Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 781–800 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

MedPublished 29 Dec 2025, 03:02 WIB

CVE-2025-15152

h-moses moga-mall PmsProductController.java addProduct unrestricted upload

A vulnerability was identified in h-moses moga-mall up to 392d631a5ef15962a9bddeeb9f1269b9085473fa. This vulnerability affects the function addProduct of the file src/main/java/com/ms/product/controller/PmsProductController.java. Such manipulation of the argument objectName leads to unrestricted upload. The attack may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T20:02:08.188Z. Updated 2025-12-29T15:50:24.977Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 22:50 WIB

Official record

MedPublished 29 Dec 2025, 02:32 WIB

CVE-2025-15151

TaleLin Lin-CMS Tests Folder config.py password in configuration file

A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0. This affects an unknown part of the file /tests/config.py of the component Tests Folder. This manipulation of the argument username/password causes password in configuration file. The attack is possible to be carried out remotely. The complexity of an attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 781 to 800 of 5493.First page Next page

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T19:32:05.944Z. Updated 2025-12-29T15:52:38.176Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 22:52 WIB

Official record

MedPublished 29 Dec 2025, 02:02 WIB

CVE-2025-15150

PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow

A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::state_listing/MavlinkLogHandler::log_entry_from_id of the file src/modules/mavlink/mavlink_log_handler.cpp. The manipulation results in stack-based buffer overflow. The attack is only possible with loc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T19:02:07.960Z. Updated 2025-12-29T16:08:11.074Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:08 WIB

Official record

MedPublished 29 Dec 2025, 01:32 WIB

CVE-2025-15149

rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting

A vulnerability has been found in rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded. Affected by this vulnerability is the function updateProductServlet of the file src/servlet/product/updateProductServlet.java of the component Add New Product Page. The manipulation of the argument productName leads to cross …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T18:32:06.054Z. Updated 2025-12-29T21:17:12.684Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 04:17 WIB

Official record

MedPublished 29 Dec 2025, 01:02 WIB

CVE-2025-15148

CmsEasy Backend Template Management template_admin.php savetemp_action code injection

A flaw has been found in CmsEasy up to 7.7.7. Affected is the function savetemp_action in the library /lib/admin/template_admin.php of the component Backend Template Management Page. Executing a manipulation of the argument content/tempdata can lead to code injection. The attack may be launched remotely. The exploit ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T18:02:08.178Z. Updated 2026-02-24T06:07:52.962Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:07 WIB

Official record

MedPublished 29 Dec 2025, 00:32 WIB

CVE-2025-15146

SohuTV CacheCloud UserManageController.java doUserList cross site scripting

A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This impacts the function doUserList of the file src/main/java/com/sohu/cache/web/controller/UserManageController.java. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be used.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T17:32:06.551Z. Updated 2025-12-29T21:25:59.423Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 04:25 WIB

Official record

MedPublished 29 Dec 2025, 00:02 WIB

CVE-2025-15145

SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting

A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. This affects the function doTotalList of the file src/main/java/com/sohu/cache/web/controller/TotalManageController.java. Such manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T17:02:05.970Z. Updated 2025-12-29T21:26:55.456Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 04:26 WIB

Official record

MedPublished 28 Dec 2025, 23:32 WIB

CVE-2025-15144

dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function dr_show_error/dr_exit_msg of the file /dayrui/Fcms/Init.php of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated remotely. The expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T16:32:07.116Z. Updated 2026-02-24T06:07:39.202Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:07 WIB

Official record

HighPublished 28 Dec 2025, 23:19 WIB

CVE-2025-68973

CVE-2025-68973

In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T16:19:11.019Z. Updated 2026-04-30T03:55:53.604Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated30 Apr 2026, 10:55 WIB

Official record

MedPublished 28 Dec 2025, 23:02 WIB

CVE-2025-15143

EyouCMS Backend Template Management FilemanagerLogic.php sql injection

A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.php of the component Backend Template Management. The manipulation of the argument content results in sql injection. It is possible to launch the attack remotely.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T16:02:08.347Z. Updated 2026-02-24T06:07:24.934Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:07 WIB

