Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 1–20 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

HighPublished 01 Oct 2025, 06:04 WIB

CVE-2025-24525

Keysight Ixia Vision Product Family Use of Hard-coded Cryptographic Key

Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replace the TLS certificate that shipped with the device. Remediation is available in Version 6.9.1, r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T23:04:14.688Z. Updated 2025-10-01T15:02:51.427Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2025, 22:02 WIB

Official record

MedPublished 01 Oct 2025, 05:52 WIB

CVE-2025-55191

Repository Credentials Race Condition Crashes Argo CD Server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0-rc1, 3.1.0-rc1 through 3.1.7, and 3.0.0-rc1 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 4319.Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T22:52:19.838Z. Updated 2025-10-06T18:32:34.110Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated07 Oct 2025, 01:32 WIB

Official record

MedPublished 01 Oct 2025, 05:36 WIB

CVE-2025-43826

CVE-2025-43826

Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allow remote attackers to inject arb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T22:36:31.957Z. Updated 2025-10-01T15:03:22.427Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Oct 2025, 22:03 WIB

Official record

CritPublished 01 Oct 2025, 03:00 WIB

CVE-2025-10659

MegaSys Enterprises Telenium Online Web Application OS Command Injection

The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input. This vulnerability occurs due to the insecure termination of a regular expression check within the endpoint. Because the input is not correctly validated or sa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T20:00:53.126Z. Updated 2025-09-30T20:41:17.681Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:41 WIB

Official record

MedPublished 01 Oct 2025, 02:42 WIB

CVE-2025-36262

IBM Planning Analytics Local information disclosure

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T19:42:37.033Z. Updated 2025-09-30T20:41:05.565Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:41 WIB

Official record

MedPublished 01 Oct 2025, 02:41 WIB

CVE-2025-36132

IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sess…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T19:41:19.912Z. Updated 2025-09-30T20:40:56.983Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:40 WIB

Official record

MedPublished 01 Oct 2025, 01:57 WIB

CVE-2025-43827

CVE-2025-43827

Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T18:57:54.351Z. Updated 2025-09-30T20:32:41.390Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:32 WIB

Official record

LowPublished 01 Oct 2025, 01:12 WIB

CVE-2025-11195

Rapid7 AppSpider Project Name Validation Bypass

Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T18:12:50.204Z. Updated 2025-09-30T20:33:45.909Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:33 WIB

Official record

HighPublished 01 Oct 2025, 00:55 WIB

CVE-2025-23293

CVE-2025-23293

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to information disclosure.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T17:55:29.157Z. Updated 2025-09-30T20:33:39.011Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:33 WIB

Official record

MedPublished 01 Oct 2025, 00:55 WIB

CVE-2025-23292

CVE-2025-23292

NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service (UI component).

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T17:55:02.678Z. Updated 2025-09-30T20:33:31.040Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:33 WIB

Official record

LowPublished 01 Oct 2025, 00:54 WIB

CVE-2025-23291

CVE-2025-23291

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to information disclosure.

Excerpt language: en.

Severity low: primary CNA CVSS 2.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T17:54:22.801Z. Updated 2025-09-30T20:33:10.103Z.

CVSS2.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:33 WIB

Official record

CritPublished 01 Oct 2025, 00:47 WIB

CVE-2025-10725

Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the cluster's confidentiality,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T17:47:08.577Z. Updated 2025-12-24T13:39:32.225Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated24 Dec 2025, 20:39 WIB

Official record

HighPublished 30 Sep 2025, 23:07 WIB

CVE-2025-6034

Out of Bounds Read in DefaultFontOptions() in NI Circuit Design Suite

There is a memory corruption vulnerability due to an out of bounds read in DefaultFontOptions() when using SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T16:07:21.551Z. Updated 2026-02-26T17:47:45.995Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

HighPublished 30 Sep 2025, 23:05 WIB

CVE-2025-6033

Memory Corruption issue in XML_Serialize() in NI Circuit Design Suite

There is a memory corruption vulnerability due to an out of bounds write in XML_Serialize() when using SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T16:05:53.142Z. Updated 2026-02-26T17:47:46.367Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

UnscoredPublished 30 Sep 2025, 23:02 WIB

CVE-2025-54477

Joomla! Core - [20250902] User-Enumeration in passkey authentication method

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T16:02:40.036Z. Updated 2025-10-01T04:34:47.521Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Oct 2025, 11:34 WIB

Official record

MedPublished 30 Sep 2025, 23:02 WIB

CVE-2025-54476

Joomla! Core - [20250901] Inadequate content filtering within the checkAttribute filter code

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T16:02:38.757Z. Updated 2025-10-01T04:34:46.488Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Oct 2025, 11:34 WIB

Official record

CritPublished 30 Sep 2025, 22:06 WIB

CVE-2025-7493

Freeipa: idm: privilege escalation from host to domain admin in freeipa

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for the admin@REALM credential, FreeIPA still does not validate t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T15:06:46.836Z. Updated 2026-02-26T17:47:47.013Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

HighPublished 30 Sep 2025, 21:52 WIB

CVE-2025-7779

CVE-2025-7779

Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True Image (macOS) before build 42389, Acronis True Image for SanDisk (macOS) before build 42198, Acronis True Image for Western Digital (macOS) before build 42197, Acronis True Image OEM (macOS) before bu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T14:52:46.494Z. Updated 2026-04-10T13:17:25.600Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 20:17 WIB

Official record

HighPublished 30 Sep 2025, 21:52 WIB

CVE-2025-11178

CVE-2025-11178

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before build 42386, Acronis True Image for Western Digital (Windows) before build 42636, Acronis True Image for SanDisk (Windows) before build 42679, Acronis True Image OEM (Windows) before b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T14:52:20.711Z. Updated 2026-04-10T13:16:25.613Z.

CVSS7.3v3.0KEVNot listedEPSSPresentUpdated10 Apr 2026, 20:16 WIB

Official record

MedPublished 30 Sep 2025, 21:37 WIB

CVE-2025-57852

Openshift-ai: privilege escalation via excessive /etc/passwd permissions

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T14:37:10.024Z. Updated 2026-03-06T23:45:29.053Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated07 Mar 2026, 06:45 WIB

Official record