Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 2521–2540 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 09 Apr 2025, 03:03 WIB

CVE-2025-30292

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:03:00.828Z. Updated 2025-04-08T20:41:31.996Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 03:41 WIB

Official record

HighPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30290

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to bypass security protections and gain unaut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2521 to 2540 of 4033.First page Next page

Published 2025-04-08T20:02:59.926Z. Updated 2025-05-09T16:26:11.696Z.

CVSS8.7v3.1KEVNot listedEPSSPresentUpdated09 May 2025, 23:26 WIB

Official record

CritPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30282

ColdFusion | Improper Authentication (CWE-287)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and execute code. Exploitat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:59.068Z. Updated 2025-04-22T21:43:25.989Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated23 Apr 2025, 04:43 WIB

Official record

HighPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30284

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:58.049Z. Updated 2026-02-26T18:28:30.222Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30294

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized read access. Exploitation of this issue do…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:57.132Z. Updated 2025-09-04T15:23:53.202Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated04 Sep 2025, 22:23 WIB

Official record

HighPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30289

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A low privileged attacker with local access could leverage this vulnerability t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:56.190Z. Updated 2026-02-26T18:28:31.048Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

HighPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30288

ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. A low privileged attacker with local access could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:55.419Z. Updated 2026-02-26T18:28:31.368Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

CritPublished 09 Apr 2025, 03:02 WIB

CVE-2025-24446

ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin panel privileges are required, and scope is changed.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:54.121Z. Updated 2025-04-18T17:16:43.828Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated19 Apr 2025, 00:16 WIB

Official record

CritPublished 09 Apr 2025, 03:02 WIB

CVE-2025-24447

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does not require user intera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:52.863Z. Updated 2025-04-22T21:49:32.676Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated23 Apr 2025, 04:49 WIB

Official record

CritPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30281

ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution. A high-privileged attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this issue does n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:51.732Z. Updated 2025-06-24T17:56:30.686Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated25 Jun 2025, 00:56 WIB

Official record

MedPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30291

ColdFusion | Information Exposure (CWE-200)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass. A low privileged attacker with local access could leverage this vulnerability to gain access to sensitive information which could be used to further compromise t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:50.968Z. Updated 2025-04-18T18:00:49.009Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated19 Apr 2025, 01:00 WIB

Official record

HighPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30285

ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:50.212Z. Updated 2025-04-18T17:35:35.238Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated19 Apr 2025, 00:35 WIB

Official record

HighPublished 09 Apr 2025, 03:02 WIB

CVE-2025-30286

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. A high-privileged attacker could leverage this vulnerability to bypass security…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T20:02:48.704Z. Updated 2025-04-18T17:49:52.379Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated19 Apr 2025, 00:49 WIB

Official record

LowPublished 09 Apr 2025, 01:24 WIB

CVE-2025-3416

Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T18:24:22.102Z. Updated 2026-06-30T07:03:15.074Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 14:03 WIB

Official record

MedPublished 09 Apr 2025, 01:22 WIB

CVE-2025-30308

XMPWorker | Out-of-bounds Read (CWE-125)

XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T18:22:30.346Z. Updated 2025-04-08T19:04:57.781Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 02:04 WIB

Official record

MedPublished 09 Apr 2025, 01:22 WIB

CVE-2025-30307

XMPWorker | Out-of-bounds Read (CWE-125)

XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T18:22:29.573Z. Updated 2025-04-08T19:06:14.409Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 02:06 WIB

Official record

MedPublished 09 Apr 2025, 01:22 WIB

CVE-2025-30305

XMPWorker | Out-of-bounds Read (CWE-125)

XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T18:22:28.759Z. Updated 2025-04-08T19:07:26.285Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 02:07 WIB

Official record

MedPublished 09 Apr 2025, 01:22 WIB

CVE-2025-30306

XMPWorker | Out-of-bounds Read (CWE-125)

XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T18:22:27.624Z. Updated 2025-04-08T19:07:44.935Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 02:07 WIB

Official record

MedPublished 09 Apr 2025, 01:22 WIB

CVE-2025-30309

XMPWorker | Out-of-bounds Read (CWE-125)

XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T18:22:26.740Z. Updated 2025-04-08T19:08:04.114Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 02:08 WIB

Official record

MedPublished 09 Apr 2025, 01:15 WIB

CVE-2025-30300

Adobe Framemaker | NULL Pointer Dereference (CWE-476)

Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-08T18:15:13.213Z. Updated 2025-04-08T18:36:16.741Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2025, 01:36 WIB

Official record