Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 2141–2160 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 17 Mar 2025, 20:31 WIB

CVE-2025-2379

PHPGurukul Apartment Visitors Management System create-pass.php sql injection

A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /create-pass.php. The manipulation of the argument visname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:31:05.213Z. Updated 2025-03-17T17:57:57.183Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 00:57 WIB

Official record

MedPublished 17 Mar 2025, 20:25 WIB

CVE-2025-29788

Sylius PayPal Plugin Payment Amount Manipulation Vulnerability

The Syliud PayPal Plugin is the Sylius Core Team’s plugin for the PayPal Commerce Platform. A vulnerability in versions prior to 1.6.1, 1.7.1, and 2.0.1 allows users to manipulate the final payment amount processed by PayPal. If a user modifies the item quantity in their shopping cart after initiating the PayPal Expres…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2141 to 2160 of 4001.First page Next page

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:25:24.343Z. Updated 2025-03-17T14:23:42.688Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated17 Mar 2025, 21:23 WIB

Official record

HighPublished 17 Mar 2025, 20:19 WIB

CVE-2025-29787

zip Vulnerable to Incorrect Path Canonicalization During Archive Extraction, Leading to Arbitrary File Write

`zip` is a zip library for rust which supports reading and writing of simple ZIP files. In the archive extraction routine of affected versions of the `zip` crate starting with version 1.3.0 and prior to version 2.3.0, symbolic links earlier in the archive are allowed to be used for later files in the archive without va…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:19:23.925Z. Updated 2025-03-19T15:50:49.160Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated19 Mar 2025, 22:50 WIB

Official record

HighPublished 17 Mar 2025, 20:15 WIB

CVE-2025-29786

Memory Exhaustion in Expr Parser with Unrestricted Input

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree (AST) node for each part of the expression. In scenarios where input size isn’t li…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:15:32.836Z. Updated 2026-01-23T16:29:26.719Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Jan 2026, 23:29 WIB

Official record

MedPublished 17 Mar 2025, 20:11 WIB

CVE-2025-27102

Agate vulnerable to HTML injection in user signup - Administrator phishing risk

Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary HTML code can be injected into a user's first and last name. This HTML is then rendered in the email sent to administrative users. The Agate service account sends…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:11:53.696Z. Updated 2025-03-17T13:31:23.176Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 20:31 WIB

Official record

MedPublished 17 Mar 2025, 20:06 WIB

CVE-2020-29010

CVE-2020-29010

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensitive data includes usern…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:06:16.993Z. Updated 2025-03-17T13:32:38.996Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated17 Mar 2025, 20:32 WIB

Official record

LowPublished 17 Mar 2025, 20:06 WIB

CVE-2019-17659

CVE-2019-17659

A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervisor as the restricted user "tunneluser" by leveraging knowledge of the private key from another installation or a firmware image.

Excerpt language: en.

Severity low: primary CNA CVSS 3.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:06:07.828Z. Updated 2025-03-17T13:35:08.816Z.

CVSS3.6v3.1KEVNot listedEPSSPresentUpdated17 Mar 2025, 20:35 WIB

Official record

MedPublished 17 Mar 2025, 20:05 WIB

CVE-2021-22126

CVE-2021-22126

A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may allow a local, authenticated attacker to connect to the managed Access Point (Meru AP and FortiAP-U) as root using the default hard-coded username and password.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:05:55.333Z. Updated 2026-02-26T19:09:28.871Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

MedPublished 17 Mar 2025, 20:05 WIB

CVE-2021-32584

CVE-2021-32584

An improper access control (CWE-284) vulnerability in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 and below, version 8.2.7 to 8.2.4, version 8.1.3 may allow an unauthenticated and remote attacker to access certain areas of the web management CGI functionality by just specifyi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:05:44.978Z. Updated 2025-03-17T13:37:26.791Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated17 Mar 2025, 20:37 WIB

Official record

HighPublished 17 Mar 2025, 20:05 WIB

CVE-2024-54027

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access to read sensitive data…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:05:31.108Z. Updated 2026-02-26T19:09:29.179Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

MedPublished 17 Mar 2025, 20:05 WIB

CVE-2021-26087

CVE-2021-26087

An improper neutralization of input during web page generation in FortiWLC version 8.6.0, version 8.5.3 and below, version 8.4.8 and below, version 8.3.3 web interface may allow both authenticated remote attackers and non-authenticated attackers in the same network as the appliance to perform a stored cross site script…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:05:19.849Z. Updated 2025-03-17T13:52:53.619Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated17 Mar 2025, 20:52 WIB

Official record

MedPublished 17 Mar 2025, 20:05 WIB

CVE-2019-15706

CVE-2019-15706

An improper neutralization of input during web page generation in the SSL VPN portal of FortiProxy version 2.0.0, version 1.2.9 and below and FortiOS version 6.2.1 and below, version 6.0.8 and below, version 5.6.12 may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS).

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:05:08.965Z. Updated 2025-03-17T13:53:31.962Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated17 Mar 2025, 20:53 WIB

Official record

MedPublished 17 Mar 2025, 20:00 WIB

CVE-2025-2378

PHPGurukul Medical Card Generation System download-medical-cards.php sql injection

A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been classified as critical. This affects an unknown part of the file /download-medical-cards.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T13:00:07.987Z. Updated 2025-03-17T13:54:59.723Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 20:54 WIB

Official record

MedPublished 17 Mar 2025, 19:31 WIB

CVE-2025-2377

SourceCodester Vehicle Management System confirmbooking.php cross site scripting

A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /confirmbooking.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T12:31:04.713Z. Updated 2025-03-17T15:52:26.866Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 22:52 WIB

Official record

MedPublished 17 Mar 2025, 19:23 WIB

CVE-2025-2401

Buffer overflow in Immunity Debugger

Buffer overflow vulnerability in Immunity Debugger affecting version 1.85, its exploitation could allow a local attacker to execute arbitrary code, due to the lack of proper boundary checking.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T12:23:28.435Z. Updated 2025-03-17T15:55:04.345Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 22:55 WIB

Official record

MedPublished 17 Mar 2025, 19:00 WIB

CVE-2025-2376

viames Pair Framework PHP Object UserRemember.php getCookieContent deserialization

A vulnerability has been found in viames Pair Framework up to 1.9.11 and classified as critical. Affected by this vulnerability is the function getCookieContent of the file /src/UserRemember.php of the component PHP Object Handler. The manipulation of the argument cookieName leads to deserialization. The attack can be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T12:00:07.802Z. Updated 2025-03-17T15:57:02.289Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 22:57 WIB

Official record

MedPublished 17 Mar 2025, 18:31 WIB

CVE-2025-2375

PHPGurukul Human Metapneumovirus Testing Management System Admin Profile Page profile.php cross site scripting

A vulnerability, which was