Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 1641–1660 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

HighPublished 18 Jun 2025, 02:56 WIB

CVE-2025-30680

CVE-2025-30680

A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations. Please note: this vulnerability only affects the SaaS instance of Apex Central - customers that automatically a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T19:56:23.405Z. Updated 2025-06-20T13:12:46.037Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Jun 2025, 20:12 WIB

Official record

MedPublished 18 Jun 2025, 02:56 WIB

CVE-2025-30679

CVE-2025-30679

A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T19:56:11.050Z. Updated 2025-06-20T13:12:51.981Z.

Showing 1641 to 1660 of 3682.First page Next page

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Jun 2025, 20:12 WIB

Official record

MedPublished 18 Jun 2025, 02:56 WIB

CVE-2025-30678

CVE-2025-30678

A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain parameters leading to information disclosure on affected installations.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T19:56:01.476Z. Updated 2025-06-20T13:12:57.801Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated20 Jun 2025, 20:12 WIB

Official record

MedPublished 18 Jun 2025, 02:30 WIB

CVE-2025-5141

Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache

A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #0474 on Linux, AIX, and Solaris allows low privilege local users…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T19:30:51.781Z. Updated 2025-08-29T20:11:13.423Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated30 Aug 2025, 03:11 WIB

Official record

HighPublished 18 Jun 2025, 02:05 WIB

CVE-2025-34511

Sitecore PowerShell Extension RCE via Unrestricted Upload

Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T19:05:10.466Z. Updated 2026-02-26T17:50:30.660Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 18 Jun 2025, 01:46 WIB

CVE-2025-34510

Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:46:04.239Z. Updated 2026-02-26T17:50:31.002Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 18 Jun 2025, 01:43 WIB

CVE-2025-49487

CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in order to exploit thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:43:11.176Z. Updated 2025-06-17T19:52:40.992Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 02:52 WIB

Official record

MedPublished 18 Jun 2025, 01:42 WIB

CVE-2025-49158

CVE-2025-49158

An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:42:56.705Z. Updated 2025-06-17T19:55:43.823Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 02:55 WIB

Official record

HighPublished 18 Jun 2025, 01:42 WIB

CVE-2025-49157

CVE-2025-49157

A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:42:49.084Z. Updated 2025-06-17T20:18:26.406Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 03:18 WIB

Official record

HighPublished 18 Jun 2025, 01:42 WIB

CVE-2025-49156

CVE-2025-49156

A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:42:39.613Z. Updated 2025-06-17T20:21:26.155Z.

CVSS7v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 03:21 WIB

Official record

HighPublished 18 Jun 2025, 01:42 WIB

CVE-2025-49155

CVE-2025-49155

An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to arbitrary code execution on affected installations.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:42:31.517Z. Updated 2025-06-17T20:22:40.129Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 03:22 WIB

Official record

HighPublished 18 Jun 2025, 01:42 WIB

CVE-2025-49154

CVE-2025-49154

An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key memory-mapped files which could then have severe consequences for the security and stability of affected installations. Please note: an attacker must first obtai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:42:10.085Z. Updated 2025-06-17T20:25:33.603Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 03:25 WIB

Official record

HighPublished 18 Jun 2025, 01:35 WIB

CVE-2025-49850

Out-of-bounds Read in Write in LS Electric GMWin 4

A Heap-based Buffer Overflow vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data structures.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:35:29.191Z. Updated 2025-06-17T20:41:37.493Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated18 Jun 2025, 03:41 WIB

Official record

HighPublished 18 Jun 2025, 01:34 WIB

CVE-2025-49849

Out-of-bounds Read in Write in LS Electric GMWin 4

An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data structures.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:34:02.051Z. Updated 2025-06-17T20:39:03.679Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated18 Jun 2025, 03:39 WIB

Official record

HighPublished 18 Jun 2025, 01:31 WIB

CVE-2025-49848

Out-of-bounds Write in LS Electric GMWin 4

An out-of-bounds write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing past the end of allocated data structures.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:31:45.825Z. Updated 2026-06-04T20:49:50.946Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated05 Jun 2026, 03:49 WIB

Official record

HighPublished 18 Jun 2025, 01:20 WIB

CVE-2025-34509

Sitecore XM and XP Hardcoded Credentials

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HT…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T18:20:57.441Z. Updated 2026-02-26T17:50:31.319Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

CritPublished 18 Jun 2025, 00:43 WIB

CVE-2025-49220

CVE-2025-49220

An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T17:43:23.501Z. Updated 2026-02-26T17:50:31.672Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

CritPublished 18 Jun 2025, 00:43 WIB

CVE-2025-49219

CVE-2025-49219

An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T17:43:12.062Z. Updated 2026-02-26T17:50:31.992Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

HighPublished 18 Jun 2025, 00:42 WIB

CVE-2025-47867

CVE-2025-47867

A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to execute as PHP code and lead to remote code execution on affected installations.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T17:42:55.846Z. Updated 2026-02-26T17:50:32.563Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 18 Jun 2025, 00:42 WIB

CVE-2025-47866

CVE-2025-47866

An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-17T17:42:42.396Z. Updated 2025-06-17T18:36:07.522Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 01:36 WIB

Official record