Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 1,025 published records · 3 KEV · 1,025 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

1,025 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High1,025100%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Aug 251,025

Signal coverage

KEV-listed: 3
With a forecast: 1,025
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.29% · forecast 100% · unscored 0.00%.

Showing 1–20 of 1,025By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 1,025, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

HighPublished 01 Sep 2025, 05:02 WIB

CVE-2025-9748

Tenda CH22 httpd IPSECsave fromIpsecitem stack-based overflow

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack may be performed from remote.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-31T22:02:07.125Z. Updated 2025-09-02T15:12:48.704Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Sep 2025, 22:12 WIB

Official record

HighPublished 31 Aug 2025, 10:48 WIB

CVE-2025-47696

WordPress Blog Designer PRO plugin <= 3.4.7 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 1025.Next page

Published 2025-08-31T03:48:03.893Z. Updated 2026-04-28T16:12:50.334Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 31 Aug 2025, 10:46 WIB

CVE-2024-32589

WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Broken Access Control to XSS vulnerability

Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-31T03:46:56.764Z. Updated 2026-04-28T16:09:37.965Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:09 WIB

Official record

HighPublished 30 Aug 2025, 20:57 WIB

CVE-2012-10062

XAMPP WebDAV PHP Upload Authentication Bypass RCE

A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible via /webdav/, accepts HTTP PUT requests using default credentials. This permits attackers to upload a malicio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-30T13:57:30.250Z. Updated 2026-05-15T11:14:07.305Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:14 WIB

Official record

HighPublished 30 Aug 2025, 20:49 WIB

CVE-2010-10017

WM Downloader 3.1.2.2 Buffer Overflow via Malformed M3U File

WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handler (SEH) records and execute arbitrary code. Exploitation occurs locally when a us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-30T13:49:28.100Z. Updated 2026-05-15T11:13:23.660Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:13 WIB

Official record

HighPublished 30 Aug 2025, 20:47 WIB

CVE-2009-20008

Green Dam 3.17 URL Processing Buffer Overflow

Green Dam Youth Escort version 3.17 is vulnerable to a stack-based buffer overflow when processing overly long URLs. The flaw resides in the URL filtering component, which fails to properly validate input length before copying user-supplied data into a fixed-size buffer. A remote attacker can exploit this vulnerability…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-30T13:47:42.991Z. Updated 2026-05-25T23:40:47.363Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 May 2026, 06:40 WIB

Official record

HighPublished 30 Aug 2025, 20:45 WIB

CVE-2005-10004

Cacti graph_view.php RCE via graph_start Parameter Injection

Cacti versions prior to 0.8.6-d contain a remote command execution vulnerability in the graph_view.php script. An authenticated user can inject arbitrary shell commands via the graph_start GET parameter, which is improperly handled during graph rendering. This flaw allows attackers to execute commands on the underlying…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-30T13:45:16.222Z. Updated 2026-07-28T01:46:23.918Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 30 Aug 2025, 20:42 WIB

CVE-2008-20001

activePDF WebGrabber ActiveX Control Buffer Overflow

activePDF WebGrabber version 3.8.2.0 contains a stack-based buffer overflow vulnerability in the GetStatus() method of the APWebGrb.ocx ActiveX control. By passing an overly long string to this method, a remote attacker can execute arbitrary code in the context of the vulnerable process. Although the control is not mar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-30T13:42:39.028Z. Updated 2026-05-15T11:13:10.109Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:13 WIB

Official record

HighPublished 30 Aug 2025, 19:47 WIB

CVE-2025-0165

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data SQL injection

IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-30T12:47:56.304Z. Updated 2025-09-02T20:47:44.200Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 03:47 WIB

Official record

HighPublished 30 Aug 2025, 16:19 WIB

CVE-2025-38677

f2fs: fix to avoid out-of-boundary access in dnode page

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-30T09:19:02.596Z. Updated 2026-08-05T12:03:53.615Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

HighPublished 30 Aug 2025, 06:31 WIB

CVE-2025-34165

NetSupport Manager < 14.12.0000 Stack-Based Buffer Overflow

A stack-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000 allows a remote, unauthenticated attacker to cause a denial of service (DoS) or potentially leak a limited amount of memory.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T23:31:18.668Z. Updated 2026-05-14T02:07:52.272Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:07 WIB

Official record

HighPublished 30 Aug 2025, 04:21 WIB

CVE-2025-58157

gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm

gnark is a zero-knowledge proof system framework. In version 0.12.0, there is a potential denial of service vulnerability when computing scalar multiplication is using the fake-GLV algorithm. This is because the algorithm didn't converge quickly enough for some of the inputs. This issue has been patched in version 0.13…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T21:21:35.677Z. Updated 2025-09-02T14:09:48.386Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated02 Sep 2025, 21:09 WIB

Official record

HighPublished 30 Aug 2025, 00:44 WIB

CVE-2025-58158

Harness Affected by Arbitrary File Write in Gitness LFS server

Harness Open Source is an end-to-end developer platform with Source Control Management, CI/CD Pipelines, Hosted Developer Environments, and Artifact Registries. Prior to version 3.3.0, Open Source Harness git LFS server (Gitness) exposes api to retrieve and upload files via git LFS. Implementation of upload git LFS fil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T17:44:31.852Z. Updated 2025-08-29T18:08:04.400Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:08 WIB

Official record

HighKEVPublished 30 Aug 2025, 00:30 WIB

CVE-2025-9377

Authenticated RCE via Parental Control command injection

The authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2: before 241108 and TL-WR841N/ND(MS) V9: before 241108. Both products have reached the status of EOL (end-of-life). It's recommend…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-08-29T17:30:33.700Z. Updated 2026-02-26T17:47:46.853Z.

CVSS8.6v4.0KEVListedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

HighPublished 30 Aug 2025, 00:17 WIB

CVE-2025-52861

VioStor

A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and la…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T17:17:26.199Z. Updated 2025-08-29T17:46:07.744Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 00:46 WIB

Official record

HighPublished 30 Aug 2025, 00:17 WIB

CVE-2025-33038

Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T17:17:11.149Z. Updated 2025-08-29T18:21:47.298Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:21 WIB

Official record

HighPublished 30 Aug 2025, 00:17 WIB

CVE-2025-33037

Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T17:17:05.931Z. Updated 2025-08-29T18:21:53.165Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:21 WIB

Official record

HighPublished 30 Aug 2025, 00:17 WIB

CVE-2025-33036

Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T17:17:00.802Z. Updated 2025-08-29T18:21:59.165Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:21 WIB

Official record

HighPublished 30 Aug 2025, 00:16 WIB

CVE-2025-33033

Qsync Central

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 ) an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T17:16:56.093Z. Updated 2025-08-29T18:22:05.936Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:22 WIB

Official record

HighPublished 30 Aug 2025, 00:16 WIB

CVE-2025-30278

Qsync Central

An improper certificate validation vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 4.5.0.7 ( 2025/04/23 )…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-29T17:16:46.575Z. Updated 2025-08-29T18:22:18.446Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:22 WIB

Official record