Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 901–920 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

LowPublished 26 Dec 2025, 01:32 WIB

CVE-2025-15084

youlaitech youlai-mall Order Payment OrderController.java orderService.payOrder access control

A vulnerability was identified in youlaitech youlai-mall 1.0.0/2.0.0. The impacted element is the function orderService.payOrder of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java of the component Order Payment Handler. The manipulation leads to improper access controls.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T18:32:05.729Z. Updated 2025-12-29T21:29:17.869Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Dec 2025, 04:29 WIB

Official record

LowPublished 26 Dec 2025, 00:32 WIB

CVE-2025-15083

TOZED ZLT M30s UART on-chip debug and test interface with improper access control

A vulnerability was determined in TOZED ZLT M30s up to 1.47. The affected element is an unknown function of the component UART Interface. Executing manipulation can lead to on-chip debug and test interface with improper access control. The physical device can be targeted for the attack. Attacks of this nature are highl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 901 to 920 of 5493.First page Next page

Severity low: primary CNA CVSS 1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T17:32:06.260Z. Updated 2025-12-30T21:09:24.413Z.

CVSS1v4.0KEVNot listedEPSSPresentUpdated31 Dec 2025, 04:09 WIB

Official record

MedPublished 26 Dec 2025, 00:02 WIB

CVE-2025-15082

TOZED ZLT M30s Web Management proc_post information disclosure

A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possible to initiate the attack remotely. The exploit has been made …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T17:02:09.345Z. Updated 2025-12-26T16:37:54.066Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Dec 2025, 23:37 WIB

Official record

MedPublished 25 Dec 2025, 22:02 WIB

CVE-2025-15081

JD Cloud BE6500 jdcapi sub_4780 command injection

A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulation of the argument ddns_name leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was conta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T15:02:06.546Z. Updated 2025-12-26T16:37:10.227Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Dec 2025, 23:37 WIB

Official record

HighPublished 25 Dec 2025, 20:18 WIB

CVE-2025-2307

XSS in Verisay Communication's Aidango

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Aidango allows Cross-Site Scripting (XSS). This issue affects Aidango: before 2.144.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T13:18:18.162Z. Updated 2026-06-06T06:16:21.099Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:16 WIB

Official record

HighPublished 25 Dec 2025, 20:14 WIB

CVE-2025-2406

XSS in Verisay Communication's Trizbi

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Trizbi allows Cross-Site Scripting (XSS). This issue affects Trizbi: before 2.144.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T13:14:49.099Z. Updated 2026-06-06T06:10:33.322Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:10 WIB

Official record

HighPublished 25 Dec 2025, 20:10 WIB

CVE-2025-2405

XSS in Verisay Communication's Titarus

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Titarus allows Cross-Site Scripting (XSS). This issue affects Titarus: before 2.144.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T13:10:25.121Z. Updated 2026-06-06T06:12:09.158Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:12 WIB

Official record

MedPublished 25 Dec 2025, 12:02 WIB

CVE-2025-15078

itsourcecode Student Management System list_report.php sql injection

A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_report.php. The manipulation of the argument sy results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T05:02:06.963Z. Updated 2025-12-30T21:13:59.906Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Dec 2025, 04:13 WIB

Official record

MedPublished 25 Dec 2025, 11:02 WIB

CVE-2025-15077

itsourcecode Student Management System form137.php sql injection

A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T04:02:08.003Z. Updated 2025-12-30T21:14:32.029Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Dec 2025, 04:14 WIB

Official record

MedPublished 25 Dec 2025, 10:32 WIB

CVE-2025-15076

Tenda CH22 public path traversal

A weakness has been identified in Tenda CH22 1.0.0.1. Impacted is an unknown function of the file /public/. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T03:32:06.775Z. Updated 2026-02-24T06:04:37.858Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:04 WIB

Official record

MedPublished 25 Dec 2025, 10:02 WIB

CVE-2025-15075

itsourcecode Student Management System student_p.php sql injection

A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T03:02:06.320Z. Updated 2025-12-26T16:34:21.922Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Dec 2025, 23:34 WIB

Official record

MedPublished 25 Dec 2025, 09:32 WIB

CVE-2025-15074

itsourcecode Online Frozen Foods Ordering System customer_details.php sql injection

A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T02:32:06.261Z. Updated 2026-02-24T06:04:22.789Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:04 WIB

Official record

HighPublished 25 Dec 2025, 07:00 WIB

CVE-2025-32095

CVE-2025-32095

Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a crafted signalling message, resulting in a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:52:31.389Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:52 WIB

Official record

HighPublished 25 Dec 2025, 07:00 WIB

CVE-2025-32096

CVE-2025-32096

Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, resulting in a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:52:25.811Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:52 WIB

Official record

HighPublished 25 Dec 2025, 07:00 WIB

CVE-2025-48704

CVE-2025-48704

Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:52:04.020Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:52 WIB

Official record

MedPublished 25 Dec 2025, 07:00 WIB

CVE-2025-49088

CVE-2025-49088

Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input Validation in the OTJ service, allowing a remote attacker to trigger a software abort via a crafted calendar invite, leading to a denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:52:20.811Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:52 WIB

Official record

HighPublished 25 Dec 2025, 07:00 WIB

CVE-2025-59683

CVE-2025-59683

Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office 365 Legacy Exchange Tokens. This allows a remote attacker to read potentially sensitive data and excessively consume resources, leading to a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:51:57.340Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:51 WIB

Official record

HighPublished 25 Dec 2025, 07:00 WIB

CVE-2025-66377

CVE-2025-66377

Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already has access to execute code on one node within a Pexip Infinity installation) to impact the operation of other nodes within the installation.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:51:51.926Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:51 WIB

Official record

MedPublished 25 Dec 2025, 07:00 WIB

CVE-2025-66378

CVE-2025-66378

Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP streams traversing a Proxy Node.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:51:46.408Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:51 WIB

Official record

HighPublished 25 Dec 2025, 07:00 WIB

CVE-2025-66379

CVE-2025-66379

Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted media stream, resulting in a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-25T00:00:00.000Z. Updated 2025-12-26T14:52:15.154Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Dec 2025, 21:52 WIB

Official record