Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 21–40 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 01 May 2025, 03:00 WIB

CVE-2024-6029

Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability

Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass the firewall on the Iris modem in affected Tesla Model S vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firewall service. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T20:00:25.966Z. Updated 2025-04-30T20:13:33.588Z.

CVSS5v3.0KEVNot listedEPSSPresentUpdated01 May 2025, 03:13 WIB

Official record

HighPublished 01 May 2025, 02:36 WIB

CVE-2025-27611

base-x homograph attack allows Unicode lookalike characters to bypass validation.

base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vulnerable to attackers potentially deceiving users into sending funds to an unintended address. This issue has been patched in versions 3.0.11, 4.0.1, and 5.0.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 21 to 40 of 4033.First page Next page

Published 2025-04-30T19:36:57.356Z. Updated 2025-05-01T18:49:22.814Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 May 2025, 01:49 WIB

Official record

MedPublished 01 May 2025, 02:31 WIB

CVE-2025-4136

Weitong Mall Sale Endpoint improper authorization

A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T19:31:06.079Z. Updated 2025-05-01T18:50:28.153Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 May 2025, 01:50 WIB

Official record

UnscoredPublished 01 May 2025, 01:46 WIB

CVE-2025-2170

CVE-2025-2170

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potentially enable a remote unauthenticated attacker to cause the appliance to make requests to an unintended location.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:46:34.939Z. Updated 2025-05-14T16:34:26.710Z.

CVSS—KEVNot listedEPSSPresentUpdated14 May 2025, 23:34 WIB

Official record

MedPublished 01 May 2025, 01:37 WIB

CVE-2024-9877

Sensitive information submitted using GET method

: Use of GET Request Method With Sensitive Query Strings vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:37:45.828Z. Updated 2025-04-30T18:43:32.990Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 May 2025, 01:43 WIB

Official record

HighPublished 01 May 2025, 01:31 WIB

CVE-2024-9876

Application is vulnerable to Privilege escalation

: Modification of Assumed-Immutable Data (MAID) vulnerability in ABB ANC, ABB ANC-L, ABB ANC-mini.This issue affects ANC: through 1.1.4; ANC-L: through 1.1.4; ANC-mini: through 1.1.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:31:28.797Z. Updated 2025-04-30T18:58:18.908Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated01 May 2025, 01:58 WIB

Official record

MedPublished 01 May 2025, 01:27 WIB

CVE-2025-46554

XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:27:53.677Z. Updated 2025-04-30T18:59:16.789Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 May 2025, 01:59 WIB

Official record

HighPublished 01 May 2025, 01:27 WIB

CVE-2025-46557

Any user with view access to the XWiki space can change the authenticator

XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1, a user who can access pages located in the XWiki space (by default, anyone) can access the page XWiki.Authentication.Administration and (unless an aut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:27:39.895Z. Updated 2025-04-30T19:00:26.033Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated01 May 2025, 02:00 WIB

Official record

CritPublished 01 May 2025, 01:27 WIB

CVE-2025-46558

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting (XSS) through HTML. In particular, using Markdown syntax, it's possible for any user to embed Ja…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:27:30.953Z. Updated 2025-04-30T19:01:32.321Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated01 May 2025, 02:01 WIB

Official record

MedPublished 01 May 2025, 01:27 WIB

CVE-2025-24887

OpenCTI bypass of protected attribute update

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the `external` flag on/off and change the own token value …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:27:24.530Z. Updated 2025-04-30T19:06:07.538Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated01 May 2025, 02:06 WIB

Official record

HighPublished 01 May 2025, 01:27 WIB

CVE-2025-32777

Volcano Scheduler Denial of Service via Unbounded Response from Elastic Service/extender Plugin

Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a privilege escalation, because Volcano u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:27:16.929Z. Updated 2025-05-01T18:51:41.932Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated02 May 2025, 01:51 WIB

Official record

MedPublished 01 May 2025, 01:27 WIB

CVE-2025-46331

OpenFGA Authorization Bypass

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Helm chart <= openfga-0.2.28, docker <= v.1.8.10) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. This issue has been p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:27:05.921Z. Updated 2025-05-01T18:52:23.855Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated02 May 2025, 01:52 WIB

Official record

LowPublished 01 May 2025, 01:17 WIB

CVE-2024-47784

Unverified Password Change

Unverified Password Change for ANC software that allows an authenticated attacker to bypass the old Password check in the password change form via a web HMI This issue affects ANC software version 1.1.4 and earlier.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:17:02.648Z. Updated 2025-04-30T20:04:47.051Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated01 May 2025, 03:04 WIB

Official record

MedPublished 01 May 2025, 00:31 WIB

CVE-2025-4135

Netgear WG302v2 ui_get_input_value command injection

A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulation of the argument host leads to command injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:31:04.131Z. Updated 2025-04-30T18:12:17.638Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 May 2025, 01:12 WIB

Official record

UnscoredPublished 01 May 2025, 00:21 WIB

CVE-2025-24091

CVE-2025-24091

An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.3. An app may be able to cause a denial-of-service.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:21:08.931Z. Updated 2026-04-02T18:17:46.578Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:17 WIB

Official record

MedPublished 01 May 2025, 00:18 WIB

CVE-2025-39413

WordPress Simple Sitemap – Create a Responsive HTML Sitemap plugin <= 3.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create a Responsive HTML Sitemap: from n/a through <= 3.6.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:18:59.319Z. Updated 2026-04-28T16:12:30.603Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 01 May 2025, 00:14 WIB

CVE-2025-21416

Azure Virtual Desktop Elevation of Privilege Vulnerability

Missing authorization in Azure Virtual Desktop allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:14:53.010Z. Updated 2026-08-10T15:13:24.669Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated10 Aug 2026, 22:13 WIB

Official record

CritPublished 01 May 2025, 00:14 WIB

CVE-2025-30392

Azure AI Bot Elevation of Privilege Vulnerability

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:14:52.419Z. Updated 2026-08-10T15:13:24.123Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated10 Aug 2026, 22:13 WIB

Official record

CritPublished 01 May 2025, 00:14 WIB

CVE-2025-30390

Azure ML Compute Elevation of Privilege Vulnerability

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:14:51.736Z. Updated 2026-08-10T15:13:23.509Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated10 Aug 2026, 22:13 WIB

Official record

HighPublished 01 May 2025, 00:14 WIB

CVE-2025-33074

Azure Functions Remote Code Execution Vulnerability

Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:14:51.166Z. Updated 2026-08-10T15:13:22.970Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated10 Aug 2026, 22:13 WIB

Official record