Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 941–960 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25249

devolo dLAN 500 AV Wireless+ 3.1.0-1 Remote Code Execution via htmlmgr

devolo dLAN 500 AV Wireless+ 3.1.0-1 contains an authentication bypass vulnerability that allows attackers to enable hidden services through the htmlmgr CGI script. Attackers can enable telnet and remote shell services, reboot the device, and gain root access without a password by manipulating system configuration para…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:02.779Z. Updated 2025-12-24T20:22:26.831Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:22 WIB

Official record

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25248

Beward N100 M2.1.6 Unauthenticated RTSP Video Stream Disclosure

Beward N100 M2.1.6.04C014 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly retrieve the camera's RTSP stream by exploiting the lack of authentication in the video access mechanism.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 941 to 960 of 5493.First page Next page

Published 2025-12-24T19:28:02.157Z. Updated 2025-12-24T20:22:33.063Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:22 WIB

Official record

MedPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25247

Beward N100 H.264 VGA IP Camera M2.1.6 CSRF Add Admin Vulnerability

Beward N100 H.264 VGA IP Camera M2.1.6 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft a malicious web page with a hidden form to add an admin user by tricking a logged-in user into submitting the form.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:00.994Z. Updated 2025-12-24T20:22:39.710Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:22 WIB

Official record

HighPublished 25 Dec 2025, 02:28 WIB

CVE-2019-25246

Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'READ.filePath' parameter. Attackers can exploit the fileread script or SendCGICMD API to access sensitive files like /etc/passwd and /etc/issue by supplying absolu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:28:00.474Z. Updated 2025-12-24T20:22:45.916Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:22 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25245

Ross Video DashBoard 8.5.1 Privilege Escalation via Insecure Permissions

Ross Video DashBoard 8.5.1 contains an elevation of privileges vulnerability that allows authenticated users to modify executable files due to improper permission settings. Attackers can exploit the 'M' or 'C' flags for 'Authenticated Users' group to replace the DashBoard.exe binary with a malicious executable.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:59.816Z. Updated 2026-03-05T14:31:03.054Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 21:31 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25244

Legrand BTicino Driver Manager F454 1.0.51 CSRF and Stored XSS Vulnerabilities

Legrand BTicino Driver Manager F454 1.0.51 contains multiple web vulnerabilities that allow attackers to perform administrative actions without proper request validation. Attackers can exploit cross-site request forgery to change passwords and inject stored cross-site scripting payloads through unvalidated GET paramete…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:59.384Z. Updated 2025-12-24T20:22:58.420Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:22 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25243

FaceSentry 6.4.8 Authenticated Remote Command Injection via Ping Test

FaceSentry 6.4.8 contains an authenticated remote command injection vulnerability in pingTest.php and tcpPortTest.php scripts. Attackers can exploit unsanitized input parameters to inject and execute arbitrary shell commands with root privileges by manipulating the 'strInIP' and 'strInPort' parameters.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:58.965Z. Updated 2026-07-15T01:23:42.867Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25242

FaceSentry Access Control System 6.4.8 Cross-Site Request Forgery via Web Interface

FaceSentry Access Control System 6.4.8 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change administrator passwords, add new admin users, or open access control doors by tricking authenticated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:58.523Z. Updated 2026-03-05T12:02:17.563Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

CritPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25241

FaceSentry Access Control System 6.4.8 Remote SSH Root Access

FaceSentry Access Control System 6.4.8 contains a critical authentication vulnerability with hard-coded SSH credentials for the wwwuser account. Attackers can leverage the insecure sudoers configuration to escalate privileges and gain root access by executing sudo commands without authentication.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:58.126Z. Updated 2026-07-15T01:23:42.165Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25240

Rifatron 5brid DVR 5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504) Unauthenticated Live Stream Disclosure via animate.cgi

Rifatron 5brid DVR contains an unauthenticated vulnerability in the animate.cgi script that allows unauthorized access to live video streams. Attackers can exploit the Mobile Web Viewer module by specifying channel numbers to retrieve sequential video snapshots without authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:57.698Z. Updated 2025-12-24T20:23:25.132Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:23 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25239

V-SOL GPON/EPON OLT Platform 2.03 Unauthenticated Configuration Download

V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via direct object reference. Attackers can retrieve sensitive configuration data by sending HTTP GET requests to the usrcfg.conf endpoint, potentially enabling authent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:57.201Z. Updated 2025-12-24T20:23:32.107Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:23 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25238

V-SOL GPON/EPON OLT Platform 2.03 Cross-Site Request Forgery Vulnerability

V-SOL GPON/EPON OLT Platform 2.03 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to create admin users, enable SSH, or modify system settings by tricking authenticated administrators into loading a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:56.801Z. Updated 2025-12-24T20:23:38.963Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:23 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25237

V-SOL GPON/EPON OLT Platform 2.03 Privilege Escalation via User Role Parameter

V-SOL GPON/EPON OLT Platform v2.03 contains a privilege escalation vulnerability that allows normal users to gain administrative access by manipulating the user role parameter. Attackers can send a crafted HTTP POST request to the user management endpoint with 'user_role_mod' set to integer value '1' to elevate their p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:56.411Z. Updated 2025-12-24T20:23:45.916Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:23 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25236

iSeeQ Hybrid DVR WH-H4 1.03R Unauthenticated Live Stream Disclosure

iSeeQ Hybrid DVR WH-H4 1.03R contains an unauthenticated vulnerability in the get_jpeg script that allows unauthorized access to live video streams. Attackers can retrieve video snapshots from specific camera channels by sending requests to the /cgi-bin/get_jpeg endpoint without authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:55.979Z. Updated 2025-12-24T20:23:52.108Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:23 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25235

Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages

Smartwares HOME easy 1.0.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to access administrative web pages by disabling JavaScript. Attackers can navigate to multiple administrative endpoints and to bypass client-side validation and access sensitive system information.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:55.565Z. Updated 2026-03-05T12:02:16.765Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25234

Carlo Gavazzi SmartHouse Webapp 6.5.33 Cross-Site Request Forgery and XSS

SmartHouse Webapp 6.5.33 contains multiple cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform unauthorized actions. Attackers can exploit these vulnerabilities by tricking logged-in users into visiting malicious websites or injecting malicious scripts into various applic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:55.152Z. Updated 2025-12-24T20:24:05.780Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:24 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2019-25233

AVE DOMINAplus 1.10.x Cross-Site Request Forgery and XSS Vulnerabilities

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:54.735Z. Updated 2026-07-28T01:46:47.477Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25156

Teradek Cube 7.3.6 Cross-Site Request Forgery Password Change

Teradek Cube 7.3.6 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page with a hidden form to submit password change requests to the device's system configuration interface.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:54.324Z. Updated 2026-03-05T12:37:45.679Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:37 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25155

Teradek Slice 7.3.15 Cross-Site Request Forgery via Password Change

Teradek Slice 7.3.15 contains a cross-site request forgery vulnerability that allows attackers to change administrative passwords without proper request validation. Attackers can craft a malicious web page that automatically submits password change requests to the device when a logged-in user visits the page.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:53.919Z. Updated 2026-03-05T12:02:15.145Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25154

GNU Barcode 0.99 Buffer Overflow in Code 93 Encoding Mechanism

GNU Barcode 0.99 contains a buffer overflow vulnerability in its code 93 encoding process that allows attackers to trigger memory corruption. Attackers can exploit boundary errors during input file processing to potentially execute arbitrary code on the affected system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:53.486Z. Updated 2026-04-07T14:03:49.009Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record