Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 201–220 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

UnscoredPublished 29 Apr 2025, 07:00 WIB

CVE-2025-32354

CVE-2025-32354

In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) of Zimbra webmail due to a lack of CSRF token validation. This allows attackers to perform unauthorized GraphQL operations, such as modifying contacts, changing a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-29T00:00:00.000Z. Updated 2025-05-06T15:34:54.669Z.

CVSS—KEVNot listedEPSSPresentUpdated06 May 2025, 22:34 WIB

Official record

UnscoredPublished 29 Apr 2025, 07:00 WIB

CVE-2025-45956

CVE-2025-45956

A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-29T00:00:00.000Z. Updated 2025-05-06T15:29:16.069Z.

Showing 201 to 220 of 4033.First page Next page

CVSS—

KEVNot listed

EPSSPresent

Updated06 May 2025, 22:29 WIB

Official record

LowPublished 29 Apr 2025, 05:33 WIB

CVE-2025-46328

NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS the Driver reads logging configuration from a user-provided file. On Linux and macO…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T22:33:09.632Z. Updated 2025-04-29T13:41:29.830Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 20:41 WIB

Official record

LowPublished 29 Apr 2025, 05:33 WIB

CVE-2025-46327

Go Snowflake Driver has race condition when checking access to Easy Logging configuration file

gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver ver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T22:33:05.249Z. Updated 2025-04-29T13:43:12.167Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 20:43 WIB

Official record

LowPublished 29 Apr 2025, 05:33 WIB

CVE-2025-46326

Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file

snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Connector reads logging configuration from a user-provided file. On Linux and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T22:33:01.627Z. Updated 2025-04-29T13:42:11.360Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 20:42 WIB

Official record

MedPublished 29 Apr 2025, 04:31 WIB

CVE-2025-4039

PHPGurukul Rail Pass Management System search-pass.php sql injection

A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/search-pass.php. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T21:31:05.497Z. Updated 2025-04-28T22:14:17.336Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 05:14 WIB

Official record

MedPublished 29 Apr 2025, 04:00 WIB

CVE-2025-4038

code-projects Train Ticket Reservation System reservation stack-based overflow

A vulnerability was found in code-projects Train Ticket Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is the function Reservation of the component Ticket Reservation. The manipulation of the argument Name leads to stack-based buffer overflow. Attacking locally is a requirement…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T21:00:07.109Z. Updated 2025-04-28T22:26:07.592Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 05:26 WIB

Official record

MedPublished 29 Apr 2025, 03:57 WIB

CVE-2024-11922

Input Validation vulnerability in Web Client emails that do not go through Secure Mail

Missing input validation in certain features of the Web Client of Fortra's GoAnywhere prior to version 7.8.0 allows an attacker with permission to trigger emails to insert arbitrary HTML or JavaScript into an email.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T20:57:37.388Z. Updated 2025-04-28T22:27:53.032Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 05:27 WIB

Official record

LowPublished 29 Apr 2025, 03:55 WIB

CVE-2025-0049

Disclosure of sensitive information in an error message in GoAnywhere prior to version 7.8.0

When a Web User without Create permission on subfolders attempts to upload a file to a non-existent directory, the error message includes the absolute server path which may allow Fuzzing for application mapping. This issue affects GoAnywhere: before 7.8.0.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T20:55:06.256Z. Updated 2025-04-28T22:28:10.671Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 05:28 WIB

Official record

MedPublished 29 Apr 2025, 03:36 WIB

CVE-2024-10635

Enterprise Protection S/MIME Opaque Signature Attachment Scanning Bypass

Enterprise Protection contains an improper input validation vulnerability in attachment defense that allows an unauthenticated remote attacker to bypass attachment scanning security policy by sending a malicious S/MIME attachment with an opaque signature. When opened by a recipient in a downstream email client, the mal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T20:36:43.320Z. Updated 2025-10-06T20:51:36.637Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated07 Oct 2025, 03:51 WIB

