Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 781–800 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

MedPublished 25 Aug 2025, 10:02 WIB

CVE-2025-9405

Open5GS gmm-sm.c gmm_state_exception assertion

A security flaw has been discovered in Open5GS up to 2.7.5. The impacted element is the function gmm_state_exception of the file src/amf/gmm-sm.c. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited. The patch is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T03:02:08.364Z. Updated 2025-08-31T08:08:22.918Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2025, 15:08 WIB

Official record

MedPublished 25 Aug 2025, 09:32 WIB

CVE-2025-9404

Scada-LTS Folder pointHierarchySLTS cross site scripting

A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder Handler. The manipulation of the argument Title leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 781 to 800 of 3629.First page Next page

Published 2025-08-25T02:32:06.446Z. Updated 2025-08-25T16:40:58.638Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Aug 2025, 23:40 WIB

Official record

MedPublished 25 Aug 2025, 09:02 WIB

CVE-2025-9403

jqlang jq JSON jq_test.c run_jq_tests assertion

A vulnerability was determined in jqlang jq up to 1.6. Impacted is the function run_jq_tests of the file jq_test.c of the component JSON Parser. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. Other versions might be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T02:02:07.038Z. Updated 2025-08-25T16:48:14.466Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated25 Aug 2025, 23:48 WIB

Official record

MedPublished 25 Aug 2025, 08:32 WIB

CVE-2025-9402

HuangDou UTCMS Config update.php server-side request forgery

A vulnerability was found in HuangDou UTCMS 9. This issue affects some unknown processing of the file app/modules/ut-frame/admin/update.php of the component Config Handler. Performing manipulation of the argument UPDATEURL results in server-side request forgery. The attack is possible to be carried out remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T01:32:07.248Z. Updated 2025-08-25T20:30:20.427Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:30 WIB

Official record

MedPublished 25 Aug 2025, 08:02 WIB

CVE-2025-9401

HuangDou UTCMS Login login.php comparison

A vulnerability has been found in HuangDou UTCMS 9. This vulnerability affects unknown code of the file app/modules/ut-frame/admin/login.php of the component Login. Such manipulation of the argument code leads to incorrect comparison. The attack can be executed remotely. The attack requires a high level of complexity. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T01:02:08.708Z. Updated 2025-08-25T20:29:38.215Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:29 WIB

Official record

MedPublished 25 Aug 2025, 07:32 WIB

CVE-2025-9400

YiFang CMS P_file.php mergeMultipartUpload unrestricted upload

A flaw has been found in YiFang CMS up to 2.0.5. This affects the function mergeMultipartUpload of the file app/utils/base/plugin/P_file.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:32:06.112Z. Updated 2025-08-25T20:29:09.150Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:29 WIB

Official record

MedPublished 25 Aug 2025, 07:02 WIB

CVE-2025-9399

YiFang CMS L_tool.php sql injection

A vulnerability was detected in YiFang CMS up to 2.0.5. Affected by this issue is some unknown functionality of the file app/logic/L_tool.php. The manipulation of the argument new_url results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:02:05.588Z. Updated 2025-08-25T20:28:32.941Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:28 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2023-47799

CVE-2023-47799

Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images of other account holders because the cache is not cleared aft…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-25T20:39:28.708Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:39 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2024-39923

CVE-2024-39923

An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to be vulnerable to Cross Site Scripting (XSS) due to not sanitising the values. These links can only be set up by an admin but are clickable by any logged-in person.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-25T20:38:16.248Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:38 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2024-46412

CVE-2024-46412

Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-location.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T15:54:16.529Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:54 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2024-46413

CVE-2024-46413

Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RBStoreController#loadDataIndex method.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T15:24:05.619Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:24 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29420

CVE-2025-29420

PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T13:31:46.553Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 20:31 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29421

CVE-2025-29421

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T15:49:33.545Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:49 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29514

CVE-2025-29514

Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to download the configuration file via providing a crafted web request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-25T19:14:36.934Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 02:14 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29515

CVE-2025-29515

Incorrect access control in the DELT_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modify arbitrary settings within the device's XML database, including the administrator’s password.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-25T20:00:04.005Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:00 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29516

CVE-2025-29516

D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the backup function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-25T20:05:17.196Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 03:05 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29517

CVE-2025-29517

D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T18:38:36.865Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 01:38 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29519

CVE-2025-29519

A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to execute arbitrary commands via supplying a crafted GET request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T15:20:22.874Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 22:20 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29520

CVE-2025-29520

Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attackers with low-level privileges to arbitrarily change the high-privileged account passwords and escalate privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T16:02:10.244Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 23:02 WIB

Official record

UnscoredPublished 25 Aug 2025, 07:00 WIB

CVE-2025-29521

CVE-2025-29521

Insecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to escalate privileges via a bruteforce attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-25T00:00:00.000Z. Updated 2025-08-26T16:01:12.777Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Aug 2025, 23:01 WIB

Official record