Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 2481–2500 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 09 Apr 2025, 17:26 WIB

CVE-2025-2442

CVE-2025-2442

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in the loss of confidentially, integrity and availability when a malicious user, having physical access, sets the radio to the factory default mode.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T10:26:01.874Z. Updated 2025-04-09T13:36:42.766Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated09 Apr 2025, 20:36 WIB

Official record

MedPublished 09 Apr 2025, 17:23 WIB

CVE-2025-2441

CVE-2025-2441

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the product does not correctly initialize all data.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T10:23:45.536Z. Updated 2025-04-09T13:40:05.280Z.

Showing 2481 to 2500 of 4033.First page Next page

CVSS4.1v4.0KEVNot listedEPSSPresentUpdated09 Apr 2025, 20:40 WIB

Official record

MedPublished 09 Apr 2025, 17:20 WIB

CVE-2025-2440

CVE-2025-2440

CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a malicious user, having physical access and advanced information on the file system, sets the radio in factory default mode.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T10:20:57.073Z. Updated 2025-04-09T13:49:03.760Z.

CVSS4.1v4.0KEVNot listedEPSSPresentUpdated09 Apr 2025, 20:49 WIB

Official record

HighPublished 09 Apr 2025, 17:16 WIB

CVE-2025-2223

CVE-2025-2223

CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a malicious project file is loaded by a user from the local system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T10:16:04.119Z. Updated 2025-04-09T14:00:53.724Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated09 Apr 2025, 21:00 WIB

Official record

HighPublished 09 Apr 2025, 17:12 WIB

CVE-2025-2222

CVE-2025-2222

CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation following man in the middle attack.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T10:12:33.428Z. Updated 2025-04-09T14:05:05.060Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated09 Apr 2025, 21:05 WIB

Official record

HighPublished 09 Apr 2025, 16:03 WIB

CVE-2025-29870

CVE-2025-29870

Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product configuration information including authentication information.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:35.579Z. Updated 2025-04-10T14:24:24.090Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 21:24 WIB

Official record

HighPublished 09 Apr 2025, 16:03 WIB

CVE-2025-27934

CVE-2025-27934

Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:32.130Z. Updated 2025-04-09T14:20:29.090Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 21:20 WIB

Official record

CritPublished 09 Apr 2025, 16:03 WIB

CVE-2025-27797

CVE-2025-27797

OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:29.067Z. Updated 2025-04-09T14:57:13.725Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 21:57 WIB

Official record

MedPublished 09 Apr 2025, 16:03 WIB

CVE-2025-27722

CVE-2025-27722

Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote unauthenticated attacker to eavesdrop the communication and obtain the authentication information.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:26.029Z. Updated 2025-04-09T15:07:39.314Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 22:07 WIB

Official record

MedPublished 09 Apr 2025, 16:03 WIB

CVE-2025-25213

CVE-2025-25213

Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malicious page while logged in, unintended operations may be performed.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:20.081Z. Updated 2025-04-09T17:07:57.202Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 00:07 WIB

Official record

MedPublished 09 Apr 2025, 16:03 WIB

CVE-2025-25056

CVE-2025-25056

Cross-site request forgery vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views a malicious page while logged in, unintended operations may be performed.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:14.758Z. Updated 2025-04-09T17:13:41.222Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 00:13 WIB

Official record

HighPublished 09 Apr 2025, 16:03 WIB

CVE-2025-25053

CVE-2025-25053

OS command injection vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:09.322Z. Updated 2025-04-09T17:15:44.479Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 00:15 WIB

Official record

MedPublished 09 Apr 2025, 16:03 WIB

CVE-2025-23407

CVE-2025-23407

Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote attacker who can log in to the product may alter the settings without appropriate privileges.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T09:03:03.197Z. Updated 2025-04-09T17:16:29.703Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 00:16 WIB

Official record

MedPublished 09 Apr 2025, 14:35 WIB

CVE-2025-20952

CVE-2025-20952

Improper access control in Mdecservice prior to SMR Apr-2025 Release 1 allows local attackers to access arbitrary files with system privilege.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T07:35:41.949Z. Updated 2025-04-09T17:33:36.593Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 00:33 WIB

Official record

MedPublished 09 Apr 2025, 14:02 WIB

CVE-2025-3442

Information Disclosure Vulnerability in TP-Link Tapo IoT Smart Hub

This vulnerability exists in TP-Link Tapo H200 V1 IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the Wi-Fi credentials stored on the vulnerable device.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T07:02:54.195Z. Updated 2025-04-11T05:33:25.874Z.

CVSS4.4v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 12:33 WIB

Official record

UnscoredPublished 09 Apr 2025, 13:00 WIB

CVE-2024-8243

Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF

The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T06:00:06.866Z. Updated 2025-04-09T19:09:34.522Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2025, 02:09 WIB

Official record

UnscoredPublished 09 Apr 2025, 13:00 WIB

CVE-2024-6860

WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T06:00:05.104Z. Updated 2025-04-09T19:11:40.133Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2025, 02:11 WIB

Official record

UnscoredPublished 09 Apr 2025, 13:00 WIB

CVE-2024-6857

WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T06:00:04.059Z. Updated 2025-04-09T19:17:05.474Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2025, 02:17 WIB

Official record

MedPublished 09 Apr 2025, 11:21 WIB

CVE-2025-3100

WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.6.22 due to insufficient input sanitization and output escaping in tasks discussion. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T04:21:20.345Z. Updated 2026-04-08T16:51:27.778Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:51 WIB

Official record

MedPublished 09 Apr 2025, 09:25 WIB

CVE-2025-29988

CVE-2025-29988

Dell Client Platform BIOS contains a Stack-based Buffer Overflow Vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execution.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-09T02:25:06.695Z. Updated 2026-02-26T18:28:29.404Z.

CVSS6.9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record