Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 1381–1400 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 22 Jan 2025, 03:52 WIB

CVE-2025-21490

CVE-2025-21490

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Succes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T20:52:52.253Z. Updated 2025-11-03T20:57:28.170Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 03:57 WIB

Official record

MedPublished 22 Jan 2025, 03:52 WIB

CVE-2025-21489

CVE-2025-21489

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Region Mapping). Supported versions that are affected are 12.2.3-12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1381 to 1400 of 4273.First page Next page

Published 2025-01-21T20:52:51.881Z. Updated 2025-01-23T19:35:50.228Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated24 Jan 2025, 02:35 WIB

Official record

MedPublished 22 Jan 2025, 03:52 WIB

CVE-2024-21245

CVE-2024-21245

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T20:52:45.397Z. Updated 2025-01-23T19:39:12.899Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated24 Jan 2025, 02:39 WIB

Official record

CritPublished 22 Jan 2025, 02:21 WIB

CVE-2025-24024

Mjolnir v1.9.0 accepts commands from any room

Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components if enabled. Version 1.9.1 reverts the feature that introduced the bug, a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T19:21:56.038Z. Updated 2025-01-21T19:32:21.204Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated22 Jan 2025, 02:32 WIB

Official record

HighPublished 22 Jan 2025, 01:46 WIB

CVE-2025-23369

Improper Verification of Cryptographic Signature in GitHub Enterprise Server Allows Signature Spoofing by Improper Validation

An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This vulnerability affected …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T18:46:30.711Z. Updated 2025-02-12T20:41:22.296Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:41 WIB

Official record

MedPublished 22 Jan 2025, 00:51 WIB

CVE-2025-24020

WeGIA Open Redirect vulnerability

WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arbitrary external URLs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:51:16.698Z. Updated 2025-02-12T20:41:21.848Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:41 WIB

Official record

MedPublished 22 Jan 2025, 00:46 WIB

CVE-2025-22150

Undici Uses Insufficiently Random Values

Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be predicted if several of its generated values are known. If there is a mecha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:46:58.872Z. Updated 2025-02-12T20:41:22.041Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:41 WIB

Official record

HighPublished 22 Jan 2025, 00:36 WIB

CVE-2025-24019

YesWiki vulnerable to authenticated arbitrary file deletion

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without any limitation on the filesystem's scope. This vulnerability al…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:36:10.367Z. Updated 2025-02-12T20:41:22.176Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:41 WIB

Official record

MedPublished 22 Jan 2025, 00:23 WIB

CVE-2025-24461

CVE-2025-24461

In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:23:20.740Z. Updated 2025-01-21T18:41:29.249Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Jan 2025, 01:41 WIB

Official record

MedPublished 22 Jan 2025, 00:23 WIB

CVE-2025-24460

CVE-2025-24460

In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:23:20.190Z. Updated 2025-01-21T18:41:36.784Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated22 Jan 2025, 01:41 WIB

Official record

MedPublished 22 Jan 2025, 00:23 WIB

CVE-2025-24459

CVE-2025-24459

In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:23:19.526Z. Updated 2025-01-21T18:41:43.325Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated22 Jan 2025, 01:41 WIB

Official record

HighPublished 22 Jan 2025, 00:23 WIB

CVE-2025-24458

CVE-2025-24458

In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:23:18.934Z. Updated 2025-01-21T18:41:51.242Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated22 Jan 2025, 01:41 WIB

Official record

MedPublished 22 Jan 2025, 00:23 WIB

CVE-2025-24457

CVE-2025-24457

In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:23:18.057Z. Updated 2025-01-21T18:41:57.529Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated22 Jan 2025, 01:41 WIB

Official record

MedPublished 22 Jan 2025, 00:23 WIB

CVE-2025-24456

CVE-2025-24456

In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:23:17.295Z. Updated 2025-01-21T18:42:05.201Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated22 Jan 2025, 01:42 WIB

Official record

MedPublished 22 Jan 2025, 00:21 WIB

CVE-2025-23996

WordPress AnyRoad plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in AnyRoad AnyRoad anyguide allows Cross Site Request Forgery.This issue affects AnyRoad: from n/a through <= 1.3.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:21:52.454Z. Updated 2026-05-11T23:01:59.617Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:01 WIB

Official record

HighPublished 22 Jan 2025, 00:21 WIB

CVE-2025-23994

WordPress Estatebud – Properties & Listings plugin <= 5.5.0 - CSRF to Settings Update & Stored XSS vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatebud Estatebud – Properties & Listings estatebud-properties-listings allows Stored XSS.This issue affects Estatebud – Properties & Listings: from n/a through <= 5.5.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:21:52.174Z. Updated 2026-05-12T23:44:28.192Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:44 WIB

Official record

MedPublished 22 Jan 2025, 00:21 WIB

CVE-2025-22722

WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:21:51.675Z. Updated 2026-04-28T16:11:05.846Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 22 Jan 2025, 00:21 WIB

CVE-2025-22721

WordPress ApplyOnline plugin <= 2.6.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Farhan Noor ApplyOnline apply-online allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ApplyOnline: from n/a through <= 2.6.7.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:21:51.532Z. Updated 2026-04-28T16:11:05.477Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 22 Jan 2025, 00:21 WIB

CVE-2025-22661

WordPress Online Payments plugin <= 3.20.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vcita Online Payments – Get Paid with PayPal, Square & Stripe paypal-payment-button-by-vcita allows Stored XSS.This issue affects Online Payments – Get Paid with PayPal, Square & Stripe: from n/a through <= 3.20.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:21:51.098Z. Updated 2026-04-28T16:11:04.076Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 22 Jan 2025, 00:21 WIB

CVE-2025-22276

WordPress Related Post Shortcode Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in enguerranws Related Post Shortcode related-post-shortcode allows Stored XSS.This issue affects Related Post Shortcode: from n/a through <= 1.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T17:21:50.948Z. Updated 2026-04-28T16:10:57.729Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record