Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 2061–2080 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30114

CVE-2025-30114

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Bypassing of Device Pairing can occur. The pairing mechanism relies solely on the connecting device's MAC address. By obtaining the MAC address through network scanning and spoofing it, an attacker can bypass the authentication process and gain …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-21T17:58:05.485Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:58 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30115

CVE-2025-30115

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSID and password ("qwertyuiop"), which cannot be modified by users. The SSID is continuously broadcast, allowing unauthorized access to the device network.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-21T13:56:46.020Z.

Showing 2061 to 2080 of 4001.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 20:56 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30116

CVE-2025-30116

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Remotely Dumping of Video Footage and the Live Video Stream can occur. It allows remote attackers to access and download recorded video footage from the SD card via port 9091. Additionally, attackers can connect to port 9092 to stream the live v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T18:13:44.031Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2025, 01:13 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30117

CVE-2025-30117

An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. After bypassing the device pairing, an attacker can obtain sensitive user and vehicle information through the settings interf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T18:19:25.014Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Mar 2025, 01:19 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30122

CVE-2025-30122

An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users, making it easy for attackers to gain unauthorized access to multiple devices.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-21T13:59:34.498Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 20:59 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30123

CVE-2025-30123

An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to gain unauthorized access and extract sensitive recorded footage from the device.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-21T17:56:19.116Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 00:56 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30132

CVE-2025-30132

An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis, it was found that this domain was not owned by IROAD, allowing an attacker to register it and potentially intercept sensitive device traffic. If the dashcam or…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-21T13:48:53.858Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 20:48 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30137

CVE-2025-30137

An issue was discovered in the G-Net GNET APK 2.6.2. Hardcoded credentials exist in in APK for ports 9091 and 9092. The GNET mobile application contains hardcoded credentials that provide unauthorized access to the dashcam's API endpoints on ports 9091 and 9092. Once the GNET SSID is connected to, the attacker sends a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T16:47:42.994Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 23:47 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30138

CVE-2025-30138

An issue was discovered on G-Net Dashcam BB GONX devices. Managing Settings and Obtaining Sensitive Data and Sabotaging Car Battery can be performed by unauthorized persons. It allows unauthorized users to modify critical system settings once connected to its network. Attackers can extract sensitive car and driver info…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T16:40:28.628Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 23:40 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30139

CVE-2025-30139

An issue was discovered on G-Net Dashcam BB GONX devices. Default credentials for SSID cannot be changed. It broadcasts a fixed SSID with default credentials that cannot be changed. This allows any nearby attacker to connect to the dashcam's network without restriction. Once connected, an attacker can sniff on connecte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T15:38:45.471Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 22:38 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30140

CVE-2025-30140

An issue was discovered on G-Net Dashcam BB GONX devices. A Public Domain name is Used for the Internal Domain Name. It uses an unregistered public domain name as an internal domain, creating a security risk. This domain was not owned by GNET originally, allowing an attacker to register it and potentially intercept sen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T15:29:45.678Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 22:29 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30141

CVE-2025-30141

An issue was discovered on G-Net Dashcam BB GONX devices. One can Remotely Dump Video Footage and the Live Video Stream. It exposes API endpoints on ports 9091 and 9092 that allow remote access to recorded and live video feeds. An attacker who connects to the dashcam's network can retrieve all stored recordings and con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T15:36:51.282Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 22:36 WIB

Official record

UnscoredPublished 18 Mar 2025, 07:00 WIB

CVE-2025-30142

CVE-2025-30142

An issue was discovered on G-Net Dashcam BB GONX devices. Bypassing of Device Pairing can occur. It uses MAC address verification as the sole mechanism for recognizing paired devices, allowing attackers to bypass authentication. By capturing the MAC address of an already-paired device through ARP scanning or other mean…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-18T00:00:00.000Z. Updated 2025-03-25T15:32:49.933Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 22:32 WIB

Official record

MedPublished 18 Mar 2025, 06:31 WIB

CVE-2025-2472

PHPGurukul Apartment Visitors Management System Sign In index.php sql injection

A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Sign In. The manipulation of the argument username leads to sql injection. The attack can be launched remot…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T23:31:07.601Z. Updated 2025-03-18T14:05:17.635Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:05 WIB

Official record

MedPublished 18 Mar 2025, 06:31 WIB

CVE-2025-2471

PHPGurukul Boat Booking System boat-details.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. Affected is an unknown function of the file /boat-details.php. The manipulation of the argument bid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T23:31:04.936Z. Updated 2025-03-18T14:06:54.295Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:06 WIB

Official record

HighPublished 18 Mar 2025, 05:50 WIB

CVE-2025-29913

CryptoLib's Crypto_TC_Prep_AAD Has Buffer Overflow Due to Integer Underflow

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_TC_Prep_AAD` …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T22:50:49.074Z. Updated 2025-03-18T14:07:35.486Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:07 WIB

Official record

HighPublished 18 Mar 2025, 05:48 WIB

CVE-2025-29912

CryptoLib Has Heap Buffer Overflow Due to Unsigned Integer Underflow in Crypto_TC_ProcessSecurity

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In versions 1.3.3 and prior, an unsigned integer underflow in the `Crypto_TC_ProcessSecur…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T22:48:40.833Z. Updated 2025-03-18T13:31:28.409Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 20:31 WIB

Official record

HighPublished 18 Mar 2025, 05:34 WIB

CVE-2023-22512

CVE-2023-22512

This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely disrupting services o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T22:34:42.950Z. Updated 2025-05-12T15:39:27.035Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated12 May 2025, 22:39 WIB

Official record

MedPublished 18 Mar 2025, 05:31 WIB

CVE-2025-2420

猫宁i Morning cross-site request forgery

A vulnerability classified as problematic was found in 猫宁i Morning up to bc782730c74ff080494f145cc363a0b4f43f7d3e. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T22:31:08.216Z. Updated 2025-03-18T13:12:05.123Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 20:12 WIB

Official record

HighPublished 18 Mar 2025, 05:20 WIB

CVE-2025-29911

CryptoLib Has Heap Buffer Overflow in Crypto_AOS_ProcessSecurity Function

CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A critical heap buffer overflow vulnerability was identified in the `Crypto_AOS_ProcessSe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T22:20:15.289Z. Updated 2025-03-18T13:17:45.829Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 20:17 WIB

Official record