Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,774 published records · 14 KEV · 3,774 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,774 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2967.8%
High1,13730%
Med1,44438%
Low962.5%
None00.00%
Legacy00.00%
Unscored80121%

Matching records by UTC month

Jul 253,774

Signal coverage

KEV-listed: 14
With a forecast: 3,774
Unknown date: 0
Unscored severity: 801

Share of cohort: KEV 0.37% · forecast 100% · unscored 21%.

Showing 1–20 of 3,774By severity band: Critical · 9.0–10.0 296, High · 7.0–8.9 1,137, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 96, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 801

LowPublished 01 Aug 2025, 03:44 WIB

CVE-2023-32251

Kernel: ksmbd brute force delay bypass via asynchronous requests

A vulnerability has been identified in the Linux kernel's ksmbd component (kernel SMB/CIFS server). A security control designed to prevent dictionary attacks, which introduces a 5-second delay during session setup, can be bypassed through the use of asynchronous requests. This bypass negates the intended anti-brute-for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T20:44:02.968Z. Updated 2026-06-30T06:36:58.944Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 13:36 WIB

Official record

MedPublished 01 Aug 2025, 03:41 WIB

CVE-2025-23289

CVE-2025-23289

NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to the log files through proxy servers. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 3774.Next page

Published 2025-07-31T20:41:51.159Z. Updated 2025-08-01T13:27:25.634Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 20:27 WIB

Official record

MedPublished 01 Aug 2025, 03:25 WIB

CVE-2025-48073

OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereferen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T20:25:51.545Z. Updated 2025-07-31T20:36:41.060Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:36 WIB

Official record

MedPublished 01 Aug 2025, 03:18 WIB

CVE-2025-48072

OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a malicious…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T20:18:40.598Z. Updated 2025-07-31T20:37:21.287Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:37 WIB

Official record

HighPublished 01 Aug 2025, 03:13 WIB

CVE-2025-48071

OpenEXR's Forged Unpacked Size can Lead to Heap-Based Buffer Overflow in Deep Scanline Parsing

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.2 through 3.3.0, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep scan-line EXR files with a maliciously forg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T20:13:14.436Z. Updated 2025-07-31T20:22:23.603Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:22 WIB

Official record

MedPublished 01 Aug 2025, 02:42 WIB

CVE-2025-37112

Hard-Coded Encryption Keys found in System

A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:42:04.081Z. Updated 2025-07-31T20:01:12.230Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:01 WIB

Official record

MedPublished 01 Aug 2025, 02:41 WIB

CVE-2025-37111

Hard-Coded Authentication Keys found in System

A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:41:54.593Z. Updated 2025-07-31T20:02:46.356Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:02 WIB

Official record

MedPublished 01 Aug 2025, 02:41 WIB

CVE-2025-37110

Sensitive Credential Information stored insecurely in System Database

A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:41:39.665Z. Updated 2025-07-31T20:03:53.635Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:03 WIB

Official record

CritPublished 01 Aug 2025, 02:23 WIB

CVE-2025-8286

Güralp Systems FMUS Series and MIN Series Devices

The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:23:37.557Z. Updated 2025-08-15T20:24:46.530Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated16 Aug 2025, 03:24 WIB

Official record

LowPublished 01 Aug 2025, 02:20 WIB

CVE-2025-37109

HPE Telco Service Activator, Protection Mechanism Failure

Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:20:44.918Z. Updated 2025-08-04T18:30:39.560Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated05 Aug 2025, 01:30 WIB

Official record

LowPublished 01 Aug 2025, 02:17 WIB

CVE-2025-37108

HPE Telco Service Activator, Protection Mechanism Failure

Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:17:55.861Z. Updated 2025-07-31T19:50:02.995Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 02:50 WIB

Official record

CritPublished 01 Aug 2025, 00:57 WIB

CVE-2025-8426

Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability

Marvell QConvergeConsole compressConfigFiles Directory Traversal Information Disclosure and Denial-of-Service Vulnerability. This vulnerability allows remote attackers to disclose sensitive information or to create a denial-of-service condition on affected installations of Marvell QConvergeConsole. Authentication is no…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T17:57:54.748Z. Updated 2025-07-31T18:26:02.364Z.

CVSS9.4v3.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 01:26 WIB

Official record

MedPublished 01 Aug 2025, 00:26 WIB

CVE-2025-54833

OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T17:26:31.457Z. Updated 2025-08-07T18:49:33.918Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Aug 2025, 01:49 WIB

Official record

MedPublished 01 Aug 2025, 00:26 WIB

CVE-2025-54834

OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T17:26:04.606Z. Updated 2025-07-31T18:16:59.684Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 01:16 WIB

Official record

MedPublished 01 Aug 2025, 00:25 WIB

CVE-2025-54832

OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification

OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T17:25:27.272Z. Updated 2025-08-07T18:45:45.102Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Aug 2025, 01:45 WIB

Official record

MedPublished 31 Jul 2025, 22:32 WIB

CVE-2025-8409

code-projects Vehicle Management filter.php sql injection

A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /filter.php. The manipulation of the argument from leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:32:06.674Z. Updated 2025-07-31T16:06:28.458Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 23:06 WIB

Official record

MedPublished 31 Jul 2025, 22:24 WIB

CVE-2025-46809

Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs

A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:24:41.890Z. Updated 2025-09-03T07:12:41.584Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 14:12 WIB

Official record

MedPublished 31 Jul 2025, 22:02 WIB

CVE-2025-8408

code-projects Vehicle Management filter1.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /filter1.php. The manipulation of the argument vehicle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:02:05.653Z. Updated 2025-07-31T20:07:31.662Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:07 WIB

Official record

CritPublished 31 Jul 2025, 22:01 WIB

CVE-2013-10037

WebTester 5.x install2.php Unauthenticated Command Execution

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:01:44.165Z. Updated 2026-04-07T14:02:59.797Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:02 WIB

Official record

CritPublished 31 Jul 2025, 22:01 WIB

CVE-2014-125126

Simple E-Document Arbitrary File Upload RCE

An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cookie header (access=3) with HTTP requests. The application’s upload mechanism fails to restrict file types and does not validate or sanitize …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:01:17.704Z. Updated 2026-07-15T01:23:16.555Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record