Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,274 published records · 10 KEV · 4,274 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,274 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2606.1%
High1,18528%
Med1,72740%
Low1373.2%
None20.05%
Legacy00.00%
Unscored96323%

Matching records by UTC month

Oct 254,274

Signal coverage

KEV-listed: 10
With a forecast: 4,274
Unknown date: 0
Unscored severity: 963

Share of cohort: KEV 0.23% · forecast 100% · unscored 23%.

Showing 181–200 of 4,274By severity band: Critical · 9.0–10.0 260, High · 7.0–8.9 1,185, Medium · 4.0–6.9 1,727, Low · 0.1–3.9 137, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 963

CritPublished 31 Oct 2025, 04:30 WIB

CVE-2025-34284

Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:30:19.179Z. Updated 2026-09-30T17:20:05.017Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 31 Oct 2025, 04:29 WIB

CVE-2024-13995

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 181 to 200 of 4274.First page Next page

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:29:55.745Z. Updated 2025-11-17T18:21:47.489Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

HighPublished 31 Oct 2025, 04:29 WIB

CVE-2025-34283

Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user without API privileges could view another user's or their own API key value.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:29:37.293Z. Updated 2026-09-30T17:20:04.340Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:20 WIB

Official record

HighPublished 31 Oct 2025, 04:29 WIB

CVE-2024-13994

Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization

Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:29:17.240Z. Updated 2025-11-17T18:21:47.324Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 01:21 WIB

Official record

HighPublished 31 Oct 2025, 04:28 WIB

CVE-2024-13999

Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromise of network-integra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:28:50.777Z. Updated 2026-09-30T17:19:54.662Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 00:19 WIB

Official record

MedPublished 31 Oct 2025, 04:28 WIB

CVE-2023-7319

Nagios Network Analyzer < 2024R1 XSS via Percentile Calculator Menu

Nagios Network Analyzer versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Percentile Calculator menu. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:28:29.373Z. Updated 2025-11-17T21:36:23.299Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

MedPublished 31 Oct 2025, 04:28 WIB

CVE-2025-34278

Nagios Network Analyzer < 2024R1 Source Groups / Percentile Calculator Menu Stored XSS

Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:28:11.933Z. Updated 2025-11-17T21:36:25.596Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

HighPublished 31 Oct 2025, 04:27 WIB

CVE-2025-34280

Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal Function

Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:27:41.203Z. Updated 2025-11-17T21:36:25.762Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

MedPublished 31 Oct 2025, 04:27 WIB

CVE-2023-7321

Nagios Log Server < 2.1.14 XSS via Snapshots Page

Nagios Log Server versions prior to 2.1.14 are vulnerable to cross-site scripting (XSS) via the Snapshots Page. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:27:23.232Z. Updated 2025-11-17T21:36:23.480Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

MedPublished 31 Oct 2025, 04:27 WIB

CVE-2023-7323

Nagios Log Server < 2024R1 XSS via Create User Function

Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:27:03.493Z. Updated 2025-11-17T21:36:23.836Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

MedPublished 31 Oct 2025, 04:26 WIB

CVE-2020-36858

Nagios Log Server < 2.1.6 XSS via Create User, Edit User, & Manage Host Lists Pages

Nagios Log Server versions prior to 2.1.6 contain cross-site scripting (XSS) vulnerabilities via the web interface on the Create User, Edit User, and Manage Host Lists pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:26:38.984Z. Updated 2025-11-17T21:36:22.598Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

HighPublished 31 Oct 2025, 04:25 WIB

CVE-2025-34298

Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation

Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change workflow. A user could set their own email to an invalid value and, due to insufficient validation and authorization checks tied to email identity state, trigger inconsistent account state that grante…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:25:52.056Z. Updated 2025-11-17T21:36:25.925Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

CritPublished 31 Oct 2025, 04:25 WIB

CVE-2025-34277

Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID

Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-controlled data, leading to arbi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:25:32.852Z. Updated 2025-11-17T21:36:25.444Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

MedPublished 31 Oct 2025, 04:25 WIB

CVE-2025-34272

Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback

In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's default view. Depending on the product's …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:25:10.601Z. Updated 2025-11-17T21:36:24.794Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

HighPublished 31 Oct 2025, 04:24 WIB

CVE-2025-34273

Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard Deletion

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:24:43.451Z. Updated 2025-11-17T21:36:24.971Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

HighPublished 31 Oct 2025, 04:24 WIB

CVE-2024-58273

Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root

Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:24:15.621Z. Updated 2025-11-17T21:36:24.008Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

CritPublished 31 Oct 2025, 04:23 WIB

CVE-2025-34274

Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:23:54.741Z. Updated 2025-11-17T21:36:25.216Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

HighPublished 31 Oct 2025, 04:23 WIB

CVE-2023-7322

Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:23:34.547Z. Updated 2025-11-17T21:36:23.640Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

MedPublished 31 Oct 2025, 04:23 WIB

CVE-2016-15049

Nagios Log Server < 1.4.2 Dashboards Logs Table XSS

Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:23:13.241Z. Updated 2025-11-17T21:36:22.045Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record

HighPublished 31 Oct 2025, 04:22 WIB

CVE-2025-34271

Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept crede…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-10-30T21:22:51.043Z. Updated 2025-11-17T21:36:24.505Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Nov 2025, 04:36 WIB

Official record