Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 801–820 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

MedPublished 28 Dec 2025, 17:32 WIB

CVE-2025-15132

ZSPACE Z4Pro+ HTTP POST Request open zfilev2_api_open command injection

A vulnerability was determined in ZSPACE Z4Pro+ 1.0.0440024. The affected element is the function zfilev2_api_open of the file /v2/file/safe/open of the component HTTP POST Request Handler. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclose…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T10:32:05.208Z. Updated 2025-12-29T18:00:46.951Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 01:00 WIB

Official record

MedPublished 28 Dec 2025, 17:02 WIB

CVE-2025-15131

ZSPACE Z4Pro+ HTTP POST Request status zfilev2_api_SafeStatus command injection

A vulnerability was found in ZSPACE Z4Pro+ 1.0.0440024. Impacted is the function zfilev2_api_SafeStatus of the file /v2/file/safe/status of the component HTTP POST Request Handler. The manipulation results in command injection. The attack may be performed from remote. The exploit has been made public and could be used.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 801 to 820 of 5493.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T10:02:06.337Z. Updated 2025-12-29T18:01:13.797Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 01:01 WIB

Official record

MedPublished 28 Dec 2025, 16:32 WIB

CVE-2025-15130

shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection

A vulnerability has been found in shanyu SyCms up to a242ef2d194e8bb249dc175e7c49f2c1673ec921. This issue affects the function addPost of the file Application/Admin/Controller/FileManageController.class.php of the component Administrative Panel. The manipulation leads to code injection. The attack is possible to be car…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T09:32:10.325Z. Updated 2025-12-29T18:01:53.351Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 01:01 WIB

Official record

MedPublished 28 Dec 2025, 16:02 WIB

CVE-2025-15129

ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection

A flaw has been found in ChenJinchuang Lin-CMS-TP5 up to 0.3.3. This vulnerability affects the function Upload of the file application/lib/file/LocalUploader.php of the component File Upload Handler. Executing manipulation of the argument File can lead to code injection. The attack can be executed remotely. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T09:02:10.127Z. Updated 2025-12-29T18:55:29.222Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 01:55 WIB

Official record

MedPublished 28 Dec 2025, 15:32 WIB

CVE-2025-15128

ZKTeco BioTime Endpoint safe_setting credentials storage

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. R…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T08:32:10.069Z. Updated 2026-06-11T07:14:44.030Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Jun 2026, 14:14 WIB

Official record

MedPublished 28 Dec 2025, 15:02 WIB

CVE-2025-15127

FantasticLBP Hotels_Server Room.php sql injection

A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown functionality of the file /controller/api/Room.php. Such manipulation of the argument hotelId leads to sql injection. The attack may be launched remotely. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T08:02:06.225Z. Updated 2025-12-29T16:02:17.068Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:02 WIB

Official record

LowPublished 28 Dec 2025, 14:32 WIB

CVE-2025-15126

JeecgBoot getPositionUserList improper authorization

A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexity of an attack is rath…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T07:32:06.264Z. Updated 2025-12-29T16:03:06.162Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:03 WIB

Official record

LowPublished 28 Dec 2025, 14:02 WIB

CVE-2025-15125

JeecgBoot queryDepartPermission improper authorization

A security flaw has been discovered in JeecgBoot up to 3.9.0. Affected is the function queryDepartPermission of the file /sys/permission/queryDepartPermission. The manipulation of the argument departId results in improper authorization. The attack can be launched remotely. This attack is characterized by high complexit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T07:02:06.680Z. Updated 2025-12-29T16:03:49.238Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:03 WIB

Official record

LowPublished 28 Dec 2025, 13:32 WIB

CVE-2025-15124

JeecgBoot list getParameterMap improper authorization

A vulnerability was identified in JeecgBoot up to 3.9.0. This impacts the function getParameterMap of the file /sys/sysDepartPermission/list. The manipulation of the argument departId leads to improper authorization. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T06:32:06.920Z. Updated 2025-12-29T16:04:32.586Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:04 WIB