Official record

MedPublished 28 Dec 2025, 22:32 WIB

CVE-2025-15142

9786 phpok3w show.php sql injection

A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This produ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T15:32:12.734Z. Updated 2025-12-29T16:26:52.591Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:26 WIB

Official record

LowPublished 28 Dec 2025, 22:02 WIB

CVE-2025-15141

Halo Configuration actuator information disclosure

A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high complexity. The exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T15:02:05.484Z. Updated 2026-02-24T06:07:11.149Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:07 WIB

Official record

MedPublished 28 Dec 2025, 21:32 WIB

CVE-2025-15140

saiftheboss7 onlinemcqexam quesadd.php sql injection

A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada. This vulnerability affects unknown code of the file /admin/quesadd.php. Performing manipulation of the argument ans1/ans2 results in sql injection. The attack is possible to be carried out remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T14:32:06.750Z. Updated 2025-12-29T16:07:22.328Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:07 WIB

Official record

MedPublished 28 Dec 2025, 21:02 WIB

CVE-2025-15139

TRENDnet TEW-822DRE formWsc sub_43ACF4 command injection

A vulnerability has been found in TRENDnet TEW-822DRE 1.00B21/1.01B06. This affects the function sub_43ACF4 of the file /boafrm/formWsc. Such manipulation of the argument peerPin leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor wa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T14:02:07.407Z. Updated 2026-02-24T06:06:59.708Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:06 WIB

Official record

MedPublished 28 Dec 2025, 20:32 WIB

CVE-2025-15138

prasathmani TinyFileManager tinyfilemanager.php path traversal

A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T13:32:08.843Z. Updated 2025-12-29T16:40:10.063Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:40 WIB

Official record

HighPublished 28 Dec 2025, 20:02 WIB

CVE-2025-15137

TRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934 command injection

A vulnerability was detected in TRENDnet TEW-800MB 1.0.1.0. Affected by this vulnerability is the function sub_F934 of the file NTPSyncWithHost.cgi. The manipulation results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T13:02:05.931Z. Updated 2026-02-24T06:06:46.907Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:06 WIB

Official record

HighPublished 28 Dec 2025, 19:32 WIB

CVE-2025-15136

TRENDnet TEW-800MB Management wizardset do_setWizard_asp command injection

A security vulnerability has been detected in TRENDnet TEW-800MB 1.0.1.0. Affected is the function do_setWizard_asp of the file /goform/wizardset of the component Management Interface. The manipulation of the argument WizardConfigured leads to command injection. The attack may be initiated remotely. The exploit has bee…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T12:32:06.349Z. Updated 2026-02-24T06:06:34.391Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:06 WIB

Official record

MedPublished 28 Dec 2025, 19:02 WIB

CVE-2025-15135

joey-zhou xiaozhi-esp32-server-java Cookie AuthenticationInterceptor.java tryAuthenticateWithCookies improper authentication

A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file AuthenticationInterceptor.java of the component Cookie Handler. Executing manipulation can lead to improper authentication. The attack can be launched remotely. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T12:02:07.346Z. Updated 2025-12-29T17:58:51.665Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 00:58 WIB

Official record

MedPublished 28 Dec 2025, 18:32 WIB

CVE-2025-15134

yourmaileyes MOOC Submission MainController.java subreview cross site scripting

A security flaw has been discovered in yourmaileyes MOOC up to 1.17. This affects the function subreview of the file mooc/controller/MainController.java of the component Submission Handler. Performing manipulation of the argument review results in cross site scripting. The attack can be initiated remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T11:32:05.791Z. Updated 2025-12-29T17:59:32.211Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 00:59 WIB

Official record

MedPublished 28 Dec 2025, 18:02 WIB

CVE-2025-15133

ZSPACE Z4Pro+ HTTP POST Request close zfilev2_api_CloseSafe command injection

A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly availabl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T11:02:10.256Z. Updated 2025-12-29T18:00:13.048Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 01:00 WIB

Official record