Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 1641–1660 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 16 Apr 2025, 17:31 WIB

CVE-2025-3683

PCMan FTP Server SIZE Command buffer overflow

A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component SIZE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:31:05.489Z. Updated 2025-04-16T19:10:38.710Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Apr 2025, 02:10 WIB

Official record

MedPublished 16 Apr 2025, 17:31 WIB

CVE-2025-3682

PCMan FTP Server PASV Command buffer overflow

A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component PASV Command Handler. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1641 to 1660 of 4033.First page Next page

Published 2025-04-16T10:31:04.320Z. Updated 2025-04-16T19:11:27.224Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Apr 2025, 02:11 WIB

Official record

UnscoredPublished 16 Apr 2025, 17:24 WIB

CVE-2024-58092

nfsd: fix legacy client tracking initialization

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix legacy client tracking initialization Get rid of the nfsd4_legacy_tracking_ops->init() call in check_for_legacy_methods(). That will be handled in the caller (nfsd4_client_tracking_init()). Otherwise, we'll wind up calling nfsd4_legacy_tr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:24:53.056Z. Updated 2026-05-11T21:03:08.939Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:03 WIB

Official record

HighPublished 16 Apr 2025, 17:23 WIB

CVE-2025-30960

WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability

Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:23:51.746Z. Updated 2026-04-28T16:12:02.172Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

UnscoredPublished 16 Apr 2025, 17:23 WIB

CVE-2025-22023

usb: xhci: Don't skip on Stopped - Length Invalid

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Don't skip on Stopped - Length Invalid Up until commit d56b0b2ab142 ("usb: xhci: ensure skipped isoc TDs are returned when isoc ring is stopped") in v6.11, the driver didn't skip missed isochronous TDs when handling Stoppend and Stopped - …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:23:28.381Z. Updated 2026-05-11T21:11:09.855Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:11 WIB

Official record

HighPublished 16 Apr 2025, 17:23 WIB

CVE-2025-22022

usb: xhci: Apply the link chain quirk on NEC isoc endpoints

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 (one with start/stop bug, one without) were seen to cause IOMMU faults after some Missed Service Errors. Faulting address is immediately afte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:23:27.423Z. Updated 2026-08-05T11:56:04.678Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

CritPublished 16 Apr 2025, 17:20 WIB

CVE-2025-22021

netfilter: socket: Lookup orig tuple for IPv6 SNAT

In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the right socket (if any). Then socket_match() can correctly check …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:20:37.695Z. Updated 2026-10-15T21:51:56.689Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:51 WIB

Official record

HighPublished 16 Apr 2025, 17:20 WIB

CVE-2025-22020

memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:20:37.045Z. Updated 2026-08-05T11:56:02.551Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

HighPublished 16 Apr 2025, 17:20 WIB

CVE-2025-22019

bcachefs: bch2_ioctl_subvolume_destroy() fixes

In the Linux kernel, the following vulnerability has been resolved: bcachefs: bch2_ioctl_subvolume_destroy() fixes bch2_evict_subvolume_inodes() was getting stuck - due to incorrectly pruning the dcache. Also, fix missing permissions checks.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:20:36.342Z. Updated 2026-08-05T11:56:01.490Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:56 WIB

Official record

MedPublished 16 Apr 2025, 17:00 WIB

CVE-2025-3681

PCMan FTP Server MODE Command buffer overflow

A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component MODE Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T10:00:05.699Z. Updated 2025-04-16T19:12:05.383Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Apr 2025, 02:12 WIB

Official record

MedPublished 16 Apr 2025, 16:31 WIB

CVE-2025-3680

PCMan FTP Server LANG Command buffer overflow

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component LANG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T09:31:05.904Z. Updated 2025-04-16T19:27:37.819Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Apr 2025, 02:27 WIB

Official record

MedPublished 16 Apr 2025, 16:31 WIB

CVE-2025-3679

PCMan FTP Server HOST Command buffer overflow

A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component HOST Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T09:31:04.757Z. Updated 2025-04-16T19:28:22.757Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Apr 2025, 02:28 WIB

Official record

MedPublished 16 Apr 2025, 16:14 WIB

CVE-2025-27936

Webhook Secret Exposure via Timing attack in MSteams plugin

Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T09:14:55.095Z. Updated 2025-04-16T14:32:45.176Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated16 Apr 2025, 21:32 WIB

Official record

LowPublished 16 Apr 2025, 16:14 WIB

CVE-2025-31363

Data exfiltration via AI plugin Jira tool

Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool.

Excerpt language: en.

Severity low: primary CNA CVSS 3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T09:14:15.992Z. Updated 2025-04-16T14:33:01.674Z.

CVSS3v3.1KEVNot listedEPSSPresentUpdated16 Apr 2025, 21:33 WIB

Official record

MedPublished 16 Apr 2025, 16:00 WIB

CVE-2025-3678

PCMan FTP Server HELP Command buffer overflow

A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component HELP Command Handler. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T09:00:11.362Z. Updated 2025-04-16T14:39:12.985Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated16 Apr 2025, 21:39 WIB

Official record

HighPublished 16 Apr 2025, 15:40 WIB

CVE-2023-32197

Rancher's External RoleTemplates can lead to privilege escalation

A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalation in specific scenarios.This issue affects rancher: from 2.7.0 before 2.7.14, from 2.8.0 before 2.8.5.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T08:40:54.464Z. Updated 2026-02-26T18:28:14.100Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

CritPublished 16 Apr 2025, 15:37 WIB

CVE-2024-22036

Rancher Remote Code Execution via Cluster/Node Drivers

A vulnerability has been identified within Rancher where a cluster or node driver can be used to escape the chroot jail and gain root access to the Rancher container itself. In production environments, further privilege escalation is possible based on living off the land within the Rancher container itself. For the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T08:37:54.218Z. Updated 2026-02-26T18:28:14.414Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

HighPublished 16 Apr 2025, 15:31 WIB

CVE-2024-52281

Stored Cross-site Scripting vulnerability in Rancher UI

A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T08:31:11.378Z. Updated 2026-02-26T18:28:14.954Z.

CVSS8.9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 16 Apr 2025, 15:31 WIB

CVE-2025-3677

lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization

A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function split_files/apply_delta_low_cpu_mem of the file fastchat/model/apply_delta.py. The manipulation leads to deserialization. An attack has to be approached locally.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T08:31:04.475Z. Updated 2025-04-21T11:28:25.222Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 18:28 WIB

Official record

MedPublished 16 Apr 2025, 15:22 WIB

CVE-2025-3104

WP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function

The WP STAGING Pro WordPress Backup Plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 6.1.2 due to missing capability checks on the getOutdatedPluginsRequest() function. This makes it possible for unauthenticated attackers to reveal outdated installed active or inactive plug…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-16T08:22:17.436Z. Updated 2026-04-08T16:54:18.717Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:54 WIB

Official record