Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 317 published records · 9 KEV · 317 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

317 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit317100%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Dec 25317

Signal coverage

KEV-listed: 9
With a forecast: 317
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 2.8% · forecast 100% · unscored 0.00%.

Showing 1–20 of 317By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

CritPublished 01 Jan 2026, 04:55 WIB

CVE-2025-69288

Titra has Remote Code Execution in Admin Functionality

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version 0.99.49 fixes the issue.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-31T21:55:44.667Z. Updated 2026-01-02T14:35:24.773Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated02 Jan 2026, 21:35 WIB

Official record

CritPublished 01 Jan 2026, 01:39 WIB

CVE-2021-47744

Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root

Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the static 'Chameleon' password to gain remote root access via Telnet or SSH on affected devices.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 317.Next page

Published 2025-12-31T18:39:11.435Z. Updated 2026-01-02T16:23:14.918Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Jan 2026, 23:23 WIB

Official record

CritPublished 01 Jan 2026, 01:39 WIB

CVE-2020-36904

Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration, including changing admi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-31T18:39:08.542Z. Updated 2026-01-02T20:16:14.728Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated03 Jan 2026, 03:16 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2025-15114

Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability

Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security measures and disable the alarm system without additional authe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:47.116Z. Updated 2026-03-11T19:29:49.602Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated12 Mar 2026, 02:29 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2025-15113

Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload

Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binary images. Attackers can exploit this vulnerability to overwrite flash program memory and potentially execute arbitrary code on the home auto…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:46.694Z. Updated 2026-03-11T19:30:48.494Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated12 Mar 2026, 02:30 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2025-15111

Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability

Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access. Attackers can exploit the weak default administrative credentials to obtain full control of the home automation system.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:45.831Z. Updated 2026-03-11T19:30:33.994Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated12 Mar 2026, 02:30 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2023-54327

Tinycontrol LAN Controller 1.58a Authentication Bypass via Admin Password Change

Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:43.728Z. Updated 2026-05-14T02:07:05.311Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:07 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2023-53983

Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass

Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:42.839Z. Updated 2026-10-01T21:44:54.086Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 04:44 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50803

JM-DATA ONU JF511-TV 1.0.67 Default Credentials Vulnerability

JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:41.999Z. Updated 2026-01-05T20:24:15.140Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated06 Jan 2026, 03:24 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50796

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Remote Code Execution via upload.cgi

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:39.503Z. Updated 2026-10-01T19:19:13.061Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50794

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Unauthenticated Command Injection via Username

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter. Attackers can exploit index.php and login.php scripts by injecting arbitrary shell commands through the HTTP POST 'username' parameter to execute system commands.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:38.681Z. Updated 2026-10-01T19:19:11.695Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50696

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass

SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations. Attackers can leverage these static credentials to gain unauthorized access to the device across Linux and Windows distributions without requiring user…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:35.214Z. Updated 2026-10-01T19:19:06.504Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

CritPublished 31 Dec 2025, 05:41 WIB

CVE-2022-50691

MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh

MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T22:41:33.477Z. Updated 2026-05-14T02:06:58.500Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:06 WIB

Official record

CritPublished 30 Dec 2025, 23:59 WIB

CVE-2025-68926

RustFS has a gRPC Hardcoded Token Authentication Bypass

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T16:59:53.999Z. Updated 2026-01-05T14:23:55.080Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Jan 2026, 21:23 WIB

Official record

CritPublished 30 Dec 2025, 23:48 WIB

CVE-2025-52835

WordPress WING WordPress Migrator plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T16:48:13.719Z. Updated 2026-04-28T16:13:20.143Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

CritPublished 30 Dec 2025, 23:02 WIB

CVE-2025-15255

Tenda W6-S R7websSsecurityHandler httpd stack-based overflow

A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Executing a manipulation of the argument Cookie can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclose…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T16:02:07.019Z. Updated 2026-02-24T06:17:51.072Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 13:17 WIB

Official record

CritPublished 30 Dec 2025, 19:23 WIB

CVE-2023-54292

RDMA/irdma: Fix data race on CQP request done

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. Annotate lockless intent with READ_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T12:23:30.419Z. Updated 2026-10-15T21:41:44.172Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

CritPublished 30 Dec 2025, 19:23 WIB

CVE-2023-54280

cifs: fix potential race when tree connecting ipc

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential race when tree connecting ipc Protect access of TCP_Server_Info::hostname when building the ipc tree name as it might get freed in cifsd thread and thus causing an use-after-free bug in __tree_connect_dfs_target(). Also, while at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T12:23:22.335Z. Updated 2026-10-15T21:41:43.877Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

CritPublished 30 Dec 2025, 19:16 WIB

CVE-2023-54269

SUNRPC: double free xprt_ctxt while still in use

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T12:16:00.317Z. Updated 2026-10-15T21:41:43.730Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

CritPublished 30 Dec 2025, 19:15 WIB

CVE-2023-54258

cifs: fix potential oops in cifs_oplock_break

In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can oc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-30T12:15:52.855Z. Updated 2026-10-15T21:41:43.411Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record