Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,274 published records · 10 KEV · 4,274 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,274 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2606.1%
High1,18528%
Med1,72740%
Low1373.2%
None20.05%
Legacy00.00%
Unscored96323%

Matching records by UTC month

Oct 254,274

Signal coverage

KEV-listed: 10
With a forecast: 4,274
Unknown date: 0
Unscored severity: 963

Share of cohort: KEV 0.23% · forecast 100% · unscored 23%.

Showing 141–160 of 4,274By severity band: Critical · 9.0–10.0 260, High · 7.0–8.9 1,185, Medium · 4.0–6.9 1,727, Low · 0.1–3.9 137, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 963

MedPublished 31 Oct 2025, 04:46 WIB

CVE-2022-50587

Nagios XI < 5.8.9 Stored XSS via Command Names in Apply Config Error Text

Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) via the Apply Configuration error text. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:46:15.817Z. Updated 2025-11-17T18:21:44.766Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:45 WIB

CVE-2022-50586

Nagios XI < 5.8.9 Stored XSS via BPI Info URL

Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:45:53.493Z. Updated 2025-11-17T18:21:44.541Z.

Showing 141 to 160 of 4274.First page Next page

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:45 WIB

CVE-2022-50588

Nagios XI < 5.8.9 Stored XSS in Update Checking

Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:45:33.708Z. Updated 2025-11-17T18:21:44.935Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

HighPublished 31 Oct 2025, 04:45 WIB

CVE-2020-36869

Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page

Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly sanitized, allowing SQL inject…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:45:10.468Z. Updated 2025-11-17T18:21:41.647Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

HighPublished 31 Oct 2025, 04:44 WIB

CVE-2016-15050

Nagios XI < 5.2.4 SQL Injection in Notification Search

Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate parameterization or sanitation, allowing an authenticated user to manipulate database queries. Successful exploitation …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:44:49.116Z. Updated 2025-11-17T18:21:38.140Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

CritPublished 31 Oct 2025, 04:44 WIB

CVE-2024-13996

Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change

Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:44:26.053Z. Updated 2026-09-30T17:19:52.620Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:19 WIB

Official record

MedPublished 31 Oct 2025, 04:43 WIB

CVE-2024-13993

Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers

Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:43:55.640Z. Updated 2025-11-17T18:21:47.166Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:43 WIB

CVE-2013-10071

Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality

Nagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:43:34.559Z. Updated 2025-11-17T18:21:37.382Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

CritPublished 31 Oct 2025, 04:43 WIB

CVE-2024-14008

Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard

Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:43:07.355Z. Updated 2026-09-30T17:20:00.211Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

CritPublished 31 Oct 2025, 04:42 WIB

CVE-2025-34286

Nagios XI < 2026R1 RCE via Run Check Command in CCM

Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run Check command. Insufficient validation/escaping of parameters used to build backend command lines allows an authenticated administrator to inject shell metacharacters that are executed on the server. S…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:42:44.052Z. Updated 2026-05-14T02:08:09.418Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated14 May 2026, 09:08 WIB

Official record

CritPublished 31 Oct 2025, 04:42 WIB

CVE-2024-14003

Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the und…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:42:19.225Z. Updated 2026-09-30T17:19:57.417Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:19 WIB

Official record

CritPublished 31 Oct 2025, 04:41 WIB

CVE-2025-34134

Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile and bpi_configfile) allow an authenticated administrative user…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:41:58.188Z. Updated 2026-09-30T17:20:02.985Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 31 Oct 2025, 04:41 WIB

CVE-2011-10035

Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPE

Nagios XI versions prior to 2011R1.9 contain privilege escalation vulnerabilities in the scripts that install or update system crontab entries. Due to time-of-check/time-of-use race conditions and missing synchronization or final-path validation, a local low-privileged user could manipulate filesystem state during cron…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:41:36.116Z. Updated 2025-11-17T18:21:35.708Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

CritPublished 31 Oct 2025, 04:41 WIB

CVE-2024-14009

Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile

Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and operations, an authenticated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:41:13.594Z. Updated 2026-09-30T17:20:00.920Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 31 Oct 2025, 04:40 WIB

CVE-2024-14004

Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)

Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the Nagios XI system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:40:51.523Z. Updated 2026-09-30T17:19:58.122Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:19 WIB

Official record

HighPublished 31 Oct 2025, 04:40 WIB

CVE-2018-25123

Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component

Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:40:26.892Z. Updated 2025-11-17T18:21:39.196Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

HighPublished 31 Oct 2025, 04:40 WIB

CVE-2020-36868

Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script

Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some deployments executed with elev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:40:03.387Z. Updated 2025-11-17T18:21:41.468Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

HighPublished 31 Oct 2025, 04:39 WIB

CVE-2025-34287

Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl

Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodically as the nagios user but owned by www-data. Because the file was writable by www-data, an attacker with web server privileges could modify its contents, leading to arbitrary code execution as the nag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:39:43.482Z. Updated 2025-11-17T18:21:51.502Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

MedPublished 31 Oct 2025, 04:39 WIB

CVE-2025-34135

Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:39:22.649Z. Updated 2026-09-30T17:20:03.656Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 31 Oct 2025, 04:39 WIB

CVE-2021-47700

Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory

Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local or co-hosted processes could read/overwrite export artifacts or manipulate paths, risking disclosure or tampering and potential code execution depending on deploy…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:39:02.693Z. Updated 2025-11-17T18:21:43.914Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record