Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 791 published records · 4 KEV · 791 with a forecast · 0 unknown dates
791 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.51% · forecast 100% · unscored 0.00%.
CVE-2025-66423
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-30T00:00:00.000Z. Updated 2025-12-01T14:10:34.912Z.
OrangeHRM is Vulnerable to Persistent Session Access Due to Missing Invalidation After User Disable and Password Change
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid indefinitely. As a result, a disabled user, or an attacker using a…
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T03:06:25.730Z. Updated 2025-12-01T21:05:42.865Z.
OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow
OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originally initiated. After obtaining a valid reset link for any account t…
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T03:05:46.498Z. Updated 2025-12-01T15:10:18.376Z.
OpenObserve's Invite Token Lifecycle Misconfiguration
OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid si…
Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T02:45:42.467Z. Updated 2025-12-01T15:33:42.150Z.
Kiteworks MFT is vulnerable to an Incorrectly Specified Destination in a Communication Channel
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances to intercept upstream co…
Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T02:25:23.493Z. Updated 2025-12-01T15:41:27.509Z.
Kiteworks MFT is vulnerable to Insufficient Session Expiration
Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0.
Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T02:24:18.115Z. Updated 2025-12-03T15:11:36.226Z.
AIS-catcher Integer Underflow in MQTT Packet Parsing leading to Heap Buffer Overflow
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field. This leads to…
Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T01:57:52.613Z. Updated 2025-12-01T14:11:01.007Z.
LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability
LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing specially crafted OpenAPI specs to its "Actions" feature and making the LLM use those actions. It could be used by an authenticated user with access to this featur…
Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T01:26:18.757Z. Updated 2025-12-01T14:11:07.641Z.
Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intende…
Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-29T00:43:02.452Z. Updated 2025-12-01T14:11:22.446Z.
org.lz4:lz4-java - Out-of-Bounds Memory Access
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T15:52:56.140Z. Updated 2025-12-29T12:41:30.868Z.
Path Traversal Vulnerability in keras-team/keras via Tar Archive Extraction in keras.utils.get_file()
Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe …
Severity high: primary CNA CVSS 8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T14:06:02.069Z. Updated 2025-11-28T15:08:13.714Z.
Uniong｜WebITR - Arbitrary File Read
WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T07:49:23.701Z. Updated 2025-11-28T14:17:37.695Z.
Uniong｜WebITR - SQL Injection
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T07:40:16.729Z. Updated 2025-11-28T14:25:07.959Z.
Uniong｜WebITR - SQL Injection
WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T07:35:48.522Z. Updated 2025-11-28T14:56:46.238Z.
Uniong｜WebITR - Authorization Bypass
WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T07:31:08.294Z. Updated 2025-11-28T14:56:17.174Z.
CVE-2025-58308
Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T03:04:29.657Z. Updated 2025-11-28T14:59:16.172Z.
CVE-2025-58302
Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T02:56:00.604Z. Updated 2025-11-28T15:00:39.763Z.
CVE-2025-58310
Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T02:36:41.070Z. Updated 2025-11-28T15:04:12.281Z.
CVE-2025-58316
DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability.
Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T02:31:02.797Z. Updated 2025-11-28T15:05:09.805Z.
CVE-2025-58303
UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability.
Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-11-28T02:28:38.566Z. Updated 2025-11-28T15:05:30.934Z.