Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 581–600 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22406

CVE-2025-22406

In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:50.898Z. Updated 2025-08-27T14:04:40.863Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:04 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22405

CVE-2025-22405

In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:49.898Z. Updated 2025-08-27T14:04:14.835Z.

CVSS

Showing 581 to 600 of 3629.First page Next page

—

KEVNot listed

EPSSPresent

Updated27 Aug 2025, 21:04 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22404

CVE-2025-22404

In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:48.900Z. Updated 2025-08-27T14:03:32.350Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:03 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-22403

CVE-2025-22403

In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:47.884Z. Updated 2025-08-27T14:02:45.076Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:02 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0093

CVE-2025-0093

In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:46.854Z. Updated 2025-08-27T13:59:49.947Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 20:59 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0092

CVE-2025-0092

In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:45.758Z. Updated 2025-08-27T13:58:02.927Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 20:58 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0086

CVE-2025-0086

In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:44.753Z. Updated 2025-08-27T14:09:35.395Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:09 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0084

CVE-2025-0084

In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support is enabled, with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:43.740Z. Updated 2025-08-27T14:10:22.604Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:10 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0083

CVE-2025-0083

In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:42.711Z. Updated 2025-08-27T14:01:28.545Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:01 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0082

CVE-2025-0082

In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:41.698Z. Updated 2025-08-27T14:42:07.881Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:42 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0081

CVE-2025-0081

In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:40.650Z. Updated 2025-08-27T14:14:23.731Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:14 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0080

CVE-2025-0080

In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:39.638Z. Updated 2025-08-27T13:44:30.722Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 20:44 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0079

CVE-2025-0079

In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:38.633Z. Updated 2025-08-27T13:48:17.455Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 20:48 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0078

CVE-2025-0078

In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:37.637Z. Updated 2025-08-27T13:52:36.086Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 20:52 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0075

CVE-2025-0075

In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:36.630Z. Updated 2025-08-27T14:16:40.891Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:16 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2025-0074

CVE-2025-0074

In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:35.616Z. Updated 2025-08-27T14:17:08.716Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:17 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2024-49740

CVE-2024-49740

In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:34.573Z. Updated 2025-08-27T13:57:26.530Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 20:57 WIB

Official record

UnscoredPublished 27 Aug 2025, 05:48 WIB

CVE-2023-21125

CVE-2023-21125

In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:48:27.450Z. Updated 2025-08-27T14:18:12.572Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:18 WIB

Official record

HighPublished 27 Aug 2025, 05:33 WIB

CVE-2025-57820

Svelte devalue vulnerable to prototype pollution

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:33:19.100Z. Updated 2025-08-27T20:42:46.786Z.

CVSS7.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2025, 03:42 WIB

Official record

MedPublished 27 Aug 2025, 05:26 WIB

CVE-2025-9277

SiteSEO – SEO Simplified <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the broken preg_replace expression in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T22:26:50.814Z. Updated 2026-04-08T17:17:50.443Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record