Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1901–1920 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

HighPublished 20 Mar 2025, 12:22 WIB

CVE-2025-1770

Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion

The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.0.24 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T05:22:34.878Z. Updated 2026-04-08T16:56:18.670Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:56 WIB

Official record

MedPublished 20 Mar 2025, 12:22 WIB

CVE-2025-1314

Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctf_clear_cache_admin() function. This makes it possible for unauthenticated attackers to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1901 to 1920 of 4001.First page Next page

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T05:22:34.298Z. Updated 2026-04-08T16:43:12.366Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:43 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2024-48590

CVE-2024-48590

Inflectra SpiraTeam 7.2.00 is vulnerable to Server-Side Request Forgery (SSRF) via the NewsReaderService. This allows an attacker to escalate privileges and obtain sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-24T15:07:05.597Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 22:07 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2024-48591

CVE-2024-48591

Inflectra SpiraTeam 7.2.00 is vulnerable to Cross Site Scripting (XSS). A specially crafted SVG file can be uploaded that will render and execute JavaScript upon direct viewing.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T18:55:52.017Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:55 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2024-57440

CVE-2024-57440

D-Link DSL-3788 revA1 1.01R1B036_EU_EN is vulnerable to Buffer Overflow via the COMM_MAKECustomMsg function of the webproc cgi

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2026-01-20T19:51:55.294Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Jan 2026, 02:51 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-25758

CVE-2025-25758

An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-24T15:12:36.790Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 22:12 WIB

Official record

CritPublished 20 Mar 2025, 07:00 WIB

CVE-2025-26852

CVE-2025-26852

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-04-03T20:27:35.447Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated04 Apr 2025, 03:27 WIB

Official record

CritPublished 20 Mar 2025, 07:00 WIB

CVE-2025-26853

CVE-2025-26853

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-04-03T20:18:08.325Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated04 Apr 2025, 03:18 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29101

CVE-2025-29101

Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-24T13:21:10.892Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 20:21 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29121

CVE-2025-29121

A vulnerability was found in Tenda AC6 V15.03.05.16. The vulnerability affects the functionality of the /goform/fast_setting_wifi_set file form_fast_setting_wifi_set. Using the timeZone parameter causes a stack-based buffer overflow.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T18:53:26.965Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:53 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29149

CVE-2025-29149

Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T18:50:10.087Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:50 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29214

CVE-2025-29214

Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T18:54:40.415Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:54 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29215

CVE-2025-29215

Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T17:31:46.187Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:31 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29217

CVE-2025-29217

Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2026-07-05T00:58:33.985Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 07:58 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29218

CVE-2025-29218

Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T17:30:37.206Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:30 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29410

CVE-2025-29410

A cross-site scripting (XSS) vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T18:57:01.623Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 01:57 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29411

CVE-2025-29411

An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-24T15:09:49.427Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 22:09 WIB

Official record

UnscoredPublished 20 Mar 2025, 07:00 WIB

CVE-2025-29412

CVE-2025-29412

A cross-site scripting (XSS) vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T00:00:00.000Z. Updated 2025-03-21T19:16:55.239Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 02:16 WIB

Official record

HighPublished 20 Mar 2025, 03:42 WIB

CVE-2025-27774

Applio allows SSRF and file write in model_download.py

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 156 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-19T20:42:56.129Z. Updated 2025-03-20T19:09:31.583Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:09 WIB

Official record

HighPublished 20 Mar 2025, 03:42 WIB

CVE-2025-27775

Applio allows SSRF and file write in model_download.py

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 143 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-19T20:42:47.335Z. Updated 2025-03-20T19:09:55.498Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:09 WIB

Official record