Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 123 published records · 0 KEV · 123 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

123 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low123100%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Jun 25123

Signal coverage

KEV-listed: 0
With a forecast: 123
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.00% · forecast 100% · unscored 0.00%.

Showing 1–20 of 123By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 123, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

LowPublished 01 Jul 2025, 02:58 WIB

CVE-2025-52996

File Browser's Password Protection of Links Vulnerable to Bypass

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T19:58:33.484Z. Updated 2025-08-04T17:36:00.191Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 00:36 WIB

Official record

LowPublished 30 Jun 2025, 17:37 WIB

CVE-2025-40710

Host Header Injection (HHI) in the Hotspot Shield VPN client

Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnel. Although such applications do not present this vulnerability per se, the use of the tunnel, together with a forged Host header, can cause …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 123.Next page

Published 2025-06-30T10:37:05.241Z. Updated 2025-06-30T11:15:43.105Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated30 Jun 2025, 18:15 WIB

Official record

LowPublished 30 Jun 2025, 07:00 WIB

CVE-2025-32462

CVE-2025-32462

Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.

Excerpt language: en.

Severity low: primary CNA CVSS 2.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-30T00:00:00.000Z. Updated 2026-07-14T12:41:06.361Z.

CVSS2.8v3.1KEVNot listedEPSSPresentUpdated14 Jul 2026, 19:41 WIB

Official record

LowPublished 29 Jun 2025, 07:00 WIB

CVE-2015-20112

CVE-2015-20112

RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.

Excerpt language: en.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-29T00:00:00.000Z. Updated 2025-06-30T15:44:44.955Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated30 Jun 2025, 22:44 WIB

Official record

LowPublished 28 Jun 2025, 22:38 WIB

CVE-2023-28902

Denial of Service via integer underflow in picserver

An integer underflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause denial-of-service of the infotainment system. The vulnerability was originally discovered in Skoda Superb III car with MIB3 infotainment unit OEM part number 3V0035820. The list…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-28T15:38:23.242Z. Updated 2025-06-30T19:20:28.406Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated01 Jul 2025, 02:20 WIB

Official record

LowPublished 28 Jun 2025, 22:38 WIB

CVE-2023-28903

CVE-2023-28903

An integer overflow in the image processing binary of the MIB3 infotainment unit allows an attacker with local access to the vehicle to cause a denial-of-service of the infotainment system.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-28T15:38:02.954Z. Updated 2025-06-30T19:20:34.306Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated01 Jul 2025, 02:20 WIB

Official record

LowPublished 27 Jun 2025, 20:00 WIB

CVE-2025-53018

Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLs

Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal ne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T13:00:14.086Z. Updated 2025-06-27T13:58:56.661Z.

CVSS3v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 20:58 WIB

Official record

LowPublished 27 Jun 2025, 08:31 WIB

CVE-2025-6748

Bharti Airtel Thanks App files cleartext storage in a file or on disk

A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/data/com.myairtelapp/files/. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the physical device. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T01:31:06.283Z. Updated 2025-06-27T13:44:33.773Z.

CVSS2.4v4.0KEVNot listedEPSSPresentUpdated27 Jun 2025, 20:44 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-46415

CVE-2025-46415

A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Excerpt language: en.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T19:57:56.693Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated28 Jun 2025, 02:57 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-46416

CVE-2025-46416

The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user account (e.g., nixbld or guixbuild). This affects Nix through 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix through 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T15:49:08.285Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 22:49 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47818

CVE-2025-47818

Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:22:58.439Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:22 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47820

CVE-2025-47820

Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:26:12.446Z.

CVSS2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:26 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47821

CVE-2025-47821

Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:27:32.117Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:27 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47823

CVE-2025-47823

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.

Excerpt language: en.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:13:25.835Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:13 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-47824

CVE-2025-47824

Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.

Excerpt language: en.

Severity low: primary CNA CVSS 2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-09-02T16:10:30.962Z.

CVSS2v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 23:10 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-52991

CVE-2025-52991

The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T15:46:39.932Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 22:46 WIB

Official record

LowPublished 27 Jun 2025, 07:00 WIB

CVE-2025-52992

CVE-2025-52992

The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T15:18:30.716Z.

CVSS3.2v3.1KEVNot listedEPSSPresentUpdated27 Jun 2025, 22:18 WIB

Official record

LowPublished 26 Jun 2025, 16:30 WIB

CVE-2025-6703

transport/fc.rs: panic attempting to send MAX_DATA with value larger max varint

Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T09:30:03.893Z. Updated 2025-06-26T12:59:56.348Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Jun 2025, 19:59 WIB

Official record

LowPublished 26 Jun 2025, 12:31 WIB

CVE-2025-2938

Business Logic Errors in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to gain elevated project privileges by requesting access to projects where role modifications during the approval process resulted in unint…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T05:31:30.851Z. Updated 2026-02-26T17:50:22.974Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

LowPublished 26 Jun 2025, 12:31 WIB

CVE-2025-5846

Missing Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-26T05:31:05.956Z. Updated 2025-06-26T13:22:59.788Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated26 Jun 2025, 20:22 WIB

Official record