Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 3,673 published records · 15 KEV · 3,673 with a forecast · 0 unknown dates
3,673 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.41% · forecast 100% · unscored 36%.
CVE-2025-25723
Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-28T00:00:00.000Z. Updated 2025-04-03T18:56:46.496Z.
CVE-2025-25916
wuzhicms v4.1.0 has a Cross Site Scripting (XSS) vulnerability in del function in \coreframe\app\member\admin\group.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-28T00:00:00.000Z. Updated 2025-02-28T15:59:39.952Z.
CVE-2025-26047
Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-28T00:00:00.000Z. Updated 2025-03-06T20:44:28.522Z.
CVE-2025-26263
GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-28T00:00:00.000Z. Updated 2025-03-19T13:33:50.507Z.
CVE-2025-26326
A vulnerability was identified in the NVDA Remote (version 2.6.4) and Tele NVDA Remote (version 2025.3.3) remote connection add-ons, which allows an attacker to obtain total control of the remote system by guessing a weak password. The problem occurs because these add-ons accept any password entered by the user and do …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-28T00:00:00.000Z. Updated 2025-03-13T15:22:13.886Z.
Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.9 via shortcodes. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP cod…
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T23:22:40.122Z. Updated 2026-04-08T17:12:14.398Z.
Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile
The Cardealer theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.4. This is due to missing nonce validation on the 'update_user_profile' function. This makes it possible for unauthenticated attackers to update the user email and password via a forged request, granted t…
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T23:22:39.776Z. Updated 2026-04-08T16:57:12.337Z.
Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation
The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'save_settings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user role.
Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T23:22:39.410Z. Updated 2026-04-08T16:51:41.160Z.
Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files
The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-l…
Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T23:22:38.865Z. Updated 2026-04-08T16:47:50.849Z.
CVE-2025-24832
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) be…
Severity medium: primary CNA CVSS 4.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T23:00:16.679Z. Updated 2025-02-28T15:00:45.368Z.
gpu: host1x: Fix a use of uninitialized mutex
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix a use of uninitialized mutex commit c8347f915e67 ("gpu: host1x: Fix boot regression for Tegra") caused a use of uninitialized mutex leading to below warning when CONFIG_DEBUG_MUTEXES and CONFIG_DEBUG_LOCK_ALLOC are enabled. [ 41.6…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:06:14.720Z. Updated 2026-05-11T21:07:13.696Z.
batman-adv: Drop unmanaged ELP metric worker
In the Linux kernel, the following vulnerability has been resolved: batman-adv: Drop unmanaged ELP metric worker The ELP worker needs to calculate new metric values for all neighbors "reachable" over an interface. Some of the used metric sources require locks which might need to sleep. This sleep is incompatible with…
Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:06:14.074Z. Updated 2026-08-05T11:54:41.091Z.
ptp: vmclock: Set driver data before its usage
In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: Set driver data before its usage If vmclock_ptp_register() fails during probing, vmclock_remove() is called to clean up the ptp clock and misc device. It uses dev_get_drvdata() to access the vmclock state. However the driver data is not…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:06:13.422Z. Updated 2026-05-11T21:07:11.422Z.
fbdev: omap: use threaded IRQ for LCD DMA
In the Linux kernel, the following vulnerability has been resolved: fbdev: omap: use threaded IRQ for LCD DMA When using touchscreen and framebuffer, Nokia 770 crashes easily with: BUG: scheduling while atomic: irq/144-ads7846/82/0x00010000 Modules linked in: usb_f_ecm g_ether usb_f_rndis u_ether libcomposit…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:06:12.722Z. Updated 2026-05-11T21:07:10.276Z.
tty: xilinx_uartps: split sysrq handling
In the Linux kernel, the following vulnerability has been resolved: tty: xilinx_uartps: split sysrq handling lockdep detects the following circular locking dependency: CPU 0 CPU 1 ========================== ============================ cdns_uart_isr() printk() uart_port_lock(port) …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:04:17.930Z. Updated 2026-05-11T21:07:09.122Z.
Revert "drm/amd/display: Use HW lock mgr for PSR1"
In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd/display: Use HW lock mgr for PSR1" This reverts commit a2b5a9956269 ("drm/amd/display: Use HW lock mgr for PSR1") Because it may cause system hang while connect with two edp panel.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:04:17.284Z. Updated 2026-05-23T15:57:16.241Z.
block: mark GFP_NOIO around sysfs ->store()
In the Linux kernel, the following vulnerability has been resolved: block: mark GFP_NOIO around sysfs ->store() sysfs ->store is called with queue freezed, meantime we have several ->store() callbacks(update_nr_requests, wbt, scheduler) to allocate memory with GFP_KERNEL which may run into direct reclaim code path, t…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:04:15.988Z. Updated 2026-09-07T15:44:41.250Z.
hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING
In the Linux kernel, the following vulnerability has been resolved: hrtimers: Force migrate away hrtimers queued after CPUHP_AP_HRTIMERS_DYING hrtimers are migrated away from the dying CPU to any online target at the CPUHP_AP_HRTIMERS_DYING stage in order not to delay bandwidth timers handling tasks involved in the C…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:04:15.356Z. Updated 2026-05-23T15:57:15.174Z.
mm/compaction: fix UBSAN shift-out-of-bounds warning
In the Linux kernel, the following vulnerability has been resolved: mm/compaction: fix UBSAN shift-out-of-bounds warning syzkaller reported a UBSAN shift-out-of-bounds warning of (1UL << order) in isolate_freepages_block(). The bogus compound_order can be any value because it is union with flags. Add back the MAX_P…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:04:14.733Z. Updated 2026-05-11T21:07:04.528Z.
ptp: Ensure info->enable callback is always set
In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences. Example of affected drivers: ptp_s390.c, ptp_vclock.c and …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-02-27T20:04:14.089Z. Updated 2026-10-15T01:04:34.817Z.