Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 581–600 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

MedPublished 25 Jun 2025, 23:41 WIB

CVE-2025-52569

GitHub.jl lacks validation for user-provided fields

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the `GitHub.repo()` function, the user can provide any string for the `repo_name` field. These inputs are not validated or safely enco…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:41:46.303Z. Updated 2025-06-25T17:55:48.517Z.

CVSS6.6v4.0KEVNot listedEPSSPresentUpdated26 Jun 2025, 00:55 WIB

Official record

HighPublished 25 Jun 2025, 23:39 WIB

CVE-2025-52483

Registrator.jl Vulnerable to Argument Injection and Command Injection

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 581 to 600 of 3682.First page Next page

Published 2025-06-25T16:39:45.707Z. Updated 2025-06-26T14:38:03.142Z.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated26 Jun 2025, 21:38 WIB

Official record

HighPublished 25 Jun 2025, 23:37 WIB

CVE-2025-52480

Registrator.jl Argument Injection Vulnerability

Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:37:32.944Z. Updated 2025-06-26T14:37:18.399Z.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated26 Jun 2025, 21:37 WIB

Official record

CritPublished 25 Jun 2025, 23:36 WIB

CVE-2025-49153

Path Traversal in MICROSENS NMP Web+

The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:36:11.596Z. Updated 2025-07-17T13:46:29.428Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated17 Jul 2025, 20:46 WIB

Official record

HighPublished 25 Jun 2025, 23:34 WIB

CVE-2025-49152

Insufficient Session Expiration in MICROSENS NMP Web+

The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:34:00.772Z. Updated 2025-07-17T13:44:34.959Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated17 Jul 2025, 20:44 WIB

Official record

CritPublished 25 Jun 2025, 23:32 WIB

CVE-2025-49151

Use of Hard-coded, Security-relevant Constants in MICROSENS NMP Web+

The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:32:30.492Z. Updated 2025-07-17T13:43:28.516Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated17 Jul 2025, 20:43 WIB

Official record

HighPublished 25 Jun 2025, 23:31 WIB

CVE-2025-6616

D-Link DIR-619L formSetWAN_Wizard51 stack-based overflow

A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWAN_Wizard51 of the file /goform/formSetWAN_Wizard51. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:31:05.816Z. Updated 2025-06-25T20:12:08.789Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Jun 2025, 03:12 WIB

Official record

CritPublished 25 Jun 2025, 23:29 WIB

CVE-2025-20282

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. This vulnerability is due a lack of file validation checks that would prevent uplo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:29:12.357Z. Updated 2026-02-26T17:50:23.927Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 25 Jun 2025, 23:23 WIB

CVE-2025-5015

Parsons AccuWeather Widget Cross-site Scripting

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:23:54.248Z. Updated 2025-06-25T20:09:56.654Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 03:09 WIB

Official record

LowPublished 25 Jun 2025, 23:15 WIB

CVE-2025-4656

Vault Vulnerable to Recovery Key Cancellation Denial of Service

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:15:11.861Z. Updated 2025-06-25T20:05:45.581Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 03:05 WIB

Official record

CritKEVPublished 25 Jun 2025, 23:11 WIB

CVE-2025-20281

Cisco ISE API Unauthenticated Remote Code Execution Vulnerability

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to insufficient validatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-06-25T16:11:42.285Z. Updated 2026-02-26T17:50:24.202Z.

CVSS10v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 25 Jun 2025, 23:11 WIB

CVE-2025-20264

Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms for users created by…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:11:42.274Z. Updated 2025-06-26T19:53:19.444Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:53 WIB

Official record

HighPublished 25 Jun 2025, 23:06 WIB

CVE-2025-52479

HTTP.jl vulnerable to CR/LF Injection in URIs

HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to version 1.6.0 and HTTP.jl prior to version 1.10.17 allows the construction of URIs containing CR/LF characters. If user input was not otherwise escaped or protected, t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:06:45.402Z. Updated 2026-05-07T20:47:37.830Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated08 May 2026, 03:47 WIB

Official record

HighPublished 25 Jun 2025, 23:00 WIB

CVE-2025-6615

D-Link DIR-619L formAutoDetecWAN_wizard4 stack-based overflow

A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform/formAutoDetecWAN_wizard4. The manipulation of the argument curTime leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:00:18.252Z. Updated 2025-06-26T19:50:49.809Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:50 WIB

Official record

HighPublished 25 Jun 2025, 23:00 WIB

CVE-2025-6614

D-Link DIR-619L formSetWANType_Wizard5 stack-based overflow

A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of the file /goform/formSetWANType_Wizard5. The manipulation of the argument curTime leads to stack-based buffer overflow. The attack may be launched remotely. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T16:00:16.008Z. Updated 2025-06-26T19:49:17.217Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:49 WIB

Official record

MedPublished 25 Jun 2025, 22:48 WIB

CVE-2025-50179

Tuleap missing CSRF protection on tracker reports manipulation

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T15:48:24.488Z. Updated 2025-06-25T16:00:32.891Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated25 Jun 2025, 23:00 WIB

Official record

MedPublished 25 Jun 2025, 22:39 WIB

CVE-2025-49845

Discourse users are able to see their own whispers even after being removed from a group that has been configured to see whispers

Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only users that belong to groups specified in the site setting are allowed to view posts typed `whisper`. However, it has been discovered that users of versions prior to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T15:39:01.328Z. Updated 2025-06-26T19:44:55.771Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:44 WIB

Official record

MedPublished 25 Jun 2025, 22:31 WIB

CVE-2025-6612

code-projects Inventory Management System removeCategories.php sql injection

A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/removeCategories.php. The manipulation of the argument categoriesId leads to sql injection. The attack may be initiated remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T15:31:07.817Z. Updated 2025-06-26T19:41:42.361Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:41 WIB

Official record

MedPublished 25 Jun 2025, 22:31 WIB

CVE-2025-6611

code-projects Inventory Management System createBrand.php sql injection

A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/createBrand.php. The manipulation of the argument brandStatus leads to sql injection. The attack can be initiated remotely. The exploit has been d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T15:31:05.727Z. Updated 2025-06-26T19:38:45.755Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 02:38 WIB

Official record

MedPublished 25 Jun 2025, 22:12 WIB

CVE-2025-50178

GitForge.jl lacks validation for user provided fields

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functions. In the `GitForge.get_repo` function for GitHub, the user can provide any string for the owner and repo fields. These inputs are not validated or safely encod…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-25T15:12:24.751Z. Updated 2025-06-25T15:20:43.040Z.

CVSS6.6v4.0KEVNot listedEPSSPresentUpdated25 Jun 2025, 22:20 WIB

Official record