Official record

LowPublished 28 Dec 2025, 13:02 WIB

CVE-2025-15123

JeecgBoot datarule improper authorization

A vulnerability was determined in JeecgBoot up to 3.9.0. This affects an unknown function of the file /sys/sysDepartPermission/datarule/. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitability is reporte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T06:02:05.781Z. Updated 2025-12-29T16:05:08.309Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:05 WIB

Official record

LowPublished 28 Dec 2025, 12:02 WIB

CVE-2025-15122

JeecgBoot datarule loadDatarule improper authorization

A vulnerability was found in JeecgBoot up to 3.9.0. The impacted element is the function loadDatarule of the file /sys/sysDepartRole/datarule/. Performing manipulation of the argument departId/roleId results in improper authorization. It is possible to initiate the attack remotely. The attack is considered to have high…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T05:02:05.798Z. Updated 2025-12-29T16:42:57.874Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:42 WIB

Official record

MedPublished 28 Dec 2025, 11:32 WIB

CVE-2025-15121

JeecgBoot getDeptRoleByUserId information disclosure

A vulnerability has been found in JeecgBoot up to 3.9.0. The affected element is the function getDeptRoleByUserId of the file /sys/sysDepartRole/getDeptRoleByUserId. Such manipulation of the argument departId leads to information disclosure. The vendor was contacted early about this disclosure but did not respond in an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T04:32:06.152Z. Updated 2025-12-29T16:41:44.256Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:41 WIB

Official record

LowPublished 28 Dec 2025, 11:02 WIB

CVE-2025-15120

JeecgBoot getDeptRoleList improper authorization

A flaw has been found in JeecgBoot up to 3.9.0. Impacted is the function getDeptRoleList of the file /sys/sysDepartRole/getDeptRoleList. This manipulation of the argument departId causes improper authorization. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T04:02:06.291Z. Updated 2025-12-29T16:40:55.481Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:40 WIB

Official record

LowPublished 28 Dec 2025, 10:32 WIB

CVE-2025-15119

JeecgBoot list queryPageList improper authorization

A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T03:32:06.719Z. Updated 2025-12-29T19:04:57.949Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 02:04 WIB

Official record

MedPublished 28 Dec 2025, 10:02 WIB

CVE-2025-15118

macrozheng mall Member Endpoint update improper authorization

A security vulnerability has been detected in macrozheng mall up to 1.0.3. This vulnerability affects unknown code of the file /member/address/update/ of the component Member Endpoint. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T03:02:05.540Z. Updated 2025-12-29T16:40:10.112Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:40 WIB

Official record

LowPublished 28 Dec 2025, 09:32 WIB

CVE-2025-15117

Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization

A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T02:32:05.652Z. Updated 2025-12-29T16:39:15.402Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:39 WIB

Official record

MedPublished 28 Dec 2025, 09:02 WIB

CVE-2025-15116

OpenCart Single-Use Coupon race condition

A security flaw has been discovered in OpenCart up to 4.1.0.3. Affected by this issue is some unknown functionality of the component Single-Use Coupon Handler. Performing a manipulation results in race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation is known t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-28T02:02:06.876Z. Updated 2026-02-24T06:06:09.491Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:06 WIB

Official record

MedPublished 28 Dec 2025, 05:52 WIB

CVE-2025-68972

CVE-2025-68972

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-27T22:52:30.957Z. Updated 2026-01-02T20:44:27.393Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated03 Jan 2026, 03:44 WIB

Official record

MedPublished 28 Dec 2025, 03:02 WIB

CVE-2025-15110

jackq XCMS Backend ProductImageController.class.php upload unrestricted upload

A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/ProductImageController.class.php of the component Backend. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-27T20:02:09.663Z. Updated 2026-02-24T06:05:58.343Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:05 WIB

Official record

MedPublished 28 Dec 2025, 02:33 WIB

CVE-2025-14177

Information Leak of Memory in getimagesize

In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-27T19:33:23.973Z. Updated 2025-12-29T16:01:36.231Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 23:01 WIB

Official record