Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 501–520 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

UnscoredPublished 26 Sep 2025, 07:00 WIB

CVE-2025-56383

CVE-2025-56383

Notepad++ v8.8.3 has a DLL hijacking vulnerability, which can replace the original DLL file to execute malicious code. NOTE: this is disputed by multiple parties because the behavior only occurs when a user installs the product into a directory tree that allows write access by arbitrary unprivileged users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2026-02-26T17:47:55.453Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

UnscoredPublished 26 Sep 2025, 07:00 WIB

CVE-2025-56463

CVE-2025-56463

Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T15:57:25.891Z.

CVSS—KEV

Showing 501 to 520 of 4319.First page Next page

Not listed

EPSSPresent

Updated26 Sep 2025, 22:57 WIB

Official record

UnscoredPublished 26 Sep 2025, 07:00 WIB

CVE-2025-57292

CVE-2025-57292

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T15:20:12.397Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Sep 2025, 22:20 WIB

Official record

UnscoredPublished 26 Sep 2025, 07:00 WIB

CVE-2025-57692

CVE-2025-57692

PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T20:43:15.186Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2025, 03:43 WIB

Official record

UnscoredPublished 26 Sep 2025, 07:00 WIB

CVE-2025-58384

CVE-2025-58384

In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T18:40:58.386Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Sep 2025, 01:40 WIB

Official record

UnscoredPublished 26 Sep 2025, 07:00 WIB

CVE-2025-58385

CVE-2025-58385

In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T15:48:08.144Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Sep 2025, 22:48 WIB

Official record

UnscoredPublished 26 Sep 2025, 07:00 WIB

CVE-2025-59362

CVE-2025-59362

Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-29T15:30:05.725Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Sep 2025, 22:30 WIB

Official record

HighPublished 26 Sep 2025, 07:00 WIB

CVE-2025-60017

CVE-2025-60017

Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restart_wifi_sta).

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T19:17:06.504Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated27 Sep 2025, 02:17 WIB

Official record

MedPublished 26 Sep 2025, 07:00 WIB

CVE-2025-60250

CVE-2025-60250

Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d4bdfe19a4f IV.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T19:18:16.378Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated27 Sep 2025, 02:18 WIB

Official record

MedPublished 26 Sep 2025, 07:00 WIB

CVE-2025-60251

CVE-2025-60251

Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring.

Excerpt language: en.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T00:00:00.000Z. Updated 2025-09-26T14:49:50.498Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated26 Sep 2025, 21:49 WIB

Official record

MedPublished 26 Sep 2025, 06:32 WIB

CVE-2025-10980

JeecgBoot exportXls improper authorization

A security vulnerability has been detected in JeecgBoot up to 3.8.2. This affects an unknown function of the file /sys/position/exportXls. Such manipulation leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted ea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T23:32:07.502Z. Updated 2025-09-26T19:15:16.785Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 02:15 WIB

Official record

MedPublished 26 Sep 2025, 06:02 WIB

CVE-2025-10979

JeecgBoot exportXls improper authorization

A weakness has been identified in JeecgBoot up to 3.8.2. The impacted element is an unknown function of the file /sys/role/exportXls. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. The vendor was …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T23:02:07.534Z. Updated 2025-09-26T19:13:10.702Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 02:13 WIB

Official record

MedPublished 26 Sep 2025, 05:32 WIB

CVE-2025-10978

JeecgBoot Filter exportXls improper authorization

A security flaw has been discovered in JeecgBoot up to 3.8.2. The affected element is an unknown function of the file /sys/user/exportXls of the component Filter Handler. The manipulation results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T22:32:11.908Z. Updated 2025-09-26T19:11:50.060Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 02:11 WIB

Official record

LowPublished 26 Sep 2025, 05:32 WIB

CVE-2025-10977

JeecgBoot deleteBatch improper authorization

A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is conside…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T22:32:08.286Z. Updated 2025-09-26T15:38:18.442Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2025, 22:38 WIB

Official record

LowPublished 26 Sep 2025, 05:02 WIB

CVE-2025-10976

JeecgBoot getDepartUserList improper authorization

A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T22:02:08.243Z. Updated 2025-09-26T17:52:54.563Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:52 WIB

Official record

MedPublished 26 Sep 2025, 04:32 WIB

CVE-2025-10975

GuanxingLu vlarl ZeroMQ reasoning_server.py run_reasoning_server deserialization

A vulnerability was found in GuanxingLu vlarl up to 31abc0baf53ef8f5db666a1c882e1ea64def2997. This vulnerability affects the function experiments.robot.bridge.reasoning_server::run_reasoning_server of the file experiments/robot/bridge/reasoning_server.py of the component ZeroMQ. Performing manipulation of the argument …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T21:32:07.791Z. Updated 2025-09-26T17:53:07.057Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:53 WIB

Official record

MedPublished 26 Sep 2025, 04:32 WIB

CVE-2025-10974

giantspatula SewKinect Endpoint calculate pickle.loads deserialization

A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /calculate of the component Endpoint. Such manipulation of the argument body_parts/point_cloud leads to deserialization. The attack may be launched remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T21:32:05.444Z. Updated 2025-09-26T17:55:26.429Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:55 WIB

Official record

MedPublished 26 Sep 2025, 04:11 WIB

CVE-2025-26482

CVE-2025-26482

Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T21:11:43.372Z. Updated 2025-09-26T17:39:20.743Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:39 WIB

Official record

MedPublished 26 Sep 2025, 04:02 WIB

CVE-2025-10973

JackieDYH Resume-management-system show.php sql injection

A flaw has been found in JackieDYH Resume-management-system up to fb6b857d852dd796e748ce30c606fe5e61c18273. Affected by this issue is some unknown functionality of the file /admin/show.php. This manipulation of the argument userid causes sql injection. The attack may be initiated remotely. The exploit has been publishe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T21:02:05.564Z. Updated 2025-09-26T17:55:39.385Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:55 WIB

Official record

CritPublished 26 Sep 2025, 03:17 WIB

CVE-2025-11005

TOTOLINK X6000R Unauthenticated Command Injection Vulnerability

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1458_B20250708.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T20:17:45.856Z. Updated 2025-09-26T17:55:52.729Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:55 WIB

Official record