Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 128 published records · 0 KEV · 128 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

128 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low128100%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Sep 25128

Signal coverage

KEV-listed: 0
With a forecast: 128
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.00% · forecast 100% · unscored 0.00%.

Showing 1–20 of 128By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

LowPublished 01 Oct 2025, 01:12 WIB

CVE-2025-11195

Rapid7 AppSpider Project Name Validation Bypass

Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration file to a name that already exists. This issue stems from a lack of effective verification of the uniqueness of project names when editing them o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T18:12:50.204Z. Updated 2025-09-30T20:33:45.909Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:33 WIB

Official record

LowPublished 01 Oct 2025, 00:54 WIB

CVE-2025-23291

CVE-2025-23291

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to information disclosure.

Excerpt language: en.

Severity low: primary CNA CVSS 2.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T17:54:22.801Z. Updated 2025-09-30T20:33:10.103Z.

Showing 1 to 20 of 128.Next page

CVSS2.4v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 03:33 WIB

Official record

LowPublished 30 Sep 2025, 07:00 WIB

CVE-2025-56675

CVE-2025-56675

The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and password.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-30T00:00:00.000Z. Updated 2025-09-30T19:32:42.572Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated01 Oct 2025, 02:32 WIB

Official record

LowPublished 30 Sep 2025, 04:51 WIB

CVE-2025-59163

vet MCP Server SSE Transport DNS Rebinding Vulnerability

vet is an open source software supply chain security tool. Versions 1.12.4 and below are vulnerable to a DNS rebinding attack due to lack of HTTP Host and Origin header validation. Data from the vet scan sqlite3 database may be exposed to remote attackers when vet is used as an MCP server in SSE mode with default ports…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T21:51:31.243Z. Updated 2025-09-30T14:49:25.166Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 21:49 WIB

Official record

LowPublished 27 Sep 2025, 07:05 WIB

CVE-2025-36144

IBM watsonx.data information disclosure

IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-27T00:05:08.668Z. Updated 2025-09-29T14:04:30.872Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated29 Sep 2025, 21:04 WIB

Official record

LowPublished 26 Sep 2025, 22:53 WIB

CVE-2025-59842

JupyterLab LaTeX typesetter links did not enforce `noopener` attribute

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener attribute. This is deemed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T15:53:37.253Z. Updated 2025-09-26T17:52:42.227Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:52 WIB

Official record

LowPublished 26 Sep 2025, 21:20 WIB

CVE-2025-36326

IBM Controller information disclosure

IBM Cognos Controller 11.0.0 through 11.0.1, and IBM Controller 11.1.0 through 11.1.1 could allow an attacker to obtain sensitive information due to the use of hardcoded cryptographic keys for signing session cookies.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T14:20:46.219Z. Updated 2025-09-26T14:54:41.385Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated26 Sep 2025, 21:54 WIB

Official record

LowPublished 26 Sep 2025, 16:11 WIB

CVE-2025-5069

Incorrect Ownership Assignment in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to gain unauthorized access to confidential issues by creating a project with an identical name to the victim's project.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T09:11:09.636Z. Updated 2025-09-26T13:12:27.389Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated26 Sep 2025, 20:12 WIB

Official record

LowPublished 26 Sep 2025, 16:10 WIB

CVE-2025-10868

Business Logic Errors in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 where certain string conversion methods exhibit performance degradation with large inputs.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T09:10:49.812Z. Updated 2025-09-26T13:13:02.624Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated26 Sep 2025, 20:13 WIB

Official record

LowPublished 26 Sep 2025, 16:04 WIB

CVE-2025-10867

Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T09:04:26.530Z. Updated 2025-09-26T15:33:34.488Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated26 Sep 2025, 22:33 WIB

Official record

LowPublished 26 Sep 2025, 16:04 WIB

CVE-2025-10871

Missing Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions from 16.6 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. Project Maintainers can exploit a vulnerability where they can assign custom roles to users with permissions exceeding their own, effectively granting themselves elevated privileges.

Excerpt language: en.

Severity low: primary CNA CVSS 3.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T09:04:21.687Z. Updated 2026-02-26T17:47:54.446Z.

CVSS3.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

LowPublished 26 Sep 2025, 14:52 WIB

CVE-2025-1396

Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled

A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validate_username setting. This behavior allows malicious actors to determine which u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T07:52:52.297Z. Updated 2025-09-30T15:43:31.106Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated30 Sep 2025, 22:43 WIB

Official record

LowPublished 26 Sep 2025, 10:25 WIB

CVE-2025-10173

ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on the post_save() function in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Editor-lev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-26T03:25:33.813Z. Updated 2026-04-08T16:44:13.423Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:44 WIB

Official record

LowPublished 26 Sep 2025, 05:32 WIB

CVE-2025-10977

JeecgBoot deleteBatch improper authorization

A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is conside…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T22:32:08.286Z. Updated 2025-09-26T15:38:18.442Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated26 Sep 2025, 22:38 WIB

Official record

LowPublished 26 Sep 2025, 05:02 WIB

CVE-2025-10976

JeecgBoot getDepartUserList improper authorization

A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T22:02:08.243Z. Updated 2025-09-26T17:52:54.563Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated27 Sep 2025, 00:52 WIB

Official record

LowPublished 25 Sep 2025, 22:53 WIB

CVE-2025-60019

Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()

glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T15:53:02.569Z. Updated 2026-06-30T07:57:02.631Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 14:57 WIB

Official record

LowPublished 25 Sep 2025, 21:52 WIB

CVE-2025-59838

Monkeytype Vulnerable to Self-XSS on loading saved custom text

Monkeytype is a minimalistic and customizable typing test. In versions 25.36.0 and prior, improper handling of user input when loading a saved custom text results in XSS. This issue has been fixed in version 25.44.0.

Excerpt language: en.

Severity low: primary CNA CVSS 2.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T14:52:16.612Z. Updated 2026-10-13T15:24:20.935Z.

CVSS2.4v4.0KEVNot listedEPSSPresentUpdated13 Oct 2026, 22:24 WIB

Official record

LowPublished 25 Sep 2025, 21:41 WIB

CVE-2025-36857

Rapid7 Appspider Broken Access Control Vulnerability

Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom configuration files. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T14:41:35.939Z. Updated 2025-09-25T16:03:45.231Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated25 Sep 2025, 23:03 WIB

Official record

LowPublished 25 Sep 2025, 20:11 WIB

CVE-2025-5494

Privilege Escalation

ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.

Excerpt language: en.

Severity low: primary CNA CVSS 3.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-25T13:11:49.423Z. Updated 2025-09-25T15:15:34.354Z.

CVSS3.9v3.1KEVNot listedEPSSPresentUpdated25 Sep 2025, 22:15 WIB

Official record

LowPublished 25 Sep 2025, 02:48 WIB

CVE-2025-59824

Omni Wireguard SideroLink potential escape

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutually authenticate and authorize access. The WireGuard interface …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 0.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-24T19:48:23.935Z. Updated 2025-09-24T20:09:36.681Z.

CVSS0.5v4.0KEVNot listedEPSSPresentUpdated25 Sep 2025, 03:09 WIB

Official record