Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 201–220 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 31 Mar 2025, 23:31 WIB

CVE-2025-3003

ESAFENET CDG UserAjax sql injection

A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/UserAjax. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:31:04.326Z. Updated 2025-03-31T18:19:01.444Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:19 WIB

Official record

LowPublished 31 Mar 2025, 23:26 WIB

CVE-2025-30368

Zulip allows the deletion of organization by administrators of a different organization

Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to check that the field belongs to the same organization as the user. Therefore, an administrator of any organization was incorrectly allowed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 201 to 220 of 4001.First page Next page

Published 2025-03-31T16:26:48.673Z. Updated 2025-03-31T18:59:32.854Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:59 WIB

Official record

HighPublished 31 Mar 2025, 23:22 WIB

CVE-2025-2794

Kentico Xperience <= 13.0.180 Unsafe Reflection

An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:22:48.521Z. Updated 2025-11-19T12:09:19.756Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Nov 2025, 19:09 WIB

Official record

CritPublished 31 Mar 2025, 23:17 WIB

CVE-2025-30223

Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input

Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victim…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:17:05.914Z. Updated 2025-03-31T18:21:08.456Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:21 WIB

Official record

HighPublished 31 Mar 2025, 23:12 WIB

CVE-2025-30161

OpenEMR Stored XSS in OpenEMR Bronchitis Form

OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal credentials from administrators. This vulnerability is fixed in 7.0.3.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:12:29.064Z. Updated 2025-03-31T18:21:55.232Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:21 WIB

Official record

MedPublished 31 Mar 2025, 23:07 WIB

CVE-2025-30149

OpenEMR Reflected XSS in AJAX Script

OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in the AJAX Script interface\super\layout_listitems_ajax.php via the target parameter. This vulnerability is fixed in 7.0.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:07:11.417Z. Updated 2025-03-31T18:04:29.366Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:04 WIB

Official record

HighPublished 31 Mar 2025, 23:03 WIB

CVE-2025-29772

OpenEMR allows Reflected XSS in CAMOS new.php

OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the page without being properly processed. This leads to a reflected cross-site scripting (XSS) vul;nerability in CAMOS new.php. This vulnerability is fixed in 7.0.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:03:32.711Z. Updated 2025-03-31T18:34:56.541Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:34 WIB

Official record

HighPublished 31 Mar 2025, 23:00 WIB

CVE-2025-1449

Admin Shell Access Vulnerability in Rockwell Automation Verve Asset Manager

A vulnerability exists in the Rockwell Automation Verve Asset Manager due to insufficient variable sanitizing. A portion of the administrative web interface for Verve's Legacy Agentless Device Inventory (ADI) capability (deprecated since the 1.36 release) allows users to change a variable with inadequate sanitizing. If…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:00:56.951Z. Updated 2025-03-31T18:24:38.780Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:24 WIB

Official record

MedPublished 31 Mar 2025, 23:00 WIB

CVE-2025-3002

Digital China DCME-520 mon_merge_stat_hist.php os command injection

A vulnerability, which was classified as critical, has been found in Digital China DCME-520 up to 20250320. This issue affects some unknown processing of the file /usr/local/WWW/function/audit/newstatistics/mon_merge_stat_hist.php. The manipulation of the argument type_name leads to os command injection. The attack may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T16:00:13.225Z. Updated 2025-03-31T18:05:58.087Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:05 WIB

Official record

MedPublished 31 Mar 2025, 22:58 WIB

CVE-2025-30155

Tuleap does not enforce read permissions on parent trackers in the REST API

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap does not enforce read permissions on parent trackers in the REST API. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742392651 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:58:30.058Z. Updated 2025-03-31T18:18:13.265Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:18 WIB

Official record

MedPublished 31 Mar 2025, 22:53 WIB

CVE-2025-30209

Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap Enterprise Edition 1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:53:46.455Z. Updated 2025-03-31T18:19:35.993Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:19 WIB

Official record

MedPublished 31 Mar 2025, 22:48 WIB

CVE-2025-30203

Tuleap allows XSS via the content of RSS feeds in the RSS widgets

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncont…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:48:49.651Z. Updated 2025-03-31T18:34:00.583Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:34 WIB

Official record

MedPublished 31 Mar 2025, 22:40 WIB

CVE-2025-29929

Tuleap is missing CSRF protection on tracker hierarchy administration

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:40:58.925Z. Updated 2025-03-31T18:35:27.933Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:35 WIB

Official record

MedPublished 31 Mar 2025, 22:38 WIB

CVE-2025-29766

Tuleap has missing CSRF protections on artifact submission & edition from the tracker view

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. The vulnerabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:38:00.273Z. Updated 2025-03-31T18:36:27.728Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:36 WIB

Official record

MedPublished 31 Mar 2025, 22:33 WIB

CVE-2025-27149

Zulip exports can leak private data

Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization administrators feature in Zulip leaks private data. The collection of user-agent types identifying specific integrations or HTTP libraries (E.g., ZulipGitlabWebhook, okhttp, or Pyc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:33:38.543Z. Updated 2025-03-31T18:36:58.695Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:36 WIB

Official record

MedPublished 31 Mar 2025, 22:31 WIB

CVE-2025-3001

PyTorch torch.lstm_cell memory corruption

A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:31:05.008Z. Updated 2025-03-31T18:47:18.769Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:47 WIB

Official record

MedPublished 31 Mar 2025, 22:21 WIB

CVE-2025-3048

Path Traversal in AWS SAM CLI allows file copy to local cache

After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker conta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:21:16.205Z. Updated 2025-10-14T19:23:20.481Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 02:23 WIB

Official record

MedPublished 31 Mar 2025, 22:21 WIB

CVE-2025-3047

Path Traversal in AWS SAM CLI allows file copy to build container

When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A user could leverage the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:21:11.290Z. Updated 2025-10-14T19:22:56.059Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 02:22 WIB

Official record

MedPublished 31 Mar 2025, 22:08 WIB

CVE-2025-27095

JumpServer has a Kubernetes Token Leak Vulnerability

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig file to redirect API requests to an external server controlled by the attacker. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:08:20.942Z. Updated 2025-03-31T18:53:50.455Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:53 WIB

Official record

MedPublished 31 Mar 2025, 22:00 WIB

CVE-2025-3000

PyTorch torch.jit.script memory corruption

A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T15:00:10.521Z. Updated 2025-03-31T18:55:52.815Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 01:55 WIB

Official record