Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 761–780 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-65442

CVE-2025-65442

DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information (e.g., user session cookies) via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage. The vulnerability …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-29T16:45:57.333Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:45 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-65570

CVE-2025-65570

A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode. When an “instanceof” expression uses an array element access as the left-hand operand inside a for-in loop, the instructions implementation leaves an additional array reference on the stack rather than consuming it durin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 761 to 780 of 5493.First page Next page

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-31T16:59:28.908Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Dec 2025, 23:59 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66861

CVE-2025-66861

An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of service via crafted PE file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-31T16:59:18.214Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Dec 2025, 23:59 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66862

CVE-2025-66862

A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-30T15:21:46.591Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Dec 2025, 22:21 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66863

CVE-2025-66863

An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-30T15:19:15.437Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Dec 2025, 22:19 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66864

CVE-2025-66864

An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2026-01-02T18:13:18.482Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jan 2026, 01:13 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66865

CVE-2025-66865

An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-30T15:20:39.997Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Dec 2025, 22:20 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66866

CVE-2025-66866

An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2026-01-02T18:12:35.702Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jan 2026, 01:12 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66869

CVE-2025-66869

Buffer overflow vulnerability in function strcat in asan_interceptors.cpp in libming 0.4.8.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-30T15:23:04.733Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Dec 2025, 22:23 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-66877

CVE-2025-66877

Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-30T15:24:13.771Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Dec 2025, 22:24 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-67254

CVE-2025-67254

NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-31T16:59:12.600Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Dec 2025, 23:59 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-67255

CVE-2025-67255

In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-31T16:59:06.948Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Dec 2025, 23:59 WIB

Official record

UnscoredPublished 29 Dec 2025, 07:00 WIB

CVE-2025-68706

CVE-2025-68706

A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-29T00:00:00.000Z. Updated 2025-12-31T16:59:00.763Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Dec 2025, 23:59 WIB

Official record

HighPublished 29 Dec 2025, 06:32 WIB

CVE-2025-15162

Tenda WH450 RouteStatic stack-based overflow

A vulnerability was determined in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/RouteStatic. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T23:32:08.620Z. Updated 2026-02-24T06:09:08.645Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:09 WIB

Official record

HighPublished 29 Dec 2025, 06:02 WIB

CVE-2025-15161

Tenda WH450 PPTPUserSetting stack-based overflow

A vulnerability was found in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/PPTPUserSetting. Performing a manipulation of the argument delno results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T23:02:08.101Z. Updated 2026-02-24T06:08:53.372Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:08 WIB

Official record

HighPublished 29 Dec 2025, 05:32 WIB

CVE-2025-15160

Tenda WH450 PPTPServer stack-based overflow

A vulnerability has been found in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/PPTPServer. Such manipulation of the argument ip1 leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T22:32:07.881Z. Updated 2026-02-24T06:08:38.595Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:08 WIB

Official record

MedPublished 29 Dec 2025, 05:02 WIB

CVE-2025-15156

omec-project UPF PFCP Session Establishment Request messages_session.go handleSessionEstablishmentRequest null pointer dereference

A flaw has been found in omec-project UPF up to 2.1.3-dev. This affects the function handleSessionEstablishmentRequest of the file /pfcpiface/pfcpiface/messages_session.go of the component PFCP Session Establishment Request Handler. This manipulation causes null pointer dereference. The attack may be initiated remotely…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T22:02:06.001Z. Updated 2025-12-29T16:08:01.587Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:08 WIB

Official record

MedPublished 29 Dec 2025, 04:32 WIB

CVE-2025-15155

floooh sokol sokol_gfx.h _sg_pipeline_desc_defaults stack-based overflow

A vulnerability was detected in floooh sokol up to 16cbcc864012898793cd2bc57f802499a264ea40. The impacted element is the function _sg_pipeline_desc_defaults in the library sokol_gfx.h. The manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T21:32:10.957Z. Updated 2025-12-29T14:43:28.566Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 21:43 WIB

Official record

MedPublished 29 Dec 2025, 04:02 WIB

CVE-2025-15154

PbootCMS Header handle.php get_user_ip less trusted source

A security vulnerability has been detected in PbootCMS up to 3.2.12. The affected element is the function get_user_ip of the file core/function/handle.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to use of less trusted source. The attack can be initiated remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T21:02:07.992Z. Updated 2026-02-24T06:08:24.576Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:08 WIB

Official record

MedPublished 29 Dec 2025, 03:32 WIB

CVE-2025-15153

PbootCMS SQLite Database pbootcms.db file access

A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T20:32:07.587Z. Updated 2026-02-24T06:08:08.429Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:08 WIB

Official record