to editing a form (submission title).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-27T14:40:07.245Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:40 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-54598

CVE-2025-54598

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-27T18:51:20.671Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2025, 01:51 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-55422

CVE-2025-55422

In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2026-07-05T01:10:13.850Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:10 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-55495

CVE-2025-55495

Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-27T19:31:13.261Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Aug 2025, 02:31 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-55582

CVE-2025-55582

D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `signalc` without verifying integrity, authenticity, or permissions. An attacker with local filesystem access (via physical access, firmware modification, or debug …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-29T13:50:44.360Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2025, 20:50 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-55618

CVE-2025-55618

In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendered.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2026-07-05T01:10:22.865Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:10 WIB

Official record

UnscoredPublished 27 Aug 2025, 07:00 WIB

CVE-2025-56694

CVE-2025-56694

Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protected photo albums.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-27T00:00:00.000Z. Updated 2025-08-27T14:32:00.274Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:32 WIB

Official record

MedPublished 27 Aug 2025, 06:22 WIB

CVE-2025-8490

All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T23:22:40.976Z. Updated 2026-04-08T17:04:37.782Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-26417

CVE-2025-26417

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:58.986Z. Updated 2025-08-27T14:13:41.118Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:13 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22413

CVE-2025-22413

In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:57.984Z. Updated 2025-08-27T14:12:23.366Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:12 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22412

CVE-2025-22412

In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:56.963Z. Updated 2026-02-26T17:48:04.363Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22411

CVE-2025-22411

In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:55.939Z. Updated 2026-02-26T17:48:05.459Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22410

CVE-2025-22410

In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:54.927Z. Updated 2025-08-27T14:07:44.512Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:07 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22409

CVE-2025-22409

In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:53.937Z. Updated 2026-02-26T17:48:06.428Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:48 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22408

CVE-2025-22408

In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:52.916Z. Updated 2025-08-27T14:06:11.523Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:06 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22407

CVE-2025-22407

In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:51.907Z. Updated 2025-08-27T14:05:40.268Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:05 WIB

Official record