Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 2861–2880 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 11 Mar 2025, 07:36 WIB

CVE-2025-26659

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:36:40.932Z. Updated 2025-03-11T14:14:36.613Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 21:14 WIB

Official record

MedPublished 11 Mar 2025, 07:35 WIB

CVE-2025-26658

Broken Authentication in SAP Business One (Service Layer)

The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2861 to 2880 of 4001.First page Next page

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:35:34.989Z. Updated 2026-02-26T19:09:43.294Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

MedPublished 11 Mar 2025, 07:35 WIB

CVE-2025-26656

Missing Authorization check in S/4HANA (Manage Purchasing Info Records)

OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:35:18.381Z. Updated 2025-03-11T15:12:29.986Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 22:12 WIB

Official record

LowPublished 11 Mar 2025, 07:35 WIB

CVE-2025-26655

Missing Authorization check in SAP JIT(Outbound)

SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:35:06.396Z. Updated 2025-03-11T02:09:32.603Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:09 WIB

Official record

MedPublished 11 Mar 2025, 07:34 WIB

CVE-2025-25245

Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a limited impact on confid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:34:56.115Z. Updated 2025-03-11T02:10:07.773Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:10 WIB

Official record

MedPublished 11 Mar 2025, 07:34 WIB

CVE-2025-25244

Missing Authorization Check in SAP Business Warehouse (Process Chains)

SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:34:42.757Z. Updated 2025-03-11T02:12:02.750Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:12 WIB

Official record

MedPublished 11 Mar 2025, 07:32 WIB

CVE-2025-25242

Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP

SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:32:28.733Z. Updated 2025-03-11T02:13:11.225Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:13 WIB

Official record

MedPublished 11 Mar 2025, 07:32 WIB

CVE-2025-23194

Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component)

SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:32:11.498Z. Updated 2025-03-11T02:13:53.935Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:13 WIB

Official record

MedPublished 11 Mar 2025, 07:32 WIB

CVE-2025-23188

Missing Authorization check in SAP S/4HANA (RBD)

An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions beyond their intended permissions. This causes a low impact on integrity with no impact on confidentiality and availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:32:01.809Z. Updated 2025-03-11T02:16:30.166Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:16 WIB

Official record

MedPublished 11 Mar 2025, 07:31 WIB

CVE-2025-23185

Information Disclosure in SAP Business Objects Business Intelligence Platform

Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they could use it to craft fur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:31:51.113Z. Updated 2025-03-11T02:17:05.919Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:17 WIB

Official record

MedPublished 11 Mar 2025, 07:31 WIB

CVE-2025-0071

Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager

SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impact on integrity or avail…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:31:34.767Z. Updated 2025-03-11T02:18:02.453Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:18 WIB

Official record

MedPublished 11 Mar 2025, 07:31 WIB

CVE-2025-0062

Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impact on confidentiality an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:31:18.755Z. Updated 2025-03-11T02:18:37.752Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 09:18 WIB

Official record

UnscoredPublished 11 Mar 2025, 07:00 WIB

CVE-2021-37787

CVE-2021-37787

The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POST request to the TinyMCE module

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-21T20:39:14.794Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 03:39 WIB

Official record

LowPublished 11 Mar 2025, 07:00 WIB

CVE-2024-28607

CVE-2024-28607

The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate return value.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-11T13:18:51.833Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 20:18 WIB

Official record

UnscoredPublished 11 Mar 2025, 07:00 WIB

CVE-2024-51319

CVE-2024-51319

A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimg_upload.jsp.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-21T20:48:45.731Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 03:48 WIB

Official record

UnscoredPublished 11 Mar 2025, 07:00 WIB

CVE-2024-51320

CVE-2024-51320

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdm_fsave_htmltmp, /servlet/gsdm_btlk_openfile components

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-11T19:35:09.870Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Mar 2025, 02:35 WIB

Official record

UnscoredPublished 11 Mar 2025, 07:00 WIB

CVE-2024-51321

CVE-2024-51321

In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-21T20:47:01.303Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 03:47 WIB

Official record

UnscoredPublished 11 Mar 2025, 07:00 WIB

CVE-2024-51322

CVE-2024-51322

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsp/gsfr_feditorHTML.jsp, /servlet/SPVisualZoom, /jsp/gsmd_container.jsp components

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-11T19:25:51.813Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Mar 2025, 02:25 WIB

Official record

MedPublished 11 Mar 2025, 07:00 WIB

CVE-2024-58102

CVE-2024-58102

An issue was discovered in Datalust Seq before 2024.3.13545. An insecure default parsing depth limit allows stack consumption when parsing user-supplied queries containing deeply nested expressions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-11T13:24:30.067Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated11 Mar 2025, 20:24 WIB

Official record

UnscoredPublished 11 Mar 2025, 07:00 WIB

CVE-2025-25680

CVE-2025-25680

LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the tuya_ipc_direct_connect function of the anyka_ipc process. The vulnerability allows arbitrary code execution through the Wi-Fi configuration process when a specially crafted QR code is presented to the camera.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-11T00:00:00.000Z. Updated 2025-03-21T20:44:34.654Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 03:44 WIB

Official record