Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 701–720 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

LowPublished 24 Sep 2025, 20:11 WIB

CVE-2025-23248

CVE-2025-23248

NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the nvdisasm binary where a user may cause an out-of-bounds read by passing a malformed ELF file to nvdisasm. A successful exploit of this vulnerability may lead to a partial denial of service.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T13:11:00.645Z. Updated 2025-09-24T18:43:08.882Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated25 Sep 2025, 01:43 WIB

Official record

HighPublished 24 Sep 2025, 20:02 WIB

CVE-2025-10906

Magnetism Studios Endurance NSXPC com.MagnetismStudios.endurance.helper loadModuleNamed:WithReply missing authentication

A flaw has been found in Magnetism Studios Endurance up to 3.3.0 on macOS. This affects the function loadModuleNamed:WithReply of the file /Applications/Endurance.app/Contents/Library/LaunchServices/com.MagnetismStudios.endurance.helper of the component NSXPC Interface. Executing manipulation can lead to missing authen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 701 to 720 of 4319.First page Next page

Published 2025-09-24T13:02:06.114Z. Updated 2025-09-24T18:42:31.453Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated25 Sep 2025, 01:42 WIB

Official record

MedPublished 24 Sep 2025, 19:27 WIB

CVE-2025-9353

Themify Builder <= 7.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T12:27:28.647Z. Updated 2026-04-08T16:52:22.072Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:52 WIB

Official record

CritPublished 24 Sep 2025, 18:18 WIB

CVE-2025-9054

MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Options Update via 'wcmlim_settings_ajax_handler'

The MultiLoca - WooCommerce Multi Locations Inventory Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'wcmlim_settings_ajax_handler' function in all versions up to, and including, 4.2.8. This makes it possi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T11:18:32.303Z. Updated 2026-04-08T16:58:46.200Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:58 WIB

Official record

UnscoredPublished 24 Sep 2025, 18:02 WIB

CVE-2025-39890

wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_service_ready_ext_event Currently, in ath12k_service_ready_ext_event(), svc_rdy_ext.mac_phy_caps is not freed in the failure case, causing a memory leak. The following trace is observed in kmemleak: unreferenc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T11:02:53.539Z. Updated 2026-05-11T21:38:24.347Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:38 WIB

Official record

HighPublished 24 Sep 2025, 18:02 WIB

CVE-2025-39889

Bluetooth: l2cap: Check encryption key size on incoming connection

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: Check encryption key size on incoming connection This is required for passing GAP/SEC/SEM/BI-04-C PTS test case: Security Mode 4 Level 4, Responder - Invalid Encryption Key Size - 128 bit This tests the security key with size f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T11:02:51.036Z. Updated 2026-08-05T12:05:55.274Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:05 WIB

Official record

HighPublished 24 Sep 2025, 18:02 WIB

CVE-2024-58241

Bluetooth: hci_core: Disable works on hci_unregister_dev

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Disable works on hci_unregister_dev This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T11:02:49.948Z. Updated 2026-08-05T11:47:51.227Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:47 WIB

Official record

UnscoredPublished 24 Sep 2025, 16:29 WIB

CVE-2025-58457

Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Improper permission check in ZooKeeper AdminServer lets authorized clients to run snapshot and restore command with insufficient permissions. This issue affects Apache ZooKeeper: from 3.9.0 before 3.9.4. Users are recommended to upgrade to version 3.9.4, which fixes the issue. The issue can be mitigated by disabling…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T09:29:35.824Z. Updated 2025-11-04T21:13:42.037Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:13 WIB

Official record

MedPublished 24 Sep 2025, 16:04 WIB

CVE-2025-41716

Unauthenticated User Enumeration via Missing Authentication

The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T09:04:33.971Z. Updated 2025-09-24T13:03:53.265Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated24 Sep 2025, 20:03 WIB

