Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 741–760 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

HighPublished 20 Nov 2025, 09:32 WIB

CVE-2025-13446

Tenda AC21 SetSysTimeCfg stack-based overflow

A vulnerability has been found in Tenda AC21 16.03.08.16. This vulnerability affects unknown code of the file /goform/SetSysTimeCfg. The manipulation of the argument timeZone/time leads to stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T02:32:07.969Z. Updated 2026-02-24T06:36:01.944Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:36 WIB

Official record

HighPublished 20 Nov 2025, 09:02 WIB

CVE-2025-13445

Tenda AC21 SetIpMacBind stack-based overflow

A flaw has been found in Tenda AC21 16.03.08.16. This affects an unknown part of the file /goform/SetIpMacBind. Executing a manipulation of the argument list can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 741 to 760 of 3020.First page Next page

Published 2025-11-20T02:02:09.585Z. Updated 2026-02-24T06:35:49.126Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:35 WIB

Official record

MedPublished 20 Nov 2025, 09:02 WIB

CVE-2025-13443

macrozheng mall delete access control

A vulnerability was detected in macrozheng mall up to 1.0.3. Affected by this issue is the function delete of the file /member/readHistory/delete. Performing manipulation of the argument ids results in improper access controls. Remote exploitation of the attack is possible. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T02:02:06.154Z. Updated 2025-11-20T14:52:21.901Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 21:52 WIB

Official record

MedPublished 20 Nov 2025, 08:32 WIB

CVE-2025-13442

UTT 进取 750W formPdbUpConfig system command injection

A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. Affected by this vulnerability is the function system of the file /goform/formPdbUpConfig. Such manipulation of the argument policyNames leads to command injection. The attack may be launched remotely. The exploit has been disclosed publicly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T01:32:07.186Z. Updated 2025-11-20T14:30:06.287Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 21:30 WIB

Official record

MedPublished 20 Nov 2025, 08:32 WIB

CVE-2025-13435

Dreampie Resty HttpClient HttpClient.java request path traversal

A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the component HttpClient Module. Such manipulation of the argument filename leads to path traversal. The attack may be pe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T01:32:04.986Z. Updated 2025-11-20T14:46:53.213Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 21:46 WIB

Official record

MedPublished 20 Nov 2025, 08:02 WIB

CVE-2025-13434

jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax

A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Util.php of the component HTTP Host Header Handler. This manipulation of the argument $_SERVER['HOST'] causes improper neutralization of http headers for scripting syntax. The attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T01:02:05.491Z. Updated 2025-11-20T15:07:06.733Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 22:07 WIB

Official record

HighPublished 20 Nov 2025, 07:32 WIB

CVE-2025-13433

Muse Group MuseHub Windows Service Muse.Updater.exe unquoted search path

A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Files\WindowsApps\Muse.MuseHub_2.1.0.1567_x64__rb9pth70m6nz6\Muse.Updater.exe of the component Windows Service. The manipulation results in unquoted search path. The attack is only po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:32:05.854Z. Updated 2025-11-20T15:30:36.998Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 22:30 WIB

Official record

MedPublished 20 Nov 2025, 07:02 WIB

CVE-2025-13424

Campcodes Supplier Management System add_product.php sql injection

A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.php. The manipulation of the argument txtProductName leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:02:06.927Z. Updated 2026-02-24T06:35:33.319Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:35 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-25613

CVE-2025-25613

FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for their web based administrative application containing usernames and passwords. These were transmitted in cleartext using simple base64 encodi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2026-07-05T16:10:53.365Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:10 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-52410

CVE-2025-52410

Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is not adequately sanitized before being used in SQL queries.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T15:33:46.399Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 22:33 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-60737

CVE-2025-60737

Cross Site Scripting vulnerability in Ilevia EVE X1 Server Firmware Version<= 4.7.18.0.eden:Logic Version<=6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /index.php component

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T16:05:13.316Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 23:05 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-60738

CVE-2025-60738

An issue in Ilevia EVE X1 Server Firmware Version v4.7.18.0.eden and before Logic Version v6.00 - 2025_07_21 and before allows a remote attacker to execute arbitrary code via the ping.php component does not perform secure filtering on IP parameters

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T15:35:29.362Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 22:35 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-60794

CVE-2025-60794

Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-20T21:25:10.102Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 04:25 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-60796

CVE-2025-60796

phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other unspeci…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T16:08:17.102Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 23:08 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-60797

CVE-2025-60797

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T15:38:33.842Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 22:38 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-60798

CVE-2025-60798

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL comman…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T15:38:02.007Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 22:38 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-60799

CVE-2025-60799

phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks. Attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-20T21:34:31.713Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 04:34 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-61138

CVE-2025-61138

Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T16:03:38.792Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 23:03 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-63685

CVE-2025-63685

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of system libraries. Specifically, the application does not validate the path or signature of [regsvr32.exe] it loads. An attacker can place a crafted malicious DLL in the application's startup directory, whi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T14:32:54.749Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 21:32 WIB

Official record

UnscoredPublished 20 Nov 2025, 07:00 WIB

CVE-2025-63807

CVE-2025-63807

An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (2025-01-13). A weak verification code generation mechanism combined with missing rate limiting allows attackers to perform brute-force attacks on verification codes without authentication. Successful …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-20T00:00:00.000Z. Updated 2025-11-21T14:39:39.545Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 21:39 WIB

Official record