Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 181–200 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 31 Jan 2025, 02:45 WIB

CVE-2025-0145

Zoom Workplace Apps for Windows - Untrusted Search Path

Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:45:39.432Z. Updated 2025-01-30T21:23:22.776Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated31 Jan 2025, 04:23 WIB

Official record

LowPublished 31 Jan 2025, 02:44 WIB

CVE-2025-0144

Zoom Workplace Apps - Out-of-bounds Write

Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:44:06.908Z. Updated 2025-01-30T21:29:47.382Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated31 Jan 2025, 04:29 WIB

Official record

MedPublished 31 Jan 2025, 02:42 WIB

CVE-2025-0143

Zoom Workplace Apps for Linux - Out-of-bounds Write

Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:42:12.816Z. Updated 2025-01-31T15:38:36.360Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated31 Jan 2025, 22:38 WIB

Official record

MedPublished 31 Jan 2025, 02:38 WIB

CVE-2025-0142

Zoom Jenkins Marketplace plugin - Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of information via network access.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:38:51.716Z. Updated 2025-01-31T15:39:15.080Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated31 Jan 2025, 22:39 WIB

Official record

HighPublished 31 Jan 2025, 02:20 WIB

CVE-2025-24802

Soundness issue with Plonky2 look up tables

Plonky2 is a SNARK implementation based on techniques from PLONK and FRI. Lookup tables, whose length is not divisible by 26 = floor(num_routed_wires / 3) always include the 0 -> 0 input-output pair. Thus a malicious prover can always prove that f(0) = 0 for any lookup table f (unless its length happens to be divisible…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:20:14.250Z. Updated 2025-01-30T19:55:17.620Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated31 Jan 2025, 02:55 WIB

Official record

MedPublished 31 Jan 2025, 02:17 WIB

CVE-2024-10604

Identifiable Header Values In Fuchsia Leading To Tracking of The User

Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:17:10.012Z. Updated 2025-02-24T12:00:19.548Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Feb 2025, 19:00 WIB

Official record

MedPublished 31 Jan 2025, 02:14 WIB

CVE-2024-10603

CVE-2024-10603

Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:14:38.619Z. Updated 2025-02-24T11:59:44.637Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2025, 18:59 WIB

Official record

MedPublished 31 Jan 2025, 02:12 WIB

CVE-2024-10026

Improved Seeding and Hashing In gVisor

A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T19:12:27.994Z. Updated 2025-02-24T11:50:42.192Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated24 Feb 2025, 18:50 WIB

Official record

MedPublished 31 Jan 2025, 01:53 WIB

CVE-2025-0681

New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols

The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:53:09.669Z. Updated 2025-01-30T19:11:58.156Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Jan 2025, 02:11 WIB

Official record

CritPublished 31 Jan 2025, 01:50 WIB

CVE-2025-0680

New Rock Technologies Cloud Connected Devices has a Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.

Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary devices connected to the cloud.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:50:10.932Z. Updated 2025-01-30T19:15:29.817Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated31 Jan 2025, 02:15 WIB

Official record

UnscoredPublished 31 Jan 2025, 01:49 WIB

CVE-2024-44142

CVE-2024-44142

The issue was addressed with improved bounds checks. This issue is fixed in GarageBand 10.4.12. Processing a maliciously crafted image may lead to arbitrary code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:49:12.899Z. Updated 2026-04-02T18:18:05.246Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:18 WIB

Official record

HighPublished 31 Jan 2025, 01:41 WIB

CVE-2025-24507

CVE-2025-24507

This vulnerability allows appliance compromise at boot time.

Excerpt language: en.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:41:50.906Z. Updated 2025-02-05T05:37:57.252Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated05 Feb 2025, 12:37 WIB

Official record

MedPublished 31 Jan 2025, 01:39 WIB

CVE-2025-24506

CVE-2025-24506

A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:39:19.670Z. Updated 2025-02-05T05:36:34.940Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Feb 2025, 12:36 WIB

Official record

HighPublished 31 Jan 2025, 01:36 WIB

CVE-2025-24505

CVE-2025-24505

This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:36:09.450Z. Updated 2025-02-05T05:36:07.471Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated05 Feb 2025, 12:36 WIB

Official record

MedPublished 31 Jan 2025, 01:31 WIB

CVE-2025-24504

CVE-2025-24504

An improper input validation the CSRF filter results in unsanitized user input written to the application logs.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:31:41.795Z. Updated 2025-02-05T04:52:30.495Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Feb 2025, 11:52 WIB

Official record

CritPublished 31 Jan 2025, 01:27 WIB

CVE-2025-24503

CVE-2025-24503

A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:27:08.641Z. Updated 2025-02-05T04:51:10.380Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated05 Feb 2025, 11:51 WIB

Official record

MedPublished 31 Jan 2025, 01:24 WIB

CVE-2025-24502

CVE-2025-24502

An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:24:32.902Z. Updated 2025-02-05T04:50:21.091Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Feb 2025, 11:50 WIB

Official record

MedPublished 31 Jan 2025, 01:21 WIB

CVE-2025-24501

CVE-2025-24501

An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:21:37.817Z. Updated 2025-02-12T20:41:36.667Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:41 WIB

Official record

HighPublished 31 Jan 2025, 01:17 WIB

CVE-2025-0683

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor

In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a machine-in-the-middle s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:17:35.867Z. Updated 2025-02-12T20:41:36.789Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:41 WIB

Official record

HighPublished 31 Jan 2025, 01:17 WIB

CVE-2025-0626

Hidden Functionality vulnerability in Contec Health CMS8000 Patient Monitor

The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function also enables the network interface of the device if it is disabled. The function is triggered by attempting to update the device from the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T18:17:29.717Z. Updated 2025-03-01T17:12:24.132Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated02 Mar 2025, 00:12 WIB

Official record

Showing 181 to 200 of 4273.First page Next page