Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 141–160 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

CritPublished 30 Sep 2025, 03:39 WIB

CVE-2025-34216

Vasion Print (formerly PrinterLogic) RCE and Password Leaks via API

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1026 and Application prior to version 20.0.2702 (VA deployments only) expose a set of unauthenticated REST API endpoints that return configuration files and clear‑text passwords. The same endpoints also disclose the Laravel APP_KEY used f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:39:13.361Z. Updated 2026-05-15T11:15:25.496Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 30 Sep 2025, 03:38 WIB

CVE-2025-34233

Vasion Print (formerly PrinterLogic) Insecure Use of file_get_contents()

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a protection mechanism failure vulnerability within the file_get_contents() function. When an administrator configures a printer’s hostname (or similar callback …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 141 to 160 of 4319.First page Next page

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:38:49.403Z. Updated 2026-05-15T11:15:36.540Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 30 Sep 2025, 03:38 WIB

CVE-2025-34207

Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 and Application prior to 20.0.2786 (VA and SaaS deployments) configure the SSH client within Docker instances with the following options: `UserKnownHostsFile=/dev/null`, `StrictHostKeyChecking=no`, and `ForwardAgent yes`. These settings dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:38:29.682Z. Updated 2026-05-15T11:15:21.717Z.

CVSS7.9v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

CritPublished 30 Sep 2025, 03:38 WIB

CVE-2025-34223

Vasion Print (formerly PrinterLogic) Insecure Installation Credentials

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain a default admin account and an installation‑time endpoint at `/admin/query/update_database.php` that can be accessed without authentication. An attacker who can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:38:05.154Z. Updated 2026-05-15T11:15:29.533Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 30 Sep 2025, 03:36 WIB

CVE-2025-34212

Vasion Print (formerly PrinterLogic) Insecure Build Pipeline

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and Application prior to version 20.0.1923 (VA/SaaS deployments) possess CI/CD weaknesses: the build pulls an unverified third-party image, downloads the VirtualBox Extension Pack over plain HTTP without signature validation, and gran…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:36:51.280Z. Updated 2026-05-15T11:15:23.938Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

CritPublished 30 Sep 2025, 03:36 WIB

CVE-2025-34211

Vasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private Keys

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA and SaaS deployments) contain a private SSL key and matching public certificate stored in cleartext. The key belongs to the hostname `pl‑local.com` and is used by the appliance to termin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:36:26.157Z. Updated 2026-05-15T11:15:23.227Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

CritPublished 30 Sep 2025, 03:35 WIB

CVE-2025-34209

Vasion Print (formerly PrinterLogic) Hardcoded GPG Private Key

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker images with the private GPG key and passphrase for the account *no‑reply+virtual‑appliance@printerlogic.com*. The key is stored in cleartext and the passphrase is har…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:35:11.366Z. Updated 2026-05-15T11:15:22.502Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

CritPublished 30 Sep 2025, 03:34 WIB

CVE-2025-34234

Vasion Print (formerly PrinterLogic) Hardcoded Encryption Private Keys

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain two hardcoded private keys that are shipped in the application containers (printerlogic/pi, printerlogic/printer-admin-api, and printercloud/pi). The keys are st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:34:45.051Z. Updated 2026-05-15T11:15:37.301Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

CritPublished 30 Sep 2025, 03:34 WIB

CVE-2025-34218

Vasion Print (formerly PrinterLogic) Exposed Internal Docker Instance

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) expose internal Docker containers through the gw Docker instance. The gateway publishes a /meta endpoint which lists every micro‑service container together with versio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:34:23.512Z. Updated 2026-05-15T11:15:26.290Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

MedPublished 30 Sep 2025, 03:34 WIB

CVE-2025-34232

Vasion Print (formerly PrinterLogic) Blind SSRF via Lexmark dellCheck.php

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contain a blind server-side request forgery (SSRF) vulnerability reachable via the /var/www/app/console_release/lexmark/dellCheck.php script that can be exploited by an …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:34:00.950Z. Updated 2026-05-15T11:15:35.724Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 30 Sep 2025, 03:13 WIB

