Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1501–1520 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 21 Mar 2025, 21:52 WIB

CVE-2021-25635

Content Manipulation with Certificate Validation Attack

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T14:52:50.484Z. Updated 2025-03-21T15:13:24.100Z.

CVSS5.2v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 22:13 WIB

Official record

MedPublished 21 Mar 2025, 21:49 WIB

CVE-2025-30157

Envoy crashes when HTTP ext_proc processes local replies

Envoy is a cloud-native high-performance edge/middle/service proxy. Prior to 1.33.1, 1.32.4, 1.31.6, and 1.30.10, Envoy's ext_proc HTTP filter is at risk of crashing if a local reply is sent to the external server due to the filter's life time issue. A known situation is the failure of a websocket handshake will trigge…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1501 to 1520 of 4001.First page Next page

Published 2025-03-21T14:49:18.113Z. Updated 2025-03-21T15:15:11.034Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 22:15 WIB

Official record

CritPublished 21 Mar 2025, 21:34 WIB

CVE-2025-29927

Authorization Bypass in Next.js Middleware

Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T14:34:49.570Z. Updated 2025-04-08T15:17:05.315Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2025, 22:17 WIB

Official record

MedPublished 21 Mar 2025, 21:31 WIB

CVE-2025-2593

FastCMS list sql injection

A vulnerability has been found in FastCMS up to 0.1.5 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /api/client/article/list. The manipulation of the argument orderBy leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T14:31:04.784Z. Updated 2025-03-21T15:19:01.984Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 22:19 WIB

Official record

MedPublished 21 Mar 2025, 21:24 WIB

CVE-2025-27612

Libcontainer is affected by capabilities elevation

libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T14:24:28.756Z. Updated 2025-03-21T15:20:00.538Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 22:20 WIB

Official record

MedPublished 21 Mar 2025, 21:14 WIB

CVE-2025-2598

AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178.2 or later and ensu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T14:14:29.040Z. Updated 2025-10-14T18:38:18.174Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 01:38 WIB

Official record

HighPublished 21 Mar 2025, 21:13 WIB

CVE-2025-24915

CVE-2025-24915

When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T14:13:35.208Z. Updated 2026-02-26T19:09:18.159Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

MedPublished 21 Mar 2025, 21:00 WIB

CVE-2025-2592

Open Asset Import Library Assimp CSMLoader.cpp InternReadFile heap-based overflow

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T14:00:18.480Z. Updated 2025-03-21T14:25:58.496Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 21:25 WIB

Official record

MedPublished 21 Mar 2025, 20:31 WIB

CVE-2025-2591

Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 divide by zero

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The attack can be initiate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T13:31:08.439Z. Updated 2025-03-21T14:26:30.345Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 21:26 WIB

Official record

MedPublished 21 Mar 2025, 20:00 WIB

CVE-2025-2590

code-projects Human Resource Management System recruitment.go UpdateRecruitmentById cross site scripting

A vulnerability was found in code-projects Human Resource Management System 1.0.1. It has been classified as problematic. Affected is the function UpdateRecruitmentById of the file \handler\recruitment.go. The manipulation of the argument c leads to cross site scripting. It is possible to launch the attack remotely. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T13:00:08.940Z. Updated 2025-03-21T13:29:48.139Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 20:29 WIB

Official record

MedPublished 21 Mar 2025, 19:31 WIB

CVE-2025-2589

code-projects Human Resource Management System Account.go Index improper authorization

A vulnerability was found in code-projects Human Resource Management System 1.0.1 and classified as critical. This issue affects the function Index of the file \handler\Account.go. The manipulation of the argument user_cookie leads to improper authorization. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T12:31:04.867Z. Updated 2025-03-21T17:23:43.618Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:23 WIB

Official record

MedPublished 21 Mar 2025, 19:00 WIB

CVE-2025-2588

Hercules Augeas fa.c re_case_expand null pointer dereference

A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/fa.c. The manipulation of the argument re leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T12:00:10.758Z. Updated 2025-03-21T17:24:55.111Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:24 WIB

Official record

MedPublished 21 Mar 2025, 19:00 WIB

CVE-2025-2587

Jinher OA C6 IncentivePlanFulfillAppprove.aspx sql injection

A vulnerability, which was classified as critical, was found in Jinher OA C6 1.0. This affects an unknown part of the file IncentivePlanFulfillAppprove.aspx. The manipulation of the argument httpOID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T12:00:08.867Z. Updated 2025-03-21T17:26:41.533Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:26 WIB

Official record

MedPublished 21 Mar 2025, 18:50 WIB

CVE-2025-2597

Reflected Cross-Site Scripting (XSS) vulnerability in ITIUM 6050

Reflected Cross-Site Scripting (XSS) in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malicious Javascript code via GET and POST requests to the ‘/index.php’ endpoint and injecting code into the ‘id_session.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T11:50:02.392Z. Updated 2025-03-21T12:24:15.768Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 19:24 WIB

Official record

HighPublished 21 Mar 2025, 15:26 WIB

CVE-2025-25068

Bypassing MFA Enforcement on Plugin Endpoints

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T08:26:32.027Z. Updated 2025-03-21T12:25:55.494Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 19:25 WIB

Official record

MedPublished 21 Mar 2025, 15:25 WIB

CVE-2025-24920

Unauthorized Bookmark Creation and Modification in Archived Channels

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T08:25:44.676Z. Updated 2025-03-21T12:28:00.367Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 19:28 WIB

Official record

MedPublished 21 Mar 2025, 15:24 WIB

CVE-2025-30179

MFA Enforcement Bypass in Search APIs

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T08:24:57.929Z. Updated 2025-03-21T17:27:31.203Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:27 WIB

Official record

MedPublished 21 Mar 2025, 15:24 WIB

CVE-2025-25274

Unauthorized Command Execution in Archived Channels

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T08:24:13.165Z. Updated 2025-03-21T17:27:56.172Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:27 WIB

Official record

MedPublished 21 Mar 2025, 15:23 WIB

CVE-2025-27933

Unauthorized Private-to-Public Channel Conversion

Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T08:23:20.955Z. Updated 2025-03-21T13:32:57.219Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 20:32 WIB

Official record

LowPublished 21 Mar 2025, 15:22 WIB

CVE-2025-27715

Auto-Enrollment of Team Admins into Private Channels without explicit consent

Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T08:22:25.321Z. Updated 2025-03-21T13:35:01.832Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 20:35 WIB

Official record