Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 2041–2060 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 14 Apr 2025, 10:31 WIB

CVE-2025-3550

wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System detail improper authorization

A vulnerability has been found in wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /v1/pushConfig/detail/. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T03:31:04.899Z. Updated 2025-04-14T14:35:49.437Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Apr 2025, 21:35 WIB

Official record

MedPublished 14 Apr 2025, 10:00 WIB

CVE-2025-3549

Open Asset Import Library Assimp File MD3Loader.cpp ValidateSurfaceHeaderOffsets heap-based overflow

A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD3Importer::ValidateSurfaceHeaderOffsets of the file code/AssetLib/MD3/MD3Loader.cpp of the component File Handler. The manipulation leads to heap-based buffer overflow. The attack n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2041 to 2060 of 4033.First page Next page

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T03:00:08.855Z. Updated 2025-07-23T09:01:29.860Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated23 Jul 2025, 16:01 WIB

Official record

MedPublished 14 Apr 2025, 09:31 WIB

CVE-2025-3548

Open Asset Import Library Assimp File types.h Set heap-based overflow

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp up to 5.4.3. This issue affects the function aiString::Set in the library include/assimp/types.h of the component File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T02:31:05.592Z. Updated 2025-07-23T09:02:41.158Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated23 Jul 2025, 16:02 WIB

Official record

MedPublished 14 Apr 2025, 09:00 WIB

CVE-2025-3547

frdel Agent-Zero get_work_dir_files path traversal

A vulnerability classified as critical was found in frdel Agent-Zero 0.8.1.2. This vulnerability affects unknown code of the file /get_work_dir_files. The manipulation of the argument path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T02:00:09.568Z. Updated 2025-04-14T15:37:27.259Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Apr 2025, 22:37 WIB

Official record

HighPublished 14 Apr 2025, 08:38 WIB

CVE-2025-3572

INTUMIT SmartRobot - Server-Side Request Forgery

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T01:38:42.018Z. Updated 2025-04-14T15:50:50.785Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Apr 2025, 22:50 WIB

Official record

HighPublished 14 Apr 2025, 08:31 WIB

CVE-2025-3546

H3C Magic BE18000 HTTP POST Request getLanguage FCGI_CheckStringIfContainsSemicolon command injection

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been declared as critical. Affected by this vulnerability is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getLanguage of the component HTTP POST Request Handler. The…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T01:31:07.222Z. Updated 2025-04-14T15:54:23.768Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated14 Apr 2025, 22:54 WIB

Official record

HighPublished 14 Apr 2025, 08:00 WIB

CVE-2025-3545

H3C Magic BE18000 HTTP POST Request setLanguage FCGI_CheckStringIfContainsSemicolon command injection

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. It has been classified as critical. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/setLanguage of the component HTTP POST Request Handler. The manipulation leads …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T01:00:09.263Z. Updated 2025-04-14T15:55:20.861Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated14 Apr 2025, 22:55 WIB

Official record

HighPublished 14 Apr 2025, 07:31 WIB

CVE-2025-3544

H3C Magic BE18000 HTTP POST Request getCapabilityWeb FCGI_CheckStringIfContainsSemicolon command injection

A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getCapabilityWeb of the component HTTP POST Request Handler. The manipulation lea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T00:31:07.721Z. Updated 2025-04-14T15:56:21.217Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated14 Apr 2025, 22:56 WIB

Official record

HighPublished 14 Apr 2025, 07:00 WIB

CVE-2025-3543

H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request setsyncpppoecfg FCGI_WizardProtoProcess command injection

A vulnerability has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014 and classified as critical. This vulnerability affects the function FCGI_WizardProtoProcess of the file /api/wizard/setsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T00:00:12.283Z. Updated 2025-04-14T17:14:07.365Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Apr 2025, 00:14 WIB

Official record

UnscoredPublished 14 Apr 2025, 07:00 WIB

CVE-2025-29720

CVE-2025-29720

Dify v1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUploadApi.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T00:00:00.000Z. Updated 2025-04-14T18:20:17.245Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Apr 2025, 01:20 WIB

