Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 119 published records · 1 KEV · 119 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

119 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low119100%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

May 25119

Signal coverage

KEV-listed: 1
With a forecast: 119
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.84% · forecast 100% · unscored 0.00%.

Showing 1–20 of 119By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 119, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

LowPublished 31 May 2025, 02:21 WIB

CVE-2025-48946

liboqs affected by theoretical design flaw in HQC

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. liboqs prior to version 0.13.0 supports the HQC algorithm, an algorithm with a theoretical design flaw which leads to large numbers of malformed ciphertexts sharing the same implicit rejection value. Curr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T19:21:14.847Z. Updated 2025-05-30T20:43:37.178Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated31 May 2025, 03:43 WIB

Official record

LowPublished 31 May 2025, 01:45 WIB

CVE-2025-48938

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 119.Next page

Severity low: primary CNA CVSS 2.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T18:45:59.753Z. Updated 2025-05-30T20:38:51.984Z.

CVSS2.6v4.0KEVNot listedEPSSPresentUpdated31 May 2025, 03:38 WIB

Official record

LowPublished 30 May 2025, 21:22 WIB

CVE-2025-3611

Improper Access Control in Mattermost allows System Managers to view team details despite role restrictions

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fails to properly enforce access control restrictions for System Manager roles, allowing authenticated users with System Manager privileges to view team details they should not have access to via direct API requests to team endpoints, even when e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T14:22:09.854Z. Updated 2025-05-30T14:37:42.109Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated30 May 2025, 21:37 WIB

Official record

LowPublished 30 May 2025, 21:22 WIB

CVE-2025-1792

Improper Access Control in Mattermost Channel Member API

Mattermost versions 10.7.x <= 10.7.0, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly enforce access controls for guest users accessing channel member information, allowing authenticated guest users to view metadata about members of public channels via the channel members API endpoint.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T14:22:08.404Z. Updated 2025-06-12T17:07:00.539Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated13 Jun 2025, 00:07 WIB

Official record

LowPublished 30 May 2025, 10:38 WIB

CVE-2025-48491

Project AI API Key Exposure in Source Code

Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T03:38:53.828Z. Updated 2025-05-30T12:42:33.795Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 19:42 WIB

Official record

LowPublished 30 May 2025, 10:37 WIB

CVE-2025-48068

Information exposure in Next.js dev server due to lack of origin verification

Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T03:37:44.849Z. Updated 2025-06-13T14:47:20.267Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated13 Jun 2025, 21:47 WIB

Official record

LowPublished 30 May 2025, 10:37 WIB

CVE-2025-47952

Traefik allows path traversal using url encoding

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T03:37:12.685Z. Updated 2025-05-30T12:44:38.661Z.

CVSS2.9v4.0KEVNot listedEPSSPresentUpdated30 May 2025, 19:44 WIB

Official record

LowPublished 30 May 2025, 02:25 WIB

CVE-2025-47288

Discourse Policy plugin private group members visible

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1. A workaround involves …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T19:25:49.798Z. Updated 2025-05-30T12:35:34.217Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated30 May 2025, 19:35 WIB

Official record

LowPublished 29 May 2025, 23:32 WIB

CVE-2025-46570

vLLM’s Chunk-Based Prefix Caching Vulnerable to Potential Timing Side-Channel

vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PageAttention mechanism finds a matching prefix chunk, the prefill process speeds up, which is reflected in the TTFT (Time to First Token). These timing differences caused by matching…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T16:32:42.794Z. Updated 2025-05-29T18:05:10.768Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated30 May 2025, 01:05 WIB

Official record

LowPublished 28 May 2025, 18:19 WIB

CVE-2025-3864

Connection pool exhaustion in hackney

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote attackers can exploit this to exhaust connection pools, causing denial of service in applications using the library. Fix for this issue has been included in 1.24.0 release.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T11:19:15.208Z. Updated 2026-01-26T12:13:02.411Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Jan 2026, 19:13 WIB

Official record

LowPublished 28 May 2025, 14:56 WIB

CVE-2025-46777

CVE-2025-46777

A insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.9 may allow an authenticated attacker with at least read-only admin permissions to view encrypted secrets via the FortiPortal System Log.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T07:56:03.616Z. Updated 2025-05-28T13:30:23.832Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated28 May 2025, 20:30 WIB

Official record

LowPublished 28 May 2025, 14:55 WIB

CVE-2024-54020

CVE-2024-54020

A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allow an authenticated attacker to overwrite global threat feeds via crafted update requests.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T07:55:32.497Z. Updated 2025-05-28T14:21:37.049Z.

CVSS2.1v3.1KEVNot listedEPSSPresentUpdated28 May 2025, 21:21 WIB

Official record

LowPublished 28 May 2025, 14:54 WIB

CVE-2025-47295

CVE-2025-47295

A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to crash the FGFM daemon via a specially crafted request, under rare conditions that are outside of the attacker's control.

Excerpt language: en.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T07:54:05.794Z. Updated 2025-05-28T14:23:42.935Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated28 May 2025, 21:23 WIB

Official record

LowPublished 28 May 2025, 07:00 WIB

CVE-2025-48930

CVE-2025-48930

The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content may be accessible to an adversary through various avenues.

Excerpt language: en.

Severity low: primary CNA CVSS 2.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T00:00:00.000Z. Updated 2025-07-01T19:46:40.527Z.

CVSS2.8v3.1KEVNot listedEPSSPresentUpdated02 Jul 2025, 02:46 WIB

Official record

LowPublished 28 May 2025, 07:00 WIB

CVE-2025-48931

CVE-2025-48931

The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities (including rainbow tables) with low computational effort.

Excerpt language: en.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T00:00:00.000Z. Updated 2025-05-29T18:57:13.305Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated30 May 2025, 01:57 WIB

Official record

LowPublished 28 May 2025, 05:22 WIB

CVE-2025-2826

n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets.

n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to incorrectly be allowed or den…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-27T22:22:51.717Z. Updated 2025-05-28T13:34:08.151Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated28 May 2025, 20:34 WIB

Official record

LowPublished 27 May 2025, 22:27 WIB

CVE-2025-48370

auth-js Vulnerable to Insecure Path Routing from Malformed User Input

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function bei…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-27T15:27:00.864Z. Updated 2026-07-27T18:46:14.582Z.

CVSS2.7v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 01:46 WIB

Official record

LowPublished 27 May 2025, 22:00 WIB

CVE-2025-2236

Exposure of Sensitive System Information vulnerability during configuration affecting OpenText Advanced Authentication.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. The vulnerability could reveal sensitive information while managing and configuring of the external services. This issue affects Advanced Authentication versions …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-27T15:00:30.910Z. Updated 2025-05-27T15:17:27.699Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated27 May 2025, 22:17 WIB

Official record

LowPublished 27 May 2025, 11:32 WIB

CVE-2025-48382

Fess has Insecure Temporary File Permissions

Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary files without explicitly setting restrictive permissions. This could lead to potential information disclosure, allowing unauthorized local users to access sensi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-27T04:32:23.804Z. Updated 2025-05-27T14:34:38.199Z.

CVSS1.2v4.0KEVNot listedEPSSPresentUpdated27 May 2025, 21:34 WIB

Official record

LowPublished 27 May 2025, 07:00 WIB

CVE-2025-26211

CVE-2025-26211

Gibbon before 29.0.00 allows CSRF.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-27T00:00:00.000Z. Updated 2025-05-27T14:06:29.032Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated27 May 2025, 21:06 WIB

Official record