Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 2461–2480 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

HighPublished 09 Apr 2025, 23:09 WIB

CVE-2025-32692

WordPress WP Subscription Forms plugin <= 1.2.4 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows PHP Local File Inclusion.This issue affects WP Subscription Forms: from n/a through <= 1.2.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T16:09:08.930Z. Updated 2026-04-28T16:12:28.611Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 09 Apr 2025, 23:09 WIB

CVE-2025-32693

WordPress WebinarPress plugin <= 1.33.28 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Phishing.This issue affects WebinarPress: from n/a through <= 1.33.28.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T16:09:08.148Z. Updated 2026-04-28T16:12:28.502Z.

Showing 2461 to 2480 of 4033.First page Next page

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 09 Apr 2025, 23:09 WIB

CVE-2025-32694

WordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate WP Mail: from n/a through <= 1.3.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T16:09:07.065Z. Updated 2026-04-28T16:12:28.847Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 09 Apr 2025, 23:05 WIB

CVE-2025-32380

Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing

The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router's usage of Apollo Compiler allowed queries with deeply nested and reused named fragments to be prohibitively expensive to validate. This c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T16:05:45.994Z. Updated 2025-04-09T20:43:06.645Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 03:43 WIB

Official record

MedPublished 09 Apr 2025, 23:00 WIB

CVE-2025-32381

Denial of Service by abusing xgrammar unbounded cache in memory

XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammars to increase performance with repeated use of the same grammar. This cache is held in memory. Since the cache is unbounded, a system making use of xgrammar can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T16:00:10.642Z. Updated 2025-04-09T20:43:33.169Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 03:43 WIB

Official record

MedPublished 09 Apr 2025, 22:56 WIB

CVE-2025-32379

XSS at ctx.redirect() function in Koajs

Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:56:40.574Z. Updated 2025-04-09T20:45:15.899Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 03:45 WIB

Official record

MedPublished 09 Apr 2025, 22:48 WIB

CVE-2025-32016

Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform (formerly Azure AD v2.0 endpoint) and AAD B2C. This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:48:57.328Z. Updated 2025-04-09T20:45:42.880Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 03:45 WIB

Official record

MedPublished 09 Apr 2025, 22:37 WIB

CVE-2025-32378

Shopware's default newsletter opt-in settings allow for mass sign-up abuse

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:37:44.010Z. Updated 2025-04-09T20:46:25.559Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Apr 2025, 03:46 WIB

Official record

CritPublished 09 Apr 2025, 22:30 WIB

CVE-2025-32375

Insecure Deserialization leads to RCE in BentoML's runner server

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the se…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:30:03.842Z. Updated 2025-04-09T15:40:52.656Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 22:40 WIB

Official record

MedPublished 09 Apr 2025, 22:14 WIB

CVE-2025-32374

Possible Denial of Service (DoS) in DNN.PLATFORM registration

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted information in the public registration form. This vulnerability is fixed in 9.13.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:14:51.957Z. Updated 2025-04-09T15:44:49.820Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 22:44 WIB

Official record

MedPublished 09 Apr 2025, 22:14 WIB

CVE-2025-32373

DNN allows a registered user to enumerate and access files they should not have access to

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may be able to craft a request to enumerate/access some portal files they should not have access to. This vulnerability is fixed in 9.13.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:14:43.704Z. Updated 2025-04-09T15:42:50.064Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 22:42 WIB

Official record

MedPublished 09 Apr 2025, 22:14 WIB

CVE-2025-32372

Server-Side Request Forgery (SSRF) in DotNetNuke.Core

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent net…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:14:35.442Z. Updated 2025-04-09T15:42:10.913Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 22:42 WIB

Official record

MedPublished 09 Apr 2025, 22:14 WIB

CVE-2025-32371

Unexpected external content may be displayed in DNN ImageHandler

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to render text from a querystring parameter. This text would display in the resulting image and a user that trusts the domain might think that the information is l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T15:14:29.025Z. Updated 2025-04-09T15:41:55.992Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 22:41 WIB

Official record

MedPublished 09 Apr 2025, 21:42 WIB

CVE-2025-27391

Apache ActiveMQ Artemis: Passwords leaking from broker properties in the debug log

Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apache.activemq.artemis.core.config.impl.ConfigurationImpl logger has the debug level enabled. This issue affects Apache ActiveMQ Artemis: from 1.5.1 before 2.40.0.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T14:42:32.504Z. Updated 2025-04-09T17:02:46.727Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated10 Apr 2025, 00:02 WIB

Official record

MedPublished 09 Apr 2025, 21:07 WIB

CVE-2025-25023

IBM Security Guardium information disclosure

IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T14:07:13.339Z. Updated 2025-09-01T00:55:20.025Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated01 Sep 2025, 07:55 WIB

Official record

MedPublished 09 Apr 2025, 21:03 WIB

CVE-2023-33844

IBM Security Verify Governance cross-site scripting

IBM Security Verify Governance 10.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T14:03:58.894Z. Updated 2025-08-16T23:42:11.334Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated17 Aug 2025, 06:42 WIB

Official record

HighPublished 09 Apr 2025, 20:33 WIB

CVE-2025-1968

CVE-2025-1968

Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session IDs (Session Replay Attacks).This issue affects Sitefinity: from 14.0 through 14.3, from 14.4 before 14.4.8145, from 15.0 before 15.0.8231, from 15.1 before 15.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T13:33:31.450Z. Updated 2026-02-26T18:28:29.081Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

UnscoredPublished 09 Apr 2025, 18:59 WIB

CVE-2025-31672

Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T11:59:33.900Z. Updated 2025-05-23T13:11:07.642Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2025, 20:11 WIB

Official record

MedPublished 09 Apr 2025, 18:58 WIB

CVE-2025-30677

Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors

Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Adaptor Sink Connector log sensitive configuration properties in plain text in application logs. This vulnerability can lead to unintended exposure of credential…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T11:58:11.716Z. Updated 2025-04-09T16:03:27.556Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated09 Apr 2025, 23:03 WIB

Official record

MedPublished 09 Apr 2025, 18:00 WIB

CVE-2017-20197

propanetank Roommate-Bill-Tracking login.php sql injection

A vulnerability was found in propanetank Roommate-Bill-Tracking up to 288437f658fc9ee7d4b92a9da12557024d8bc55c. It has been declared as critical. This vulnerability affects unknown code of the file /includes/login.php. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotel…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T11:00:16.705Z. Updated 2025-04-09T13:17:18.497Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated09 Apr 2025, 20:17 WIB

Official record