Official record

MedPublished 29 Apr 2025, 03:31 WIB

CVE-2025-4037

code-projects ATM Banking moneyWithdraw logic error

A vulnerability was found in code-projects ATM Banking 1.0. It has been classified as critical. Affected is the function moneyDeposit/moneyWithdraw. The manipulation leads to business logic errors. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T20:31:04.297Z. Updated 2025-04-28T22:27:22.810Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 05:27 WIB

Official record

MedPublished 29 Apr 2025, 03:00 WIB

CVE-2025-4036

201206030 Novel Chapter AuthorController.java updateBookChapter access control

A vulnerability was found in 201206030 Novel 3.5.0 and classified as critical. This issue affects the function updateBookChapter of the file src/main/java/io/github/xxyopen/novel/controller/author/AuthorController.java of the component Chapter Handler. The manipulation leads to improper access controls. The attack may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T20:00:04.949Z. Updated 2025-04-28T21:53:22.479Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 04:53 WIB

Official record

MedPublished 29 Apr 2025, 02:31 WIB

CVE-2025-4034

projectworlds Online Examination System inser_doc_process.php sql injection

A vulnerability classified as critical was found in projectworlds Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /inser_doc_process.php. The manipulation of the argument Doc_ID leads to sql injection. The attack can be launched remotely. The exploit has been disclo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T19:31:03.828Z. Updated 2025-04-28T21:54:07.063Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 04:54 WIB

Official record

HighPublished 29 Apr 2025, 02:21 WIB

CVE-2025-3224

Elevation of Privilege in Docker Desktop for Windows during Upgrade due to Insecure Directory Deletion

A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts to delete files and subdirectories under the path C:\ProgramData\Docker\config with high privileges. Howev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T19:21:15.851Z. Updated 2025-04-28T19:43:24.060Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 02:43 WIB

Official record

HighPublished 29 Apr 2025, 02:20 WIB

CVE-2025-34491

GFI MailEssentials < 21.8 MultiNode Insecure Deserialization

GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue. A remote and authenticated attacker can execute arbitrary code by sending crafted serialized .NET when joining to a Multi-Server setup.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T19:20:02.027Z. Updated 2025-11-19T01:25:57.239Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated19 Nov 2025, 08:25 WIB

Official record

UnscoredPublished 29 Apr 2025, 02:17 WIB

CVE-2025-31651

Apache Tomcat: Bypass of rules in Rewrite Valve

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T19:17:21.721Z. Updated 2026-02-26T18:27:59.801Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:27 WIB

Official record

UnscoredPublished 29 Apr 2025, 02:14 WIB

CVE-2025-31650

Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T19:14:31.107Z. Updated 2025-11-03T19:53:11.497Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:53 WIB

Official record

MedPublished 29 Apr 2025, 02:02 WIB

CVE-2025-34490

GFI MailEssentials < 21.8 XXE Arbitrary File Read

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue. An authenticated and remote attacker can send crafted HTTP requests to read arbitrary system files.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T19:02:03.532Z. Updated 2025-11-19T01:26:14.676Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Nov 2025, 08:26 WIB

Official record

MedPublished 29 Apr 2025, 02:00 WIB

CVE-2025-4033

PHPGurukul Nipah Virus Testing Management System patient-search-report.php sql injection

A vulnerability classified as critical has been found in PHPGurukul Nipah Virus Testing Management System 1.0. Affected is an unknown function of the file /patient-search-report.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T19:00:06.946Z. Updated 2025-04-28T19:50:50.468Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 02:50 WIB

Official record

HighPublished 29 Apr 2025, 01:50 WIB

CVE-2025-34489

GFI MailEssentials < 21.8 Local Privilege Escalation

GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue. A local attacker can escalate to NT Authority/SYSTEM by sending a crafted serialized payload to a .NET Remoting Service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T18:50:26.043Z. Updated 2025-11-19T01:26:23.590Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Nov 2025, 08:26 WIB

Official record