Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 1,444 published records · 2 KEV · 1,444 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

1,444 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med1,444100%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Jul 251,444

Signal coverage

KEV-listed: 2
With a forecast: 1,444
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.14% · forecast 100% · unscored 0.00%.

Showing 1–20 of 1,444By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 1,444, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

MedPublished 01 Aug 2025, 03:41 WIB

CVE-2025-23289

CVE-2025-23289

NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to the log files through proxy servers. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T20:41:51.159Z. Updated 2025-08-01T13:27:25.634Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 20:27 WIB

Official record

MedPublished 01 Aug 2025, 03:25 WIB

CVE-2025-48073

OpenEXR ScanLineProcess::run_fill NULL Pointer Write In "reduceMemory" Mode

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In version 3.3.2, when reading a deep scanline image with a large sample count in reduceMemory mode, it is possible to crash a target application with a NULL pointer dereferen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 1444.Next page

Published 2025-07-31T20:25:51.545Z. Updated 2025-07-31T20:36:41.060Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:36 WIB

Official record

MedPublished 01 Aug 2025, 03:18 WIB

CVE-2025-48072

OpenEXR's Inaccurate Pointer Arithmetic can Cause an Out of Bounds Heap

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a malicious…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T20:18:40.598Z. Updated 2025-07-31T20:37:21.287Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:37 WIB

Official record

MedPublished 01 Aug 2025, 02:42 WIB

CVE-2025-37112

Hard-Coded Encryption Keys found in System

A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:42:04.081Z. Updated 2025-07-31T20:01:12.230Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:01 WIB

Official record

MedPublished 01 Aug 2025, 02:41 WIB

CVE-2025-37111

Hard-Coded Authentication Keys found in System

A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:41:54.593Z. Updated 2025-07-31T20:02:46.356Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:02 WIB

Official record

MedPublished 01 Aug 2025, 02:41 WIB

CVE-2025-37110

Sensitive Credential Information stored insecurely in System Database

A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T19:41:39.665Z. Updated 2025-07-31T20:03:53.635Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:03 WIB

Official record

MedPublished 01 Aug 2025, 00:26 WIB

CVE-2025-54833

OPEXUS FOIAXpress Public Access Link (PAL) account-lockout and CAPTCHA protection bypass

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows attackers to bypass account-lockout and CAPTCHA protections. Unauthenticated remote attackers can more easily brute force passwords.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T17:26:31.457Z. Updated 2025-08-07T18:49:33.918Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated08 Aug 2025, 01:49 WIB

Official record

MedPublished 01 Aug 2025, 00:26 WIB

CVE-2025-54834

OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumeration

OPEXUS FOIAXpress Public Access Link (PAL) version v11.1.0 allows an unauthenticated, remote attacker to query the /App/CreateRequest.aspx endpoint to check for the existence of valid usernames. There are no rate-limiting mechanisms in place.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T17:26:04.606Z. Updated 2025-07-31T18:16:59.684Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 01:16 WIB

Official record

MedPublished 01 Aug 2025, 00:25 WIB

CVE-2025-54832

OPEXUS FOIAXpress Public Access Link (PAL) state and territory list unauthorized modification

OPEXUS FOIAXpress Public Access Link (PAL), version v11.1.0, allows an authenticated user to add entries to the list of states and territories.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T17:25:27.272Z. Updated 2025-08-07T18:45:45.102Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Aug 2025, 01:45 WIB

Official record

MedPublished 31 Jul 2025, 22:32 WIB

CVE-2025-8409

code-projects Vehicle Management filter.php sql injection

A vulnerability has been found in code-projects Vehicle Management 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /filter.php. The manipulation of the argument from leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:32:06.674Z. Updated 2025-07-31T16:06:28.458Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 23:06 WIB

Official record

MedPublished 31 Jul 2025, 22:24 WIB

CVE-2025-46809

Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs

A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x86_64/proxy-httpd:5.0.5.7.23.1: from ? before 5.0.14-150600.4.17.1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:24:41.890Z. Updated 2025-09-03T07:12:41.584Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 14:12 WIB

Official record

MedPublished 31 Jul 2025, 22:02 WIB

CVE-2025-8408

code-projects Vehicle Management filter1.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /filter1.php. The manipulation of the argument vehicle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T15:02:05.653Z. Updated 2025-07-31T20:07:31.662Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Aug 2025, 03:07 WIB

Official record

MedPublished 31 Jul 2025, 21:57 WIB

CVE-2014-125122

Linksys WRT120N tmUnblock.cgi Stack-Based Buffer Overflow Admin Password Reset

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint. By exploiting this flaw, an unauthenticated remote attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:57:59.666Z. Updated 2026-04-07T14:03:26.941Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Apr 2026, 21:03 WIB

Official record

MedPublished 31 Jul 2025, 21:12 WIB

CVE-2025-7738

Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text expo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:12:02.648Z. Updated 2025-12-23T22:16:48.426Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated24 Dec 2025, 05:16 WIB

Official record

MedPublished 31 Jul 2025, 21:02 WIB

CVE-2025-8407

code-projects Vehicle Management filter2.php sql injection

A vulnerability, which was classified as critical, has been found in code-projects Vehicle Management 1.0. This issue affects some unknown processing of the file /filter2.php. The manipulation of the argument from leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T14:02:05.917Z. Updated 2025-07-31T14:16:40.311Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:16 WIB

Official record

MedPublished 31 Jul 2025, 20:48 WIB

CVE-2025-54589

copyparty Reflected XSS via Filter Parameter

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a `<script>` block without proper escaping, allowing…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T13:48:41.615Z. Updated 2025-07-31T14:12:45.463Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated31 Jul 2025, 21:12 WIB

Official record

MedPublished 31 Jul 2025, 19:02 WIB

CVE-2025-8382

Campcodes Online Hotel Reservation System edit_room.php sql injection

A vulnerability, which was classified as critical, was found in Campcodes Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/edit_room.php. The manipulation of the argument room_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T12:02:06.350Z. Updated 2025-08-04T05:17:02.790Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Aug 2025, 12:17 WIB

Official record

MedPublished 31 Jul 2025, 18:32 WIB

CVE-2025-8381

Campcodes Online Hotel Reservation System add_reserve.php sql injection

A vulnerability, which was classified as critical, has been found in Campcodes Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /add_reserve.php. The manipulation of the argument room_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T11:32:05.927Z. Updated 2025-07-31T13:33:20.829Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Jul 2025, 20:33 WIB

Official record

MedPublished 31 Jul 2025, 18:19 WIB

CVE-2025-8068

HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to an improper capability check on the 'ajax_trash_templates' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Contributor-level …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T11:19:13.164Z. Updated 2026-04-08T17:27:13.733Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:27 WIB

Official record

MedPublished 31 Jul 2025, 18:19 WIB

CVE-2025-8401

HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.1 via the 'get_post_data' function. This makes it possible for authenticated attackers, with Author-level access and above, to extract sensitive data including the c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-07-31T11:19:12.771Z. Updated 2026-04-08T17:10:01.120Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:10 WIB

Official record