Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 521–540 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

MedPublished 27 Jul 2025, 12:32 WIB

CVE-2025-8224

GNU Binutils BFD Library elf.c bfd_elf_get_str_section null pointer dereference

A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has bee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T05:32:06.926Z. Updated 2026-10-15T01:02:20.885Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:02 WIB

Official record

MedPublished 27 Jul 2025, 12:02 WIB

CVE-2025-8223

jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgery

A vulnerability, which was classified as problematic, was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. This affects an unknown part of the file AdminTypeCustController.java. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remote…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 521 to 540 of 3774.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T05:02:05.371Z. Updated 2025-07-28T17:26:17.418Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 00:26 WIB

Official record

MedPublished 27 Jul 2025, 11:32 WIB

CVE-2025-8222

jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scripting

A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this issue is some unknown functionality of the file GoodsController.java. The manipulation leads to cross site scripting. The attack may be launched re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T04:32:05.698Z. Updated 2025-07-28T16:45:36.587Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:45 WIB

Official record

MedPublished 27 Jul 2025, 11:23 WIB

CVE-2025-8104

Memory Usage <= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function

The Memory Usage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.98. This is due to missing nonce validation in the wpmemory_install_plugin() function. This makes it possible for unauthenticated attackers to silently install one of the several whitelisted plugins…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T04:23:39.777Z. Updated 2026-04-08T17:23:33.474Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:23 WIB

Official record

MedPublished 27 Jul 2025, 11:02 WIB

CVE-2025-8221

jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scripting

A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vulnerability is the function goodsSearch of the file GoodsCustController.java. The manipulation of the argument keyword leads to cross site scripting. The attack c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T04:02:04.985Z. Updated 2025-07-28T14:59:07.284Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 21:59 WIB

Official record

MedPublished 27 Jul 2025, 10:02 WIB

CVE-2025-8220

Engeman Web Password Recovery RecoveryPass sql injection

A vulnerability has been found in Engeman Web up to 12.0.0.2. The affected element is an unknown function of the file /Login/RecoveryPass of the component Password Recovery Page. The manipulation of the argument LanguageCombobox as part of Cookie leads to sql injection. The attack is possible to be carried out remotely…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T03:02:05.624Z. Updated 2025-10-11T21:13:14.253Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated12 Oct 2025, 04:13 WIB

Official record

MedPublished 27 Jul 2025, 09:02 WIB

CVE-2025-8219

Shanghai Lingdang Information Technology Lingdang CRM HTTP POST Request tabdetail_moduleSave_dxkp.php sql injection

A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.4.7. It has been rated as critical. This issue affects some unknown processing of the file /crm/crmapi/erp/tabdetail_moduleSave_dxkp.php of the component HTTP POST Request Handler. The manipulation of the argument getvaluestrin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T02:02:04.860Z. Updated 2025-07-28T15:02:02.129Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:02 WIB

Official record

UnscoredPublished 27 Jul 2025, 07:46 WIB

CVE-2025-6241

CVE-2025-6241

LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation. If a user-writable directory is present in the SYSTEM PATH environment variable, the user can write a malicious DLL to that directory with arbitrary code. This malicious DL…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:46:41.118Z. Updated 2025-11-03T20:06:53.132Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:06 WIB

Official record

MedPublished 27 Jul 2025, 07:00 WIB

CVE-2023-53156

CVE-2023-53156

The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T15:15:28.514Z.

CVSS4.5v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:15 WIB

Official record

MedPublished 27 Jul 2025, 07:00 WIB

CVE-2023-53157

CVE-2023-53157

The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T15:03:12.080Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:03 WIB

Official record

LowPublished 27 Jul 2025, 07:00 WIB

CVE-2024-58261

CVE-2024-58261

The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" messages for RawCertParser operations that encounter an unsupported primary key type.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T18:55:28.197Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 01:55 WIB

Official record

LowPublished 27 Jul 2025, 07:00 WIB

CVE-2024-58262

CVE-2024-58262

The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T18:55:22.149Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 01:55 WIB

Official record

LowPublished 27 Jul 2025, 07:00 WIB

CVE-2024-58263

CVE-2024-58263

The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T18:55:15.988Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 01:55 WIB

Official record

LowPublished 27 Jul 2025, 07:00 WIB

CVE-2024-58264

CVE-2024-58264

The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data.

Excerpt language: en.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T15:06:17.073Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:06 WIB

Official record

LowPublished 27 Jul 2025, 07:00 WIB

CVE-2024-58265

CVE-2024-58265

The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T15:05:47.523Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:05 WIB

Official record

LowPublished 27 Jul 2025, 07:00 WIB

CVE-2024-58266

CVE-2024-58266

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

Excerpt language: en.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T15:03:56.004Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:03 WIB

Official record

HighPublished 27 Jul 2025, 07:00 WIB

CVE-2025-54597

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-27T00:00:00.000Z. Updated 2025-07-28T18:55:34.203Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Jul 2025, 01:55 WIB

Official record

MedPublished 27 Jul 2025, 04:02 WIB

CVE-2025-8211

Roothub SystemConfigAdminController.java edit cross site scripting

A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/java/cn/roothub/web/admin/SystemConfigAdminController.java. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-26T21:02:05.372Z. Updated 2025-07-28T16:46:22.870Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 23:46 WIB

Official record

MedPublished 27 Jul 2025, 03:32 WIB

CVE-2025-8210

Yeelink Yeelight App com.yeelight.cherry AndroidManifest.xml improper export of android application components

A vulnerability was found in Yeelink Yeelight App up to 3.5.4 on Android. It has been classified as problematic. Affected is an unknown function of the file AndroidManifest.xml of the component com.yeelight.cherry. The manipulation leads to improper export of android application components. Attacking locally is a requi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-26T20:32:05.177Z. Updated 2025-07-28T15:15:18.296Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:15 WIB

Official record

MedPublished 27 Jul 2025, 03:02 WIB

CVE-2025-8207

Canara ai1 Mobile Banking App com.canarabank.mobility AndroidManifest.xml improper export of android application components

A vulnerability was found in Canara ai1 Mobile Banking App 3.6.23 on Android and classified as problematic. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.canarabank.mobility. The manipulation leads to improper export of android application components. Local access is re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-26T20:02:05.807Z. Updated 2025-07-28T15:14:42.271Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated28 Jul 2025, 22:14 WIB

Official record