Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1521–1540 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

LowPublished 21 Mar 2025, 14:31 WIB

CVE-2025-2584

WebAssembly wabt binary-reader-interp.cc GetReturnCallDropKeepCount heap-based overflow

A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T07:31:03.732Z. Updated 2025-03-21T12:29:54.383Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 19:29 WIB

Official record

MedPublished 21 Mar 2025, 14:00 WIB

CVE-2024-13903

quickjs-ng QuickJS qjs quickjs.c JS_GetRuntime stack-based overflow

A vulnerability was found in quickjs-ng QuickJS up to 0.8.0. It has been declared as problematic. Affected by this vulnerability is the function JS_GetRuntime of the file quickjs.c of the component qjs. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. Upgrading to version 0.9.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1521 to 1540 of 4001.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T07:00:14.647Z. Updated 2025-03-21T12:31:02.832Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 19:31 WIB

Official record

MedPublished 21 Mar 2025, 13:31 WIB

CVE-2025-2583

SimpleMachines SMF ManageNews.php cross site scripting

A vulnerability was found in SimpleMachines SMF 2.1.4. It has been classified as problematic. This affects an unknown part of the file ManageNews.php. The manipulation of the argument subject/message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T06:31:06.127Z. Updated 2025-04-21T12:41:44.675Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 19:41 WIB

Official record

MedPublished 21 Mar 2025, 13:31 WIB

CVE-2025-2582

SimpleMachines SMF ManageAttachments.php cross site scripting

A vulnerability was found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this issue is some unknown functionality of the file ManageAttachments.php. The manipulation of the argument Notice leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T06:31:04.195Z. Updated 2025-04-21T12:41:42.523Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 19:41 WIB

Official record

MedPublished 21 Mar 2025, 13:01 WIB

CVE-2024-50053

Stored XSS

Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T06:01:39.945Z. Updated 2025-05-05T13:24:19.125Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated05 May 2025, 20:24 WIB

Official record

MedPublished 21 Mar 2025, 12:00 WIB

CVE-2025-2581

xmedcon DICOM File malloc integer underflow

A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM File Handler. The manipulation leads to integer underflow. The attack can be launched remotely. Upgrading to version 0.25.1 is able to address this issue. It is re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T05:00:22.250Z. Updated 2025-11-03T19:45:09.550Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:45 WIB

Official record

HighPublished 21 Mar 2025, 09:23 WIB

CVE-2025-26336

CVE-2025-26336

Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX version(s) prior to 3.41.200.202209300499, contain(s) a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T02:23:46.785Z. Updated 2025-03-21T13:59:49.924Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 20:59 WIB

Official record

HighPublished 21 Mar 2025, 09:02 WIB

CVE-2025-2585

EBM Technologies EBM Maintenance Center - SQL injection

EBM Maintenance Center From EBM Technologies has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T02:02:22.600Z. Updated 2025-03-21T15:37:57.576Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated21 Mar 2025, 22:37 WIB

Official record

CritPublished 21 Mar 2025, 07:29 WIB

CVE-2025-29814

Microsoft Partner Center Elevation of Privilege Vulnerability

Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:29:58.478Z. Updated 2026-02-26T19:09:18.661Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

HighPublished 21 Mar 2025, 07:29 WIB

CVE-2025-29807

Microsoft Dataverse Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:29:57.849Z. Updated 2026-02-26T19:09:19.089Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:19 WIB

CVE-2023-28207

CVE-2023-28207

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3, macOS Monterey 12.6.4, macOS Big Sur 11.7.5. A plug-in may be able to inherit app permissions and access user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:19:33.108Z. Updated 2025-03-25T12:58:01.183Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 19:58 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2024-53348

CVE-2024-53348

LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-24T18:04:15.441Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 01:04 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2024-53349

CVE-2024-53349

Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-24T18:06:35.847Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 01:06 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2024-53350

CVE-2024-53350

Insecure permissions in kubeslice v1.3.1 allow attackers to gain access to the service account's token, leading to escalation of privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-24T18:07:36.466Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 01:07 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2024-53351

CVE-2024-53351

Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-24T14:47:23.712Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 21:47 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2024-57490

CVE-2024-57490

Guangzhou Hongfan Technology Co., LTD. iOffice20 has any user login vulnerability. An attacker can log in to any system account including the system administrator through a logical flaw.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-24T17:43:43.079Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 00:43 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2025-29223

CVE-2025-29223

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability via the pt parameter in the traceRoute function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-21T18:13:33.188Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:13 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2025-29226

CVE-2025-29226

In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["count"] parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-25T12:53:41.472Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 19:53 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2025-29227

CVE-2025-29227

In Linksys E5600 V1.1.0.26, the \usr\share\lua\runtime.lua file contains a command injection vulnerability in the runtime.pingTest function via the pt["pkgsize"] parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-21T18:11:39.776Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:11 WIB

Official record

UnscoredPublished 21 Mar 2025, 07:00 WIB

CVE-2025-29230

CVE-2025-29230

Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.emailReg function. The vulnerability can be triggered via the `pt["email"]` parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-21T00:00:00.000Z. Updated 2025-03-21T18:04:37.898Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:04 WIB

Official record