Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 861–880 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

MedPublished 26 Dec 2025, 11:07 WIB

CVE-2025-52598

Insufficient certificate validation

Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has found a flaw that camera's client service does not perform certificate validation. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T04:07:19.958Z. Updated 2025-12-26T15:15:22.694Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated26 Dec 2025, 22:15 WIB

Official record

MedPublished 26 Dec 2025, 11:02 WIB

CVE-2025-15099

simstudioai sim CRON Secret internal.ts improper authentication

A vulnerability was identified in simstudioai sim up to 0.5.27. This vulnerability affects unknown code of the file apps/sim/lib/auth/internal.ts of the component CRON Secret Handler. The manipulation of the argument INTERNAL_API_SECRET leads to improper authentication. It is possible to initiate the attack remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 861 to 880 of 5493.First page Next page

Published 2025-12-26T04:02:07.111Z. Updated 2025-12-26T15:04:35.405Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Dec 2025, 22:04 WIB

Official record

MedPublished 26 Dec 2025, 10:58 WIB

CVE-2025-68945

CVE-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T03:58:46.724Z. Updated 2025-12-26T18:59:29.985Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 01:59 WIB

Official record

MedPublished 26 Dec 2025, 10:37 WIB

CVE-2025-68944

CVE-2025-68944

Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

Excerpt language: en.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T03:37:28.693Z. Updated 2025-12-26T19:28:23.900Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 02:28 WIB

Official record

MedPublished 26 Dec 2025, 10:19 WIB

CVE-2025-68943

CVE-2025-68943

Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T03:19:45.242Z. Updated 2025-12-26T19:28:57.206Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 02:28 WIB

Official record

MedPublished 26 Dec 2025, 10:02 WIB

CVE-2025-15098

YunaiV yudao-cloud Business Process Management BpmSyncHttpRequestTrigger server-side request forgery

A vulnerability was determined in YunaiV yudao-cloud up to 2025.11. This affects the function BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger of the component Business Process Management. Executing a manipulation of the argument url/header/body can lead to server-side request forgery. The attack may be performed from …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T03:02:06.492Z. Updated 2026-10-27T07:19:44.102Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 14:19 WIB

Official record

MedPublished 26 Dec 2025, 09:50 WIB

CVE-2025-68942

CVE-2025-68942

Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T02:50:35.144Z. Updated 2025-12-26T19:30:04.360Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 02:30 WIB

Official record

MedPublished 26 Dec 2025, 09:32 WIB

CVE-2025-15097

Alteryx Server status improper authentication

A vulnerability was found in Alteryx Server. Affected by this issue is some unknown functionality of the file /gallery/api/status/. Performing manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 2023…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T02:32:05.819Z. Updated 2025-12-26T19:30:52.340Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Dec 2025, 02:30 WIB

Official record

MedPublished 26 Dec 2025, 09:31 WIB

CVE-2025-68941

CVE-2025-68941

Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T02:31:59.031Z. Updated 2025-12-26T19:31:33.303Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 02:31 WIB

Official record

LowPublished 26 Dec 2025, 09:14 WIB

CVE-2025-68940

CVE-2025-68940

In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T02:14:52.076Z. Updated 2025-12-26T18:57:56.965Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 01:57 WIB

Official record

HighPublished 26 Dec 2025, 09:03 WIB

CVE-2025-68939

CVE-2025-68939

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T02:03:59.691Z. Updated 2025-12-26T18:57:27.065Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 01:57 WIB

Official record

MedPublished 26 Dec 2025, 09:02 WIB

CVE-2025-15095

postmanlabs httpbin core.py cross site scripting

A security vulnerability has been detected in postmanlabs httpbin up to 0.6.1. This affects an unknown function of the file httpbin-master/httpbin/core.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The project was infor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T02:02:07.191Z. Updated 2025-12-26T19:32:01.296Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated27 Dec 2025, 02:32 WIB

Official record

MedPublished 26 Dec 2025, 08:32 WIB

CVE-2025-15094

sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting

A weakness has been identified in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The impacted element is the function userLogin of the file src/main/java/com/flycms/web/front/UserController.java of the component User Login. Executing a manipulation of the argument redirectUrl can lead to cross site sc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T01:32:06.271Z. Updated 2026-02-24T06:05:18.380Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:05 WIB

Official record

MedPublished 26 Dec 2025, 08:19 WIB

CVE-2025-68938

CVE-2025-68938

Gitea before 1.25.2 mishandles authorization for deletion of releases.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T01:19:10.609Z. Updated 2025-12-26T18:53:35.494Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Dec 2025, 01:53 WIB

Official record

MedPublished 26 Dec 2025, 08:02 WIB

CVE-2025-15093

sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting

A security flaw has been discovered in sunkaifei FlyCMS up to abbaa5a8daefb146ad4d61027035026b052cb414. The affected element is an unknown function of the file src/main/java/com/flycms/web/system/IndexAdminController.java of the component Admin Login. Performing a manipulation of the argument redirectUrl results in cro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T01:02:06.516Z. Updated 2026-02-24T06:05:04.843Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:05 WIB

Official record

HighPublished 26 Dec 2025, 07:02 WIB

CVE-2025-15092

UTT 进取 512W ConfigExceptMSN strcpy buffer overflow

A vulnerability was identified in UTT 进取 512W up to 1.7.7-171114. Impacted is the function strcpy of the file /goform/ConfigExceptMSN. Such manipulation of the argument remark leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T00:02:06.954Z. Updated 2025-12-26T15:06:18.525Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Dec 2025, 22:06 WIB

Official record

UnscoredPublished 26 Dec 2025, 07:00 WIB

CVE-2024-29720

CVE-2024-29720

An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter video rendering function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T00:00:00.000Z. Updated 2025-12-26T16:26:04.772Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Dec 2025, 23:26 WIB

Official record

UnscoredPublished 26 Dec 2025, 07:00 WIB

CVE-2024-42718

CVE-2024-42718

A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T00:00:00.000Z. Updated 2025-12-27T15:33:42.308Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Dec 2025, 22:33 WIB

Official record

UnscoredPublished 26 Dec 2025, 07:00 WIB

CVE-2024-44065

CVE-2024-44065

Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T00:00:00.000Z. Updated 2025-12-26T18:35:58.415Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Dec 2025, 01:35 WIB

Official record

UnscoredPublished 26 Dec 2025, 07:00 WIB

CVE-2025-25341

CVE-2025-25341

A vulnerability exists in the libxmljs 1.0.11 when parsing a specially crafted XML document. Accessing the internal _ref property on entity_ref and entity_decl nodes causes a segmentation fault, potentially leading to a denial-of-service (DoS).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-26T00:00:00.000Z. Updated 2025-12-26T16:30:16.444Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Dec 2025, 23:30 WIB

Official record