Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 2601–2620 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

HighPublished 10 Jun 2025, 07:13 WIB

CVE-2025-42995

Multiple vulnerabilities in SAP MDM Server

SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the application.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:13:44.987Z. Updated 2025-06-10T15:15:11.986Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

HighPublished 10 Jun 2025, 07:13 WIB

CVE-2025-42994

Multiple vulnerabilities in SAP MDM Server

SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confidentiality and integrity of the application.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2601 to 2620 of 3682.First page Next page

Published 2025-06-10T00:13:29.670Z. Updated 2025-11-12T18:21:55.820Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 Nov 2025, 01:21 WIB

Official record

MedPublished 10 Jun 2025, 07:13 WIB

CVE-2025-42993

Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)

Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration could create an RFC destination and assign an arbitrary high-privilege user. This allows the attacker to consume events via the RFC destination, leading to code e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:13:15.633Z. Updated 2026-02-26T17:51:05.634Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:51 WIB

Official record

MedPublished 10 Jun 2025, 07:12 WIB

CVE-2025-42991

Missing Authorization check in SAP S/4HANA (Bank Account Application)

SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the applic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:12:53.600Z. Updated 2025-06-10T15:15:32.154Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

LowPublished 10 Jun 2025, 07:12 WIB

CVE-2025-42990

HTML Injection in Unprotected SAPUI5 applications

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.

Excerpt language: en.

Severity low: primary CNA CVSS 3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:12:33.233Z. Updated 2025-06-10T15:15:39.014Z.

CVSS3v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

CritPublished 10 Jun 2025, 07:12 WIB

CVE-2025-42989

Missing Authorization check in SAP NetWeaver Application Server for ABAP

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:12:16.278Z. Updated 2026-02-26T17:51:05.930Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:51 WIB

Official record

LowPublished 10 Jun 2025, 07:12 WIB

CVE-2025-42988

Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform

Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and av…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:12:00.282Z. Updated 2025-06-10T15:26:39.982Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:26 WIB

Official record

MedPublished 10 Jun 2025, 07:11 WIB

CVE-2025-42987

Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement)

SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:11:45.597Z. Updated 2025-06-10T15:15:47.066Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

MedPublished 10 Jun 2025, 07:11 WIB

CVE-2025-42984

Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application)

SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute the function import on the entity making it inaccessible for unrestricted user. This has low impact on confidentiality and availability of the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:11:29.226Z. Updated 2025-06-10T15:15:53.081Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:15 WIB

Official record

HighPublished 10 Jun 2025, 07:11 WIB

CVE-2025-42983

Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis

SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system unusable. On successful exploitation, an attacker can completely delete database entries but is not able to read any data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:11:14.520Z. Updated 2025-06-10T15:16:00.463Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:16 WIB

Official record

HighPublished 10 Jun 2025, 07:10 WIB

CVE-2025-42982

Information Disclosure in SAP GRC (AC Plugin)

SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact on confidentiality, integrity and availability of the application.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:10:58.266Z. Updated 2026-02-26T17:51:06.213Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:51 WIB

Official record

HighPublished 10 Jun 2025, 07:10 WIB

CVE-2025-42977

Directory Traversal vulnerability in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentiality and a low impact on integrity.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:10:43.679Z. Updated 2025-06-10T15:26:56.805Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:26 WIB

Official record

MedPublished 10 Jun 2025, 07:10 WIB

CVE-2025-31325

Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation)

Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the attacker limited access…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:10:30.542Z. Updated 2025-06-10T15:27:05.593Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:27 WIB

Official record

HighPublished 10 Jun 2025, 07:10 WIB

CVE-2025-23192

Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)

SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potentially access sensitive session information, modify or make b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:10:12.042Z. Updated 2025-06-10T15:27:15.494Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:27 WIB

Official record

HighPublished 10 Jun 2025, 07:00 WIB

CVE-2025-5905

TOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflow

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been rated as critical. Affected by this issue is the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument Password leads to buffer overflow. The attack may be launched remotely…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:00:18.830Z. Updated 2025-06-10T15:27:25.647Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:27 WIB

Official record

HighPublished 10 Jun 2025, 07:00 WIB

CVE-2025-5904

TOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflow

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument device_name leads to buffer overflow. The attack can be launch…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:00:16.259Z. Updated 2025-06-10T15:27:34.860Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated10 Jun 2025, 22:27 WIB

Official record

UnscoredPublished 10 Jun 2025, 07:00 WIB

CVE-2024-37394

CVE-2024-37394

A stored cross-site scripting (XSS) vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious scripts when the dashb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:00:00.000Z. Updated 2025-06-11T15:07:28.709Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 22:07 WIB

Official record

UnscoredPublished 10 Jun 2025, 07:00 WIB

CVE-2024-37395

CVE-2024-37395

A stored cross-site scripting (XSS) vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by attackers to execute malic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:00:00.000Z. Updated 2025-06-11T15:08:36.833Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 22:08 WIB

Official record

UnscoredPublished 10 Jun 2025, 07:00 WIB

CVE-2024-37396

CVE-2024-37396

A stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the event is viewed. Updati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:00:00.000Z. Updated 2025-06-11T15:08:06.866Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jun 2025, 22:08 WIB

Official record

UnscoredPublished 10 Jun 2025, 07:00 WIB

CVE-2024-41502

CVE-2024-41502

Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting (XSS) via the form field "Observaces" (observances) in the "Pessoas" (persons) section when creating or editing either a legal or a natural person.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T00:00:00.000Z. Updated 2026-07-05T01:00:06.867Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:00 WIB

Official record