Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 2481–2500 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

UnscoredPublished 12 Mar 2025, 22:51 WIB

CVE-2025-27867

Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix HTTP Webconsole Plugin. This issue affects Apache Felix HTTP Webconsole Plugin: from Version 1.X through 1.2.0. Users are recommended to upgrade to version 1.2.2, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:51:24.965Z. Updated 2025-03-21T20:36:57.712Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 03:36 WIB

Official record

CritPublished 12 Mar 2025, 22:33 WIB

CVE-2025-1960

CVE-2025-1960

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:33:59.173Z. Updated 2025-03-13T18:32:42.467Z.

Showing 2481 to 2500 of 4001.First page Next page

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated14 Mar 2025, 01:32 WIB

Official record

HighPublished 12 Mar 2025, 22:30 WIB

CVE-2025-0813

CVE-2025-0813

CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:30:03.262Z. Updated 2025-03-12T15:58:00.171Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated12 Mar 2025, 22:58 WIB

Official record

MedPublished 12 Mar 2025, 22:27 WIB

CVE-2025-1984

Local Privilege Escalation on Xerox® Desktop Print Experience® v8.5

Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:27:07.715Z. Updated 2025-05-12T15:37:02.156Z.

CVSS5.2v3.1KEVNot listedEPSSPresentUpdated12 May 2025, 22:37 WIB

Official record

HighPublished 12 Mar 2025, 22:25 WIB

CVE-2025-1683

Symbolic Link Exploit in 1E Client's - Nomad module allows Arbitrary File Deletion

Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access on a Windows system to delete arbitrary files on the device by exploiting symbolic links.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:25:27.765Z. Updated 2025-06-18T18:40:59.816Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Jun 2025, 01:40 WIB

Official record

MedPublished 12 Mar 2025, 22:25 WIB

CVE-2025-2002

CVE-2025-2002

CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server is deployed, and the device is placed in debug mode by an administrative user and the debug files are exported from the device.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:25:20.057Z. Updated 2025-05-12T15:37:21.223Z.

CVSS4v4.0KEVNot listedEPSSPresentUpdated12 May 2025, 22:37 WIB

Official record

LowPublished 12 Mar 2025, 22:24 WIB

CVE-2025-0883

vulnerability has been discovered in OpenText™ Service Manager.

Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager. The vulnerability could reveal sensitive information retained by the browser. This issue affects Service Manager: 9.70, 9.71, 9.72, 9.80.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:24:50.309Z. Updated 2025-05-12T15:35:58.132Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated12 May 2025, 22:35 WIB

Official record

HighPublished 12 Mar 2025, 22:24 WIB

CVE-2025-0884

Privilege Escalation vulnerability has been discovered in OpenText™ Service Manager.

Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege Escalation. This issue affects Service Manager: 9.70, 9.71, 9.72.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T15:24:31.859Z. Updated 2025-05-12T15:36:18.682Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated12 May 2025, 22:36 WIB

Official record

HighPublished 12 Mar 2025, 21:55 WIB

CVE-2025-2240

Smallrye-fault-tolerance: smallrye fault tolerance

A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates a new object within meterMap and may lead to a denial of service (DoS) issue.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T14:55:15.889Z. Updated 2026-10-20T04:21:57.523Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 11:21 WIB

Official record

UnscoredPublished 12 Mar 2025, 21:42 WIB

CVE-2025-29891

Apache Camel: Camel Message Header Injection through request parameters

Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4. Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases. This vulnerability is present in Camel's …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T14:42:59.644Z. Updated 2025-03-19T13:10:01.834Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 20:10 WIB

Official record

MedPublished 12 Mar 2025, 21:04 WIB

CVE-2024-52362

IBM App Connect Enterprise Certified Container denial of service

IBM App Connect Enterprise Certified Container 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, and 12.8 could allow an authenticated user to cause a denial of service in the App Connect flow due to improper validation of server-sid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T14:04:10.525Z. Updated 2025-09-01T01:06:08.715Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Sep 2025, 08:06 WIB

Official record

MedPublished 12 Mar 2025, 21:00 WIB

CVE-2025-27794

Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite

Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T14:00:21.862Z. Updated 2025-03-12T15:29:21.831Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated12 Mar 2025, 22:29 WIB

Official record

MedKEVPublished 12 Mar 2025, 20:59 WIB

CVE-2025-21590

Junos OS: An local attacker with shell access can execute arbitrary code

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-03-12T13:59:43.038Z. Updated 2026-02-26T19:09:35.631Z.

CVSS6.7v4.0KEVListedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

HighPublished 12 Mar 2025, 20:51 WIB

CVE-2025-27788

Ruby JSON Parser has Out-of-bounds Read

JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions prior to 2.10.0 are not vulnerable. Version 2.10.2 fixes the problem. No known workarounds are available.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T13:51:53.348Z. Updated 2025-03-12T14:04:35.186Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated12 Mar 2025, 21:04 WIB

Official record

HighPublished 12 Mar 2025, 20:03 WIB

CVE-2024-10838

Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read

An integer underflow during deserialization may allow any unauthenticated user to read out of bounds heap memory. This may result into secret data or pointers revealing the layout of the address space to be included into a deserialized data structure, which may potentially lead to thread crashes or cause denial of serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T13:03:47.747Z. Updated 2025-03-12T13:34:12.621Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated12 Mar 2025, 20:34 WIB

Official record

MedPublished 12 Mar 2025, 19:36 WIB

CVE-2025-29904

CVE-2025-29904

In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T12:36:15.812Z. Updated 2025-03-12T13:15:49.900Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated12 Mar 2025, 20:15 WIB

Official record

MedPublished 12 Mar 2025, 19:36 WIB

CVE-2025-29903

CVE-2025-29903

In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T12:36:15.276Z. Updated 2025-03-12T13:51:16.357Z.

CVSS5.2v3.1KEVNot listedEPSSPresentUpdated12 Mar 2025, 20:51 WIB

Official record

LowPublished 12 Mar 2025, 18:48 WIB

CVE-2024-13870

Unauthenticated Firmware Downgrade in Bitdefender Box v1

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recove…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T11:48:35.528Z. Updated 2025-03-12T14:01:55.166Z.

CVSS1.8v4.0KEVNot listedEPSSPresentUpdated12 Mar 2025, 21:01 WIB

Official record

CritPublished 12 Mar 2025, 18:48 WIB

CVE-2024-13871

Unauthenticated Command Injection in Bitdefender BOX v1

A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T11:48:20.890Z. Updated 2025-03-12T14:03:01.498Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated12 Mar 2025, 21:03 WIB

Official record

CritPublished 12 Mar 2025, 18:47 WIB

CVE-2024-13872

Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so

Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /set_temp_token API method. Then, an unauthenticated and network-adjacent attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-12T11:47:46.419Z. Updated 2025-03-12T14:09:37.026Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated12 Mar 2025, 21:09 WIB

Official record