Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 981–1000 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25131

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Stored XSS via Config Upload

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a stored cross-site scripting vulnerability in the configuration file upload functionality. Attackers can upload a malicious HTML file to that executes arbitrary JavaScript in a user's browser session when viewed.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:44.162Z. Updated 2025-12-24T20:27:01.726Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:27 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25130

Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database

Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication credentials stored in an unencrypted database file. Attackers can read the BEWARD.INTERCOM.FDB file to extract usernames and passwords, enabling unauthorized access to IP cameras and doo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 981 to 1000 of 5493.First page Next page

Published 2025-12-24T19:27:43.752Z. Updated 2025-12-24T20:27:08.870Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:27 WIB

Official record

HighPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25129

SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints

SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials. Attackers can retrieve authenticated and unauthenticated user password hashes and pins through unprotected endpoints like Get_Permissions_From_DB.php and Ac10_R…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:43.322Z. Updated 2025-12-24T20:27:15.081Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:27 WIB

Official record

CritPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25128

SOCA Access Control System 180612 SQL Injection and Authentication Bypass

SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST parameters. Attackers can bypass authentication, retrieve password hashes, and gain administrative access with full system privileges by exploiting injection fla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:42.899Z. Updated 2025-12-24T20:27:21.283Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:27 WIB

Official record

MedPublished 25 Dec 2025, 02:27 WIB

CVE-2018-25127

SOCA Access Control System 180612 Cross-Site Request Forgery via Admin Interface

SOCA Access Control System 180612 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without proper request validation. Attackers can craft malicious web pages that submit forged requests to create admin accounts by tricking logged-in users into visiting a malici…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:27:42.423Z. Updated 2025-12-24T20:27:27.630Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:27 WIB

Official record

MedPublished 25 Dec 2025, 02:01 WIB

CVE-2025-36154

IBM Concert Software Cleartext Storage in a File or on Disk.

IBM Concert 1.0.0 through 2.1.0 stores sensitive information in cleartext during recursive docker builds which could be obtained by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T19:01:48.161Z. Updated 2025-12-24T20:02:34.098Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated25 Dec 2025, 03:02 WIB

Official record

HighPublished 24 Dec 2025, 23:21 WIB

CVE-2025-2515

Bluechi: privilege escalation in bluechi via unrestricted cross-node systemd dependencies

A vulnerability was found in BlueChi, a multi-node systemd service controller used in RHIVOS. This flaw allows a user with root privileges on a managed node (qm) to create or override systemd service unit files that affect the host node. This issue can lead to privilege escalation, unauthorized service execution, and p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T16:21:54.365Z. Updated 2026-06-29T20:36:02.657Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 03:36 WIB

Official record

UnscoredPublished 24 Dec 2025, 22:51 WIB

CVE-2025-68750

usb: potential integer overflow in usbg_make_tpg()

In the Linux kernel, the following vulnerability has been resolved: usb: potential integer overflow in usbg_make_tpg() The variable tpgt in usbg_make_tpg() is defined as unsigned long and is assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an integer overflow when tpgt is greater than USHRT_MAX (…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T15:51:03.141Z. Updated 2026-05-11T21:52:37.371Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:52 WIB

Official record

HighPublished 24 Dec 2025, 22:27 WIB

CVE-2025-43876

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - get8021xSettings

Under certain circumstances a successful exploitation could result in access to the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T15:27:06.898Z. Updated 2025-12-24T16:20:55.776Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 23:20 WIB

Official record

HighPublished 24 Dec 2025, 22:19 WIB

CVE-2025-43875

iSTAR Ultra, Ultra SE, Ultra G2, Ultra G2 SE, iSTAR Edge G2 - Authenticated web application command injection - getOptionsInfo

Under certain circumstances a successful exploitation could result in access to the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T15:19:19.145Z. Updated 2025-12-24T16:21:31.227Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Dec 2025, 23:21 WIB

Official record

HighPublished 24 Dec 2025, 21:31 WIB

CVE-2025-2155

Arbitrary File Upload in EchoCCS's Specto CM

Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Remote Code Inclusion. This issue affects Specto CM: before 17032025.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T14:31:07.708Z. Updated 2026-06-06T06:20:58.204Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:20 WIB

Official record

MedPublished 24 Dec 2025, 21:26 WIB

CVE-2025-2154

Stored XSS in EchoCCS's Specto CM

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Echo Call Center Services Trade and Industry Inc. Specto CM allows Stored XSS. This issue affects Specto CM: before 17032025.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T14:26:47.561Z. Updated 2026-06-06T06:22:34.276Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:22 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68606

WordPress PostX plugin <= 5.0.3 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.This issue affects PostX: from n/a through <= 5.0.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:48.784Z. Updated 2026-04-28T16:14:31.303Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68605

WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Stored XSS.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:48.261Z. Updated 2026-04-28T16:14:31.280Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68603

WordPress Editorial Calendar plugin <= 3.8.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marketing Fire Editorial Calendar editorial-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Editorial Calendar: from n/a through <= 3.8.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:47.744Z. Updated 2026-04-28T16:14:31.304Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68602

WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.5.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:47.134Z. Updated 2026-04-28T16:14:31.300Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68601

WordPress Five Star Restaurant Reservations plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:46.860Z. Updated 2026-04-28T16:14:31.310Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68600

WordPress Link Library plugin <= 7.8.7 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Yannick Lefebvre Link Library link-library allows Server Side Request Forgery.This issue affects Link Library: from n/a through <= 7.8.7.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:46.548Z. Updated 2026-04-28T16:14:31.242Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68599

WordPress YouTube Embed plugin <= 5.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-embed allows Stored XSS.This issue affects YouTube Embed: from n/a through <= 5.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:46.247Z. Updated 2026-04-28T16:14:31.285Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 24 Dec 2025, 20:10 WIB

CVE-2025-68598

WordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer live-composer-page-builder allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 2.1.22.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-24T13:10:45.982Z. Updated 2026-09-21T10:57:59.959Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Sep 2026, 17:57 WIB

Official record