Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1081–1100 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 26 Mar 2025, 15:21 WIB

CVE-2025-2167

Event post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contribu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T08:21:50.518Z. Updated 2026-04-08T16:45:24.549Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

HighPublished 26 Mar 2025, 15:21 WIB

CVE-2025-2257

Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1081 to 1100 of 4001.First page Next page

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T08:21:49.944Z. Updated 2026-04-08T16:40:53.250Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:40 WIB

Official record

MedPublished 26 Mar 2025, 14:59 WIB

CVE-2024-30155

HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability

HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers may potentially be able to obtain access to the cookie values via a Cross-Site-Forgery-Request (CSRF).

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T07:59:52.442Z. Updated 2025-03-26T14:29:40.392Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated26 Mar 2025, 21:29 WIB

Official record

MedPublished 26 Mar 2025, 13:39 WIB

CVE-2023-52972

CVE-2023-52972

Huawei PCs have a vulnerability that allows low-privilege users to bypass SDDL permission checks . Successful exploitation this vulnerability could lead to termination of some system processes.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T06:39:03.010Z. Updated 2025-03-26T14:34:13.305Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated26 Mar 2025, 21:34 WIB

Official record

UnscoredPublished 26 Mar 2025, 13:00 WIB

CVE-2024-13146

Booknetic < 4.1.5 - Staff Creation via CSRF

The Booknetic WordPress plugin before 4.1.5 does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T06:00:08.756Z. Updated 2025-03-26T18:56:41.837Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 01:56 WIB

Official record

UnscoredPublished 26 Mar 2025, 13:00 WIB

CVE-2024-12683

Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS

The Smart Maintenance Mode WordPress plugin before 1.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T06:00:06.140Z. Updated 2025-03-26T19:00:12.737Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 02:00 WIB

Official record

UnscoredPublished 26 Mar 2025, 13:00 WIB

CVE-2024-11847

WP SVG Upload <= 1.0.0 - Author+ Stored XSS via SVG

The wp-svg-upload WordPress plugin through 1.0.0 does not sanitize SVG file contents, which enables users with at least the author role to SVG with malicious JavaScript to conduct Stored XSS attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T06:00:02.270Z. Updated 2025-03-26T19:02:33.515Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 02:02 WIB

Official record

MedPublished 26 Mar 2025, 12:22 WIB

CVE-2025-1784

Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and including, 2.19.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and abo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T05:22:53.484Z. Updated 2026-04-08T17:11:08.163Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:11 WIB

Official record

MedPublished 26 Mar 2025, 09:23 WIB

CVE-2025-1490

Smart Maintenance Mode <= 1.5.2 - Reflected Cross-Site Scripting via setstatus Parameter

The Smart Maintenance Mode plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘setstatus’ parameter in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T02:23:49.553Z. Updated 2026-04-08T17:31:01.695Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

MedPublished 26 Mar 2025, 09:23 WIB

CVE-2025-2165

SH Email Alert <= 1.0 - Reflected Cross-Site Scripting

The SH Email Alert plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mid' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T02:23:49.139Z. Updated 2026-04-08T17:27:44.737Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:27 WIB

Official record

MedPublished 26 Mar 2025, 09:23 WIB

CVE-2025-2573

Amazing service box Addons For WPBakery Page Builder <= 2.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Amazing service box Addons For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T02:23:48.765Z. Updated 2026-04-08T17:13:10.992Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:13 WIB

Official record

MedPublished 26 Mar 2025, 09:23 WIB

CVE-2025-2576

Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Ayyash Studio — The kick-start kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T02:23:48.216Z. Updated 2026-04-08T16:57:18.044Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:57 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2024-41643

CVE-2024-41643

An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T14:13:55.241Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 21:13 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2024-55963

CVE-2024-55963

An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T13:36:32.205Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:36 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2024-55964

CVE-2024-55964

An issue was discovered in Appsmith before 1.52. An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container. The attacker must be able to access Appsmith, login to it, create a datasource, create a query against that datasource, and execute…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T13:33:44.023Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:33 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2024-55965

CVE-2024-55965

An issue was discovered in Appsmith before 1.51. Users invited as "App Viewer" incorrectly have access to development information of a workspace (specifically, a list of datasources in a workspace they're a member of). This information disclosure does not expose sensitive data in the datasources, such as database passw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T13:28:11.936Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 20:28 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2025-25535

CVE-2025-25535

HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T14:12:14.582Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 21:12 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2025-26001

CVE-2025-26001

Telesquare TLR-2005KSH 1.1.4 is vulnerable to Information Disclosure via the parameter getUserNamePassword.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T14:06:52.277Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 21:06 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2025-26002

CVE-2025-26002

Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized stack overflow vulnerability when requesting the admin.cgi parameter with setSyncTimeHost.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T14:04:53.559Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 21:04 WIB

Official record

UnscoredPublished 26 Mar 2025, 07:00 WIB

CVE-2025-26003

CVE-2025-26003

Telesquare TLR-2005KSH 1.1.4 is affected by an unauthorized command execution vulnerability when requesting the admin.cgi parameter with setAutorest.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-26T00:00:00.000Z. Updated 2025-03-27T14:03:23.435Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2025, 21:03 WIB

Official record