Official record

CritPublished 14 Apr 2025, 07:00 WIB

CVE-2025-32931

CVE-2025-32931

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-14T00:00:00.000Z. Updated 2025-04-14T18:20:41.641Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated15 Apr 2025, 01:20 WIB

Official record

HighPublished 14 Apr 2025, 06:31 WIB

CVE-2025-3542

H3C Magic NX15/Magic NX400/Magic R3010 HTTP POST Request getsyncpppoecfg FCGI_WizardProtoProcess command injection

A vulnerability, which was classified as critical, was found in H3C Magic NX15, Magic NX400 and Magic R3010 up to V100R014. This affects the function FCGI_WizardProtoProcess of the file /api/wizard/getsyncpppoecfg of the component HTTP POST Request Handler. The manipulation leads to command injection. The attack needs …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T23:31:06.617Z. Updated 2025-04-14T18:04:09.011Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Apr 2025, 01:04 WIB

Official record

HighPublished 14 Apr 2025, 06:00 WIB

CVE-2025-3541

H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getSpecs FCGI_WizardProtoProcess command injection

A vulnerability, which was classified as critical, has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this issue is the function FCGI_WizardProtoProcess of the file /api/wizard/getSpecs of the component HTTP POST Request Handler. The manipulation leads to command i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T23:00:14.702Z. Updated 2025-04-14T18:30:38.306Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Apr 2025, 01:30 WIB

Official record

HighPublished 14 Apr 2025, 05:31 WIB

CVE-2025-3540

H3C Magic NX15/Magic NX30 Pro/Magic NX400/Magic R3010 HTTP POST Request getCapability FCGI_WizardProtoProcess command injection

A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400 and Magic R3010 up to V100R014. Affected by this vulnerability is the function FCGI_WizardProtoProcess of the file /api/wizard/getCapability of the component HTTP POST Request Handler. The manipulation leads to command injec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T22:31:07.248Z. Updated 2025-04-14T18:50:15.113Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Apr 2025, 01:50 WIB

Official record

HighPublished 14 Apr 2025, 05:10 WIB

CVE-2025-3445

CVE-2025-3445

A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the archiver.Unarchive functionality with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T22:10:21.444Z. Updated 2025-04-14T19:07:54.939Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated15 Apr 2025, 02:07 WIB

Official record

HighPublished 14 Apr 2025, 05:00 WIB

CVE-2025-3539

H3C Magic BE18000 HTTP POST Request getBasicInfo FCGI_CheckStringIfContainsSemicolon command injection

A vulnerability classified as critical has been found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected is the function FCGI_CheckStringIfContainsSemicolon of the file /api/wizard/getBasicInfo of the component HTTP POST Request Handler. The manipulation leads to comm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T22:00:13.331Z. Updated 2025-04-14T19:15:25.559Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Apr 2025, 02:15 WIB

Official record

HighPublished 14 Apr 2025, 01:31 WIB

CVE-2025-3538

D-Link DI-8100 jhttpd auth.asp auth_asp stack-based overflow

A vulnerability was found in D-Link DI-8100 16.07.26A1. It has been rated as critical. This issue affects the function auth_asp of the file /auth.asp of the component jhttpd. The manipulation of the argument callback leads to stack-based buffer overflow. The attack needs to be approached within the local network. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T18:31:05.124Z. Updated 2025-04-14T19:17:28.142Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Apr 2025, 02:17 WIB

Official record

UnscoredPublished 13 Apr 2025, 20:16 WIB

CVE-2024-56406

Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes

A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T13:16:09.841Z. Updated 2025-10-16T14:04:20.393Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Oct 2025, 21:04 WIB

Official record

MedPublished 13 Apr 2025, 19:00 WIB

CVE-2025-3537

Tutorials-Website Employee Management System update-user.php improper authorization

A vulnerability was found in Tutorials-Website Employee Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/update-user.php. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T12:00:14.100Z. Updated 2025-04-14T19:20:51.634Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Apr 2025, 02:20 WIB

Official record

MedPublished 13 Apr 2025, 18:56 WIB

CVE-2025-3423

IBM Aspera Faspex 5 cross-site scripting

IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-13T11:56:15.398Z. Updated 2025-09-01T10:15:36.536Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2025, 17:15 WIB

Official record