Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 961–980 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25152

Ecessa Edge EV150 10.7.4 Cross-Site Request Forgery via User Configuration

Ecessa Edge EV150 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a form that submits requests to the /cgi-bin/pl_web.cgi/util_configlogin_act endpoint to add superuser accounts …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:52.680Z. Updated 2025-12-24T20:24:45.919Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:24 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25151

Ecessa WANWorx WVR-30 < 10.7.4 Cross-Site Request Forgery via User Configuration

Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an authenticated administrator int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 961 to 980 of 5493.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:52.222Z. Updated 2025-12-24T20:24:53.133Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:24 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25150

Ecessa ShieldLink SL175EHQ 10.7.4 Cross-Site Request Forgery via User Configuration

Ecessa ShieldLink SL175EHQ 10.7.4 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without authentication. Attackers can craft a malicious web page with a hidden form to add a superuser account by tricking a logged-in administrator into loading the page.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:51.814Z. Updated 2026-03-05T12:02:14.314Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25149

Microhard Systems IPn4G 1.1.0 Cross-Site Request Forgery via Web Interface

Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated users into loading a spec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:51.383Z. Updated 2026-01-26T15:55:00.365Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Jan 2026, 22:55 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25148

Microhard Systems IPn4G 1.1.0 Remote Code Execution via Admin Interface

Microhard Systems IPn4G 1.1.0 contains multiple authenticated remote code execution vulnerabilities in the admin interface that allow attackers to create crontab jobs and modify system startup scripts. Attackers can exploit hidden admin features to execute arbitrary commands with root privileges, including starting ser…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:50.947Z. Updated 2025-12-24T20:25:14.760Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:25 WIB

Official record

CritPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25147

Microhard Systems IPn4G 1.1.0 Default Credentials Authentication Bypass

Microhard Systems IPn4G 1.1.0 contains hardcoded default credentials that cannot be changed through normal gateway operations. Attackers can exploit these default credentials to gain unauthorized root-level access to the device by logging in with predefined username and password combinations.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:50.490Z. Updated 2026-07-28T01:46:38.296Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25146

Microhard Systems IPn4G 1.1.0 Service Control Denial of Service

Microhard Systems IPn4G 1.1.0 contains an undocumented vulnerability that allows authenticated attackers to list and manipulate running system processes. Attackers can send arbitrary signals to kill background processes and system services through a hidden feature, potentially causing service disruption and requiring d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:50.006Z. Updated 2026-02-02T15:58:16.121Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated02 Feb 2026, 22:58 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25145

Microhard Systems IPn4G 1.1.0 Configuration Disclosure via Authenticated Download

Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configuration files. Attackers can retrieve configuration files from multiple directories including '/www', '/etc/m_cli/', and '/tmp' to access system passwords and netwo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:49.597Z. Updated 2026-07-28T01:46:37.632Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25144

Microhard Systems IPn4G 1.1.0 Arbitrary File Access via Undocumented System Editor

Microhard Systems IPn4G 1.1.0 contains an authentication bypass vulnerability in the hidden system-editor.sh script that allows authenticated attackers to read, modify, or delete arbitrary files. Attackers can exploit unsanitized 'path', 'savefile', 'edit', and 'delfile' parameters to perform unauthorized file system m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:49.167Z. Updated 2026-02-02T15:58:15.790Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Feb 2026, 22:58 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25143

Microhard Systems IPn4G 1.1.0 Backdoor Jailbreak via Microhard Sh Service

Microhard Systems IPn4G 1.1.0 contains a service vulnerability that allows authenticated users to enable a restricted SSH shell with a default 'msshc' user. Attackers can exploit a custom 'ping' command in the NcFTP environment to escape the restricted shell and execute commands with root privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:48.742Z. Updated 2025-12-24T20:25:48.441Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:25 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25142

NovaRad NovaPACS Diagnostics Viewer 8.5 XML External Entity Injection

NovaRad NovaPACS Diagnostics Viewer 8.5.19.75 contains an unauthenticated XML External Entity (XXE) injection vulnerability in XML preference import settings. Attackers can craft malicious XML files with DTD parameter entities to retrieve arbitrary system files through an out-of-band channel attack.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:48.350Z. Updated 2026-07-28T01:46:36.954Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25141

FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated RTSP Stream Disclosure

FLIR thermal traffic cameras contain an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly retrieve video streams by accessing specific endpoints like /live.mjpeg, /snapshot.jpg, and RTSP streaming URLs without authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:47.928Z. Updated 2026-03-05T12:02:13.472Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Mar 2026, 19:02 WIB

Official record

CritPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25140

FLIR Thermal Traffic Cameras V1.01-0bb5b27 Unauthenticated Websocket Device Manipulation

FLIR thermal traffic cameras contain an unauthenticated device manipulation vulnerability in their WebSocket implementation that allows attackers to bypass authentication and authorization controls. Attackers can directly modify device configurations, access system information, and potentially initiate denial of servic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:47.524Z. Updated 2025-12-24T20:26:09.413Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:26 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25139

FLIR AX8 Thermal Camera 1.32.16 Unauthenticated RTSP Stream Disclosure

FLIR AX8 Thermal Camera 1.32.16 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can directly connect to the RTSP stream using tools like VLC or FFmpeg to view and record thermal camera footage.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:47.117Z. Updated 2026-10-01T19:19:02.555Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

CritPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25138

FLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass

FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. Attackers can exploit these persistent credentials to gain unauthorized shell access and login to multiple camera interfaces using predefined username and password combinations.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:46.730Z. Updated 2026-10-01T19:19:01.965Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25137

FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated Config File Disclosure

FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability in the ExportConfig REST API that allows attackers to download sensitive configuration files. Attackers can exploit the getConfigExportFile.cgi endpoint to retrieve system configurations, potentially enabling authentication bypass and privilege…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:46.300Z. Updated 2025-12-24T20:26:28.490Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:26 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25136

FLIR Brickstream 3D+ 2.1.742.1842 Unauthenticated RTSP Stream Disclosure

FLIR Brickstream 3D+ 2.1.742.1842 contains an unauthenticated vulnerability that allows remote attackers to access live video streams without credentials. Attackers can retrieve video stream images by directly accessing multiple image endpoints like middleImage.jpg, rightimage.jpg, and leftimage.jpg.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:45.779Z. Updated 2025-12-24T20:26:35.205Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:26 WIB

Official record

CritPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25135

Anviz AIM CrossChex Standard 4.3.6.0 CSV Injection via User Import

Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands by inserting malicious formulas in user import fields. Attackers can craft payloads in fields like 'Name', 'Gender', or 'Position' to trigger Excel macro execution when importing user data.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:45.375Z. Updated 2026-10-01T21:44:50.789Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 04:44 WIB

Official record

CritPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25134

Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass via webNewAcct.cgi

Synaccess netBooter NP-02x/NP-08x 6.8 contains an authentication bypass vulnerability in the webNewAcct.cgi script that allows unauthenticated attackers to create admin user accounts. Attackers can exploit the missing control check by sending crafted POST requests to create administrative accounts and gain unauthorized…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:44.967Z. Updated 2025-12-24T20:26:48.331Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:26 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25133

Synaccess netBooter NP-0801DU 7.4 Cross-Site Request Forgery via Admin Interface

Synaccess netBooter NP-0801DU 7.4 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages with hidden form submissions to add admin users by tricking authenticated administrators into loading a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:44.567Z. Updated 2025-12-24T20:26:55.174Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:26 WIB

Official record