Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 661–680 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

MedPublished 26 Aug 2025, 09:02 WIB

CVE-2025-9439

1000projects Online Project Report Submission and Evaluation System edit_faculty.php cross site scripting

A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is an unknown functionality of the file /rse/admin/edit_faculty.php?id=2. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T02:02:06.545Z. Updated 2025-08-26T18:03:41.426Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 01:03 WIB

Official record

HighPublished 26 Aug 2025, 08:42 WIB

CVE-2025-8447

Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 661 to 680 of 3629.First page Next page

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T01:42:37.424Z. Updated 2025-08-26T18:34:59.232Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 01:34 WIB

Official record

MedPublished 26 Aug 2025, 08:32 WIB

CVE-2025-9438

1000projects Online Project Report Submission and Evaluation System add_student.php cross site scripting

A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected is an unknown function of the file /admin/add_student.php. The manipulation of the argument address results in cross site scripting. The attack can be executed remotely. The exploit has been released…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T01:32:06.812Z. Updated 2025-08-26T18:57:27.627Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 01:57 WIB

Official record

MedPublished 26 Aug 2025, 08:02 WIB

CVE-2025-9434

1000projects Online Project Report Submission and Evaluation System edit_title.php cross site scripting

A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/edit_title.php?id=1. Executing manipulation of the argument desc can lead to cross site scripting. The attack may be launched remotely. The exploit has been publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T01:02:14.589Z. Updated 2025-09-05T17:10:18.538Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated06 Sep 2025, 00:10 WIB

Official record

MedPublished 26 Aug 2025, 08:02 WIB

CVE-2025-9433

mtons mblog Admin Panel list cross site scripting

A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Performing manipulation of the argument Name results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T01:02:12.291Z. Updated 2025-08-26T20:25:03.194Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 03:25 WIB

Official record

MedPublished 26 Aug 2025, 07:32 WIB

CVE-2025-9432

mtons mblog Admin Panel list cross site scripting

A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Panel. Such manipulation of the argument Title leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:32:09.602Z. Updated 2025-08-26T20:24:22.961Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 03:24 WIB

Official record

MedPublished 26 Aug 2025, 07:02 WIB

CVE-2025-9431

mtons mblog search cross site scripting

A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:02:15.323Z. Updated 2025-08-26T20:23:35.024Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 03:23 WIB

Official record

MedPublished 26 Aug 2025, 07:02 WIB

CVE-2025-9430

mtons mblog update cross site scripting

A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the argument input results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:02:10.350Z. Updated 2025-08-26T20:22:39.422Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Aug 2025, 03:22 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2024-35203

CVE-2024-35203

Mahara before 22.10.6, 23.04.6, and 24.04.1 allows cross-site scripting (XSS) via a file, with JavaScript code as part of its name, that is uploaded via the Mahara filebrowser system.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:00:55.395Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:00 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2024-39335

CVE-2024-39335

Supported versions of Mahara 24.04 before 24.04.1 and 23.04 before 23.04.6 are vulnerable to information being disclosed to an institution administrator under certain conditions via the 'Current submissions' page: Administration -> Groups -> Submissions.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:18:59.538Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:18 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2024-45753

CVE-2024-45753

In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-26T15:28:07.916Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:28 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2024-47192

CVE-2024-47192

An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have permission to download.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T16:22:16.133Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 23:22 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2024-47853

CVE-2024-47853

An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning Tools Interoperability (LTI).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-09-22T15:34:08.992Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Sep 2025, 22:34 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-25732

CVE-2025-25732

Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-10-22T14:55:34.618Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2025, 21:55 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-25733

CVE-2025-25733

Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of the device.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-10-22T14:55:49.842Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2025, 21:55 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-25734

CVE-2025-25734

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-10-22T14:58:01.209Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2025, 21:58 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-25735

CVE-2025-25735

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-10-22T14:58:09.571Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2025, 21:58 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-25736

CVE-2025-25736

Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-10-22T14:57:06.037Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2025, 21:57 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-25737

CVE-2025-25737

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User accounts, allowing attackers to bypass authentication via a bruteforce attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-10-22T14:56:53.275Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Oct 2025, 21:56 WIB

Official record

UnscoredPublished 26 Aug 2025, 07:00 WIB

CVE-2025-29992

CVE-2025-29992

Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-26T00:00:00.000Z. Updated 2025-08-27T14:21:02.217Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 21:21 WIB

Official record