Official record

CritPublished 24 Sep 2025, 16:04 WIB

CVE-2025-41715

Missing Authentication for Database Access in Web Application

The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T09:04:22.835Z. Updated 2025-09-24T13:07:30.391Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated24 Sep 2025, 20:07 WIB

Official record

MedPublished 24 Sep 2025, 15:25 WIB

CVE-2025-9031

Timing-Based Username Enumeration in DivvyDrive Information Technologies' DivvyDrive Web

Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. This issue affects DivvyDrive Web: from 4.8.2.2 before 4.8.2.15.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T08:25:49.377Z. Updated 2026-06-05T11:15:33.118Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 18:15 WIB

Official record

UnscoredPublished 24 Sep 2025, 14:59 WIB

CVE-2025-48392

Apache IoTDB: DoS Vulnerability

A vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4. Users are recommended to upgrade to version 2.0.5, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T07:59:52.592Z. Updated 2025-11-04T21:11:04.278Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:11 WIB

Official record

UnscoredPublished 24 Sep 2025, 14:57 WIB

CVE-2025-48459

Apache IoTDB: Deserialization of untrusted Data

Deserialization of Untrusted Data vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 2.0.5. Users are recommended to upgrade to version 2.0.5, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T07:57:24.444Z. Updated 2025-11-04T21:11:05.598Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:11 WIB

Official record

HighPublished 24 Sep 2025, 13:42 WIB

CVE-2025-58319

File Parsing Memory Corruption in CNCSoft-G2

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T06:42:08.525Z. Updated 2025-09-24T13:10:05.302Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Sep 2025, 20:10 WIB

Official record

HighPublished 24 Sep 2025, 13:38 WIB

CVE-2025-58317

File Parsing Memory Corruption in CNCSoft-G2

Delta Electronics CNCSoft-G2 lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T06:38:43.161Z. Updated 2026-03-18T05:26:08.198Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated18 Mar 2026, 12:26 WIB

Official record

MedPublished 24 Sep 2025, 08:37 WIB

CVE-2025-43819

CVE-2025-43819

A Insufficient Session Expiration vulnerability in the Liferay Portal 7.4.3.121 through 7.3.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, and 2024.Q1.1 through 2024.Q1.12 is allow an remote non-authenticated attacker to reuse old user session by SLO API

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T01:37:03.396Z. Updated 2025-09-24T13:14:12.135Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Sep 2025, 20:14 WIB

Official record

MedPublished 24 Sep 2025, 07:56 WIB

CVE-2025-43779

CVE-2025-43779

A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_commerce_product_definitions_web_internal_portlet_CPDefinitionsP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T00:56:37.951Z. Updated 2025-09-24T14:16:07.518Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Sep 2025, 21:16 WIB

Official record

UnscoredPublished 24 Sep 2025, 07:00 WIB

CVE-2025-56241

CVE-2025-56241

Aztech DSL5005EN firmware 1.00.AZ_2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted POST request to sysAccess.asp. This allows full administrative control of the router without authentication.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T00:00:00.000Z. Updated 2025-11-17T18:31:46.604Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:31 WIB

Official record

UnscoredPublished 24 Sep 2025, 07:00 WIB

CVE-2025-56815

CVE-2025-56815

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal in the POST /viz/image interface, since the server directly uses MultipartFile.transferTo() to save the uploaded file to a path controllable by the user, and lacks strict verification of the file name.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T00:00:00.000Z. Updated 2025-09-24T17:23:05.934Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2025, 00:23 WIB

Official record

UnscoredPublished 24 Sep 2025, 07:00 WIB

CVE-2025-56816

CVE-2025-56816

Datart 1.0.0-rc.3 is vulnerable to Directory Traversal. The configuration file handling of the application allows attackers to upload arbitrary YAML files to the config/jdbc-driver-ext.yml path. The application parses this file using SnakeYAML's unsafe load() or loadAs() method without input sanitization. This allows d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T00:00:00.000Z. Updated 2025-09-24T17:18:26.606Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Sep 2025, 00:18 WIB

Official record