Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 1,124 published records · 0 KEV · 1,124 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

1,124 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored1,124100%

Matching records by UTC month

May 251,124

Signal coverage

KEV-listed: 0
With a forecast: 1,124
Unknown date: 0
Unscored severity: 1,124

Share of cohort: KEV 0.00% · forecast 100% · unscored 100%.

Showing 1–20 of 1,124By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,124

UnscoredPublished 30 May 2025, 19:20 WIB

CVE-2025-40909

Perl threads have a working directory race condition where file operations may target unintended paths

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T12:20:11.237Z. Updated 2026-04-18T14:15:40.356Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Apr 2026, 21:15 WIB

Official record

UnscoredPublished 30 May 2025, 13:00 WIB

CVE-2025-4429

WordPress Gearside Developer Dashboard <= 1.0.72 - Reflected XSS

The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 1124.Next page

Published 2025-05-30T06:00:05.917Z. Updated 2025-05-30T14:02:30.756Z.

CVSS—KEVNot listedEPSSPresentUpdated30 May 2025, 21:02 WIB

Official record

UnscoredPublished 30 May 2025, 07:50 WIB

CVE-2020-36846

IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:50:28.582Z. Updated 2025-05-30T22:01:41.998Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44612

CVE-2025-44612

Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-the-middle attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:02:19.532Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:02 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44614

CVE-2025-44614

Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:02:12.898Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:02 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44619

CVE-2025-44619

Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2026-07-05T17:01:58.404Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Jul 2026, 00:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44904

CVE-2025-44904

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:01:59.619Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44905

CVE-2025-44905

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:01:54.071Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

UnscoredPublished 30 May 2025, 07:00 WIB

CVE-2025-44906

CVE-2025-44906

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-30T00:00:00.000Z. Updated 2025-05-30T22:01:48.645Z.

CVSS—KEVNot listedEPSSPresentUpdated31 May 2025, 05:01 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-30466

CVE-2025-30466

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. A website may be able to bypass Same Origin Policy.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:27.244Z. Updated 2026-04-02T18:27:10.218Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:27 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31261

CVE-2025-31261

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access protected user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:26.860Z. Updated 2026-04-02T18:26:56.443Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:26 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31231

CVE-2025-31231

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to read sensitive location information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:26.498Z. Updated 2026-04-02T18:19:30.119Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:19 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31199

CVE-2025-31199

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS 2.4. An app may be able to access sensitive user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:26.147Z. Updated 2026-04-02T18:15:55.345Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:15 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31264

CVE-2025-31264

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker with physical access to a locked device may be able to view sensitive user information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:25.786Z. Updated 2026-04-02T18:14:40.829Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:14 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31198

CVE-2025-31198

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A path handling issue was addressed with improved validation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:25.428Z. Updated 2026-04-02T18:14:00.520Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:14 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31189

CVE-2025-31189

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to break out of its sandbox.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:24.890Z. Updated 2026-04-02T18:11:41.527Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:11 WIB

Official record

UnscoredPublished 30 May 2025, 04:34 WIB

CVE-2025-31263

CVE-2025-31263

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to corrupt coprocessor memory.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T21:34:24.023Z. Updated 2026-04-02T18:11:28.712Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:11 WIB

Official record

UnscoredPublished 30 May 2025, 02:06 WIB

CVE-2025-46701

Apache Tomcat: Security constraint bypass for CGI scripts

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T19:06:04.289Z. Updated 2025-11-03T20:04:34.067Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:04 WIB

Official record

UnscoredPublished 29 May 2025, 21:47 WIB

CVE-2025-5334

CVE-2025-5334

Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to private personal information. Under specific circumstances, entries may be unintentionally moved from user vaults to shared…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T14:47:25.817Z. Updated 2025-06-10T18:24:21.477Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 01:24 WIB

Official record

UnscoredPublished 29 May 2025, 20:15 WIB

CVE-2025-37999

fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio()

In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofs_onlinefolio_split() after bio_add_folio() If bio_add_folio() fails (because it is full), erofs_fileio_scan_folio() needs to submit the I/O request via erofs_fileio_rq_submit() and allocate a new I/O request with an empty `…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T13:15:56.825Z. Updated 2026-05-11T21:19:21.337Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:19 WIB

Official record