Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,020 published records · 11 KEV · 3,020 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,020 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1755.8%
High79126%
Med1,18739%
Low1083.6%
None00.00%
Legacy00.00%
Unscored75925%

Matching records by UTC month

Nov 253,020

Signal coverage

KEV-listed: 11
With a forecast: 3,020
Unknown date: 0
Unscored severity: 759

Share of cohort: KEV 0.36% · forecast 100% · unscored 25%.

Showing 881–900 of 3,020By severity band: Critical · 9.0–10.0 175, High · 7.0–8.9 791, Medium · 4.0–6.9 1,187, Low · 0.1–3.9 108, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 759

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63213

CVE-2025-63213

The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpoint. An attacker can exploit this vulnerability by sending a specially crafted GET request with a malicious parameter to inject arbitrary comma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-21T15:55:29.978Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2025, 22:55 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63214

CVE-2025-63214

An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to delete and create arbitrary accounts.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-20T21:11:14.383Z.

Showing 881 to 900 of 3020.First page Next page

CVSS

—

KEVNot listed

EPSSPresent

Updated21 Nov 2025, 04:11 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63218

CVE-2025-63218

The Axel Technology WOLF1MS and WOLF2MS devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-19T15:14:03.256Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2025, 22:14 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63219

CVE-2025-63219

The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html endpoint. An attacker can access an active session without authentication, allowing them to control the device, modify configurations, and compromise system integrit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-19T21:36:02.845Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2025, 04:36 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63220

CVE-2025-63220

The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and repackaging the firmware.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-20T16:18:36.463Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2025, 23:18 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63221

CVE-2025-63221

The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings, leading to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-12-17T22:15:59.502Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Dec 2025, 05:15 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63223

CVE-2025-63223

The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint. Unauthenticated remote attackers can list user accounts, create new administrative users, delete users, and modify system settings…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-20T16:12:52.879Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2025, 23:12 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63224

CVE-2025-63224

The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-19T16:22:56.142Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:22 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63243

CVE-2025-63243

A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The sle_sSenha parameter to the loginAlterarSenha.asp file. An attacker can craft a malicious URL that, when visited by a victim, causes arbitrary JavaScript code to be executed in the victim'…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-19T15:43:58.358Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2025, 22:43 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63371

CVE-2025-63371

Milos Paripovic OneCommander 3.102.0.0 is vulnerable to Directory Traversal. The vulnerability resides in the ZIP file processing component, specifically in the functionality responsible for extracting and handling ZIP archive contents.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-20T14:51:13.478Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2025, 21:51 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63719

CVE-2025-63719

Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-20T14:49:47.493Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2025, 21:49 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63878

CVE-2025-63878

Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-19T21:37:00.790Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2025, 04:37 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63879

CVE-2025-63879

A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the id parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-19T16:31:45.278Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2025, 23:31 WIB

Official record

UnscoredPublished 19 Nov 2025, 07:00 WIB

CVE-2025-63932

CVE-2025-63932

D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary. The HNAP service provided by cgibin does not filter the HTTP SOAPAction header field. The unauthenticated remote attacker can execute the shell command.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-19T00:00:00.000Z. Updated 2025-11-20T15:39:00.429Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2025, 22:39 WIB

Official record

CritPublished 19 Nov 2025, 06:07 WIB

CVE-2025-65015

joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the ExceededSizeError exception messages are embedded with non-decoded JWT token parts and may cause Python logging to record…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-18T23:07:44.328Z. Updated 2025-11-19T17:12:04.336Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 00:12 WIB

Official record

MedPublished 19 Nov 2025, 06:02 WIB

CVE-2025-65093

LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was identified in the LibreNMS application at the /ajax_output.php endpoint. The hostname parameter is interpolated directly into an SQL query without proper sanitiza…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-18T23:02:04.572Z. Updated 2025-11-19T14:58:46.753Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated19 Nov 2025, 21:58 WIB

Official record

LowPublished 19 Nov 2025, 06:01 WIB

CVE-2025-65014

LibreNMS has Weak Password Policy

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a weak password policy vulnerability was identified in the user management functionality of the LibreNMS application. This vulnerability allows administrators to create accounts with extremely weak and predictable pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-18T23:01:40.005Z. Updated 2025-11-19T14:53:16.804Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated19 Nov 2025, 21:53 WIB

Official record

MedPublished 19 Nov 2025, 06:01 WIB

CVE-2025-65013

LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encodi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-18T23:01:21.659Z. Updated 2025-11-19T14:46:51.743Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated19 Nov 2025, 21:46 WIB

Official record

MedPublished 19 Nov 2025, 05:44 WIB

CVE-2025-65012

Kirby CMS has cross-site scripting (XSS) in the changes dialog

Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If ano…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-18T22:44:11.989Z. Updated 2025-11-19T17:06:24.803Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated20 Nov 2025, 00:06 WIB

Official record

MedPublished 19 Nov 2025, 05:39 WIB

CVE-2025-64515

Open Forms prefill data in read-only components can be tampered

Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data fields are dynamically set to readonly/disabled can be modified by malicious users deliberately trying to modify data they're not supposed to. For regular users, the form fields are marked as readonly…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-11-18T22:39:48.150Z. Updated 2025-11-19T17:01:01.839Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated20 Nov 2025, 00:01 WIB

Official record