CVE-2025-45376

CVE-2025-45376

Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:13:36.928Z. Updated 2026-02-26T17:47:50.058Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

MedPublished 30 Sep 2025, 03:01 WIB

CVE-2025-35034

Medical Informatics Engineering Enterprise Health reflected cross site scripting via portlet_user_id

Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthenticated attacker can craft a URL that can execute arbitrary JavaScript in the victim's browser. This issue is fixed as of 2025-03-14.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:01:58.419Z. Updated 2025-09-30T16:52:32.033Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 23:52 WIB

Official record

MedPublished 30 Sep 2025, 03:01 WIB

CVE-2025-35033

Medical Informatics Engineering Enterprise Health CSV injection

Medical Informatics Engineering Enterprise Health has a CSV injection vulnerability that allows a remote, authenticated attacker to inject macros in downloadable CSV files. This issue is fixed as of 2025-03-14.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:01:38.144Z. Updated 2025-09-30T16:52:03.135Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 23:52 WIB

Official record

MedPublished 30 Sep 2025, 03:01 WIB

CVE-2025-35032

Medical Informatics Engineering Enterprise Health arbitrary file upload

Medical Informatics Engineering Enterprise Health allows authenticated users to upload arbitrary files. The impact of this behavior depends on how files are accessed. This issue is fixed as of 2025-04-08.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:01:09.311Z. Updated 2025-09-30T16:51:39.465Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 23:51 WIB

Official record

MedPublished 30 Sep 2025, 03:00 WIB

CVE-2025-35031

Medical Informatics Engineering Enterprise Health includes session token in debug output

Medical Informatics Engineering Enterprise Health includes the user's current session token in debug output. An attacker could convince a user to send this output to the attacker, thus allowing the attacker to impersonate that user. This issue is fixed as of 2025-04-08.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:00:42.546Z. Updated 2025-09-30T16:51:17.132Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 23:51 WIB

Official record

HighPublished 30 Sep 2025, 03:00 WIB

CVE-2025-35030

Medical Informatics Engineering Enterprise Health cross site request forgery

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthenticated attacker to trick administrative users into clicking a crafted URL and perform actions on behalf of that administrative user. This issue is fixed as of 2025-04-08.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T20:00:16.950Z. Updated 2025-09-30T16:50:38.126Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated30 Sep 2025, 23:50 WIB

Official record

CritPublished 30 Sep 2025, 02:11 WIB

CVE-2025-34196

Vasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded Password

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain a hardcoded private key for the PrinterLogic Certificate Authority (CA) and a hardcoded password in product configuration files. The Windows client ships the CA …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T19:11:16.044Z. Updated 2026-05-15T11:15:15.893Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated15 May 2026, 18:15 WIB

Official record

HighPublished 30 Sep 2025, 02:02 WIB

CVE-2025-41252

Username enumeration vulnerability

Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially leading to unauthorized access attempts. Impact: Username enumeration → facilitates unauthorized access. Attack Vector: Remote, unauthenticated. Seve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T19:02:07.283Z. Updated 2025-09-29T19:14:38.914Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated30 Sep 2025, 02:14 WIB

Official record

HighPublished 30 Sep 2025, 01:45 WIB

CVE-2025-41251

Weak password recovery vulnerability

VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit this to enumerate valid usernames, potentially enabling brute-force attacks. Impact: Username enumeration → credential brute force risk. Attack Vector: Remote, unauthenticated. Severity: Important. CVSS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T18:45:16.614Z. Updated 2026-02-26T17:47:50.851Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:47 WIB

Official record

MedPublished 30 Sep 2025, 01:39 WIB

CVE-2025-57871

BUG-000174020 - Reflected XSS vulnerability identified in Portal for ArcGIS. (11.3, 11.1, 10.9.1)

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-29T18:39:13.631Z. Updated 2025-09-29T18:51:37.943Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated30 Sep 2025, 01:51 WIB

Official record