Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 978 published records · 6 KEV · 978 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

978 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High978100%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Jun 25978

Signal coverage

KEV-listed: 6
With a forecast: 978
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.61% · forecast 100% · unscored 0.00%.

Showing 1–20 of 978By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 978, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

HighPublished 01 Jul 2025, 03:45 WIB

CVE-2025-49520

Event-driven-ansible: authenticated argument injection in git url in eda project creation

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T20:45:28.706Z. Updated 2025-11-13T16:36:36.659Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:36 WIB

Official record

HighPublished 01 Jul 2025, 03:45 WIB

CVE-2025-49521

Event-driven-ansible: template injection via git branch and refspec in eda projects

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 978.Next page

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T20:45:13.138Z. Updated 2025-11-13T16:36:45.785Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 23:36 WIB

Official record

HighPublished 01 Jul 2025, 03:18 WIB

CVE-2025-53004

Dataease Redshift Data Source JDBC Connection Parameters Bypass Vulnerability

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypass vulnerability in Dataease's Redshift Data Source JDBC Connection Parameters. The sslfactory and sslfactoryarg parameters could trigger a bypass vulnerability. This issue has been patched in version …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T20:18:49.563Z. Updated 2025-07-01T00:33:13.050Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 07:33 WIB

Official record

HighPublished 01 Jul 2025, 02:57 WIB

CVE-2025-52995

File Browser vulnerable to command execution allowlist bypass

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T19:57:52.307Z. Updated 2025-06-30T20:25:51.255Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Jul 2025, 03:25 WIB

Official record

HighPublished 01 Jul 2025, 01:29 WIB

CVE-2025-36593

CVE-2025-36593

Dell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS protocol. An attacker with local network access could potentially exploit this vulnerability to forge a valid protocol accept message in response to a failed authentication reques…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T18:29:05.020Z. Updated 2026-02-26T17:50:20.464Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 01 Jul 2025, 00:19 WIB

CVE-2025-52898

Frappe account takeover via password reset token leakage

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T17:19:31.543Z. Updated 2025-06-30T18:01:16.717Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 01:01 WIB

Official record

HighPublished 01 Jul 2025, 00:12 WIB

CVE-2025-52896

Frappe authenticated XSS via data import

Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T17:12:50.590Z. Updated 2025-06-30T20:39:38.755Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 03:39 WIB

Official record

HighPublished 01 Jul 2025, 00:05 WIB

CVE-2025-52895

Frappe possibility of SQL injection due to improper validations

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T17:05:36.027Z. Updated 2025-06-30T20:40:43.365Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 03:40 WIB

Official record

HighPublished 01 Jul 2025, 00:02 WIB

CVE-2025-6916

TOTOLINK T6 formLoginAuth.htm Form_Login missing authentication

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T17:02:07.995Z. Updated 2025-06-30T20:47:24.541Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 03:47 WIB

Official record

HighPublished 30 Jun 2025, 16:39 WIB

CVE-2024-8419

Improper Access Control vulnerability in AC4xxS devices

The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T09:39:50.792Z. Updated 2026-02-16T15:43:48.124Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Feb 2026, 22:43 WIB

Official record

HighPublished 30 Jun 2025, 16:14 WIB

CVE-2025-53416

File Parsing Deserialization of Untrusted Data in DTN Soft

Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T09:14:19.717Z. Updated 2025-07-15T14:52:28.895Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated15 Jul 2025, 21:52 WIB

Official record

HighPublished 30 Jun 2025, 16:09 WIB

CVE-2025-53415

File Parsing Deserialization of Untrusted Data in DTM Soft

Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T09:09:32.624Z. Updated 2025-07-01T07:49:57.750Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated01 Jul 2025, 14:49 WIB

Official record

HighPublished 30 Jun 2025, 15:30 WIB

CVE-2025-40732

User enumeration vulnerability in Daily Expense Manager

user enumeration vulnerability in Daily Expense Manager v1.0. To exploit this vulnerability a POST request must be sent using the name parameter in /check.php

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T08:30:06.701Z. Updated 2025-06-30T17:44:46.901Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 00:44 WIB

Official record

HighPublished 30 Jun 2025, 15:29 WIB

CVE-2025-40731

SQL injection vulnerability in Daily Expense Manager

SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T08:29:16.740Z. Updated 2025-06-30T17:45:19.929Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Jul 2025, 00:45 WIB

Official record

HighPublished 30 Jun 2025, 14:29 WIB

CVE-2025-38090

drivers/rapidio/rio_cm.c: prevent possible heap overwrite

In the Linux kernel, the following vulnerability has been resolved: drivers/rapidio/rio_cm.c: prevent possible heap overwrite In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T07:29:45.565Z. Updated 2026-08-05T11:59:26.672Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:59 WIB

Official record

HighPublished 30 Jun 2025, 14:29 WIB

CVE-2025-38087

net/sched: fix use-after-free in taprio_dev_notifier

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free. Adding rcu_read_lock() inside taprio_dev_notifi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T07:29:43.325Z. Updated 2026-08-05T11:59:24.523Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:59 WIB

Official record

HighPublished 30 Jun 2025, 11:32 WIB

CVE-2025-6887

Tenda AC5 SetSysTimeCfg stack-based overflow

A vulnerability was found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/SetSysTimeCfg. The manipulation of the argument time/timeZone leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T04:32:29.352Z. Updated 2025-06-30T16:20:32.529Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Jun 2025, 23:20 WIB

Official record

HighPublished 30 Jun 2025, 11:02 WIB

CVE-2025-6886

Tenda AC5 openSchedWifi stack-based overflow

A vulnerability has been found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T04:02:23.680Z. Updated 2025-06-30T16:27:50.848Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Jun 2025, 23:27 WIB

Official record

HighPublished 30 Jun 2025, 09:02 WIB

CVE-2025-6882

D-Link DIR-513 formSetWanPPTP buffer overflow

A vulnerability classified as critical has been found in D-Link DIR-513 1.0. This affects an unknown part of the file /goform/formSetWanPPTP. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T02:02:05.814Z. Updated 2025-06-30T15:28:36.712Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Jun 2025, 22:28 WIB

Official record

HighPublished 30 Jun 2025, 08:32 WIB

CVE-2025-6881

D-Link DI-8100 jhttpd pppoe_base.asp buffer overflow

A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pppoe_base.asp of the component jhttpd. The manipulation of the argument mschap_en leads to buffer overflow. The attack may be launched remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T01:32:05.807Z. Updated 2025-06-30T16:59:17.117Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated30 Jun 2025, 23:59 WIB

Official record