Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1881–1900 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

HighPublished 20 Mar 2025, 17:08 WIB

CVE-2025-1796

Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator (PRNG) used for generating password reset codes. The application uses `random.randint` for this purpose, which is not suitable for cryptographic u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:46.897Z. Updated 2025-10-15T12:50:50.782Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

MedPublished 20 Mar 2025, 17:08 WIB

CVE-2024-11441

Stored XSS in Serge in serge-chat/serge

A stored cross-site scripting (XSS) vulnerability exists in Serge version 0.9.0. The vulnerability is due to improper neutralization of input during web page generation in the chat prompt. An attacker can exploit this vulnerability by sending a crafted message containing malicious HTML/JavaScript code, which will be st…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1881 to 1900 of 4001.First page Next page

Severity medium: primary CNA CVSS 6.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:46.700Z. Updated 2025-03-20T19:04:15.261Z.

CVSS6.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:04 WIB

Official record

HighPublished 20 Mar 2025, 17:08 WIB

CVE-2024-7765

Denial of Service in h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:46.654Z. Updated 2025-03-20T14:29:59.997Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:29 WIB

Official record

MedPublished 20 Mar 2025, 17:08 WIB

CVE-2024-13060

Improper Authorization in mintplex-labs/anything-llm

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:46.465Z. Updated 2025-10-15T12:49:34.786Z.

CVSS4.3v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

CritPublished 20 Mar 2025, 17:08 WIB

CVE-2024-12029

Remote Code Execution via Model Deserialization in invoke-ai/invokeai

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious code in model files, which…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:45.570Z. Updated 2025-03-20T14:33:03.024Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:33 WIB

Official record

HighPublished 20 Mar 2025, 17:08 WIB

CVE-2024-8501

Arbitrary File Download in modelscope/agentscope

An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This can lead to unauthorized access to sensitive information, including co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:44.723Z. Updated 2025-03-20T14:46:18.305Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:46 WIB

Official record

UnscoredPublished 20 Mar 2025, 15:59 WIB

CVE-2024-54016

compression bomb attack in Apache Seata Server

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): through <=2.2.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T08:59:26.175Z. Updated 2025-03-20T19:04:01.239Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:04 WIB

Official record

UnscoredPublished 20 Mar 2025, 15:58 WIB

CVE-2024-47552

Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating factors. Firs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T08:58:01.495Z. Updated 2026-03-30T08:35:40.674Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Mar 2026, 15:35 WIB

Official record

CritPublished 20 Mar 2025, 14:29 WIB

CVE-2025-2505

Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in those files. This can be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T07:29:57.851Z. Updated 2026-04-08T17:26:25.280Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:26 WIB

Official record

CritPublished 20 Mar 2025, 14:25 WIB

CVE-2024-12016

SQLi in CM Informatics' CM News

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Injection. This issue affects CM News: through 6.0. NOTE: The vendor was contacted and it was learned that the product is not supported.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T07:25:11.647Z. Updated 2026-06-02T06:30:52.082Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 13:30 WIB

Official record

HighPublished 20 Mar 2025, 14:13 WIB

CVE-2025-1385

Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specif…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T07:13:34.577Z. Updated 2025-03-20T15:10:30.494Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:10 WIB

Official record

MedPublished 20 Mar 2025, 13:54 WIB

CVE-2025-2108

140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Site Title' widget

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'title_tag' and 'html_tag' parameters in all versions up to, and including, 1.4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T06:54:57.470Z. Updated 2026-04-08T16:32:21.394Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:32 WIB

Official record

UnscoredPublished 20 Mar 2025, 13:00 WIB

CVE-2024-13881

LinkMyPosts <= 1.0 - Reflected XSS

The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T06:00:07.996Z. Updated 2025-03-20T19:30:08.203Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:30 WIB

Official record

UnscoredPublished 20 Mar 2025, 13:00 WIB

CVE-2024-13880

My Quota <= 1.0.8 - Reflected XSS

The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T06:00:07.305Z. Updated 2025-03-20T19:35:40.358Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:35 WIB

Official record

UnscoredPublished 20 Mar 2025, 13:00 WIB

CVE-2024-13878

SpotBot <= 0.1.8 - Reflected XSS

The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T06:00:06.978Z. Updated 2025-03-20T19:36:29.014Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:36 WIB

Official record

UnscoredPublished 20 Mar 2025, 13:00 WIB

CVE-2024-13877

Passbeemedia Web Push Notifications <= 1.0.0 - Reflected XSS

The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T06:00:06.305Z. Updated 2025-03-20T19:08:49.162Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:08 WIB

Official record

UnscoredPublished 20 Mar 2025, 13:00 WIB

CVE-2024-13876

Meintopf <= 0.2.1 - Reflected XSS

The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T06:00:05.661Z. Updated 2025-03-20T19:09:54.407Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:09 WIB

Official record

UnscoredPublished 20 Mar 2025, 13:00 WIB

CVE-2024-13875

WP Programmmanager <= 1.2 - Reflected XSS

The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T06:00:02.741Z. Updated 2025-03-20T19:12:27.612Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:12 WIB

Official record

HighPublished 20 Mar 2025, 12:49 WIB

CVE-2025-22228

CVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length

BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are the same.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T05:49:19.275Z. Updated 2026-02-26T19:09:20.934Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

MedPublished 20 Mar 2025, 12:22 WIB

CVE-2025-1766

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'payment_complete' function in all versions up to, and including, 4.0.24. This makes it possible for unauthenticated attackers to update t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T05:22:35.308Z. Updated 2026-04-08T17:32:40.671Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:32 WIB

Official record