Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 605 published records · 6 KEV · 605 with a forecast · 0 unknown dates
605 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.99% · forecast 100% · unscored 100%.
CVE-2025-6554
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)
Unscored under this view's policy KEV listed. Forecast present in this snapshot.
Published 2025-06-30T21:14:14.799Z. Updated 2025-10-21T22:45:23.208Z.
powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap memtrace mmap issue has an out of bounds issue. This patch fixes the by checking that the requested mapping region size should stay within the allocated region size.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T07:29:44.086Z. Updated 2026-05-11T21:21:01.549Z.
Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSS
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T06:00:01.730Z. Updated 2025-06-30T18:50:31.178Z.
WP Lightbox 2 < 3.0.6.8 - Unauthenticated Stored XSS
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T06:00:01.235Z. Updated 2025-06-30T18:52:02.699Z.
CVE-2023-47310
A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP traceroute packets.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T00:00:00.000Z. Updated 2026-07-05T16:05:45.698Z.
CVE-2024-53621
A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T00:00:00.000Z. Updated 2025-06-30T19:40:22.659Z.
CVE-2025-26074
Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T00:00:00.000Z. Updated 2025-06-30T18:44:46.795Z.
CVE-2025-45143
string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T00:00:00.000Z. Updated 2025-06-30T18:50:15.866Z.
CVE-2025-45931
An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T00:00:00.000Z. Updated 2026-07-05T16:06:10.776Z.
CVE-2025-46014
Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-30T00:00:00.000Z. Updated 2025-06-30T14:05:49.557Z.
Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server
Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same as CVE-2024-47552, but the version range described in the CVE-2024-47552 definition is too narrow. This issue affects Apache Seata (incubating): from 2.0.0 before 2.3.0. Severity Justification: The Ap…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-28T18:25:18.312Z. Updated 2026-03-30T08:35:55.447Z.
net: ch9200: fix uninitialised access during mii_nway_restart
In the Linux kernel, the following vulnerability has been resolved: net: ch9200: fix uninitialised access during mii_nway_restart In mii_nway_restart() the code attempts to call mii->mdio_read which is ch9200_mdio_read(). ch9200_mdio_read() utilises a local buffer called "buff", which is initialised with control_read…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-28T07:52:58.293Z. Updated 2026-05-11T21:20:59.045Z.
GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMs
Software installed and running inside a Guest VM may conduct improper GPU system calls to prevent other Guests from running work on the GPU.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T17:04:00.516Z. Updated 2025-07-01T17:36:03.642Z.
GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close it
Software installed and running inside a Guest VM may override Firmware's state and gain access to the GPU.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T16:53:44.938Z. Updated 2025-07-02T14:26:00.627Z.
Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses
Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as …
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T12:19:59.195Z. Updated 2026-09-07T18:26:26.820Z.
BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update
The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T06:00:11.971Z. Updated 2025-07-01T19:19:08.270Z.
WP Map Block by aBlocks < 2.0.3 - Contributor+ Stored XSS via Marker
The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T06:00:10.599Z. Updated 2025-07-01T19:19:58.297Z.
Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS
The Responsive Lightbox & Gallery WordPress plugin before 2.5.2 use the Swipebox library which does not validate and escape title attributes before outputting them back in a page/post where used, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T06:00:08.082Z. Updated 2025-06-27T14:30:24.444Z.
Firelight Lightbox < 2.3.16 - Contributor+ Stored XSS
The Firelight Lightbox WordPress plugin before 2.3.16 does not sanitise and escape title attributes before outputting them in the page, which could allow users with a role as low as contributors to perform stored Cross-Site Scripting attacks.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T06:00:03.026Z. Updated 2025-06-27T14:31:50.266Z.
CVE-2025-44163
RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the `entity` parameter to overwrite arbitrary files writable by the web server via abuse of the `tee` command used in shell executi…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-06-27T00:00:00.000Z. Updated 2025-06-27T20:01:03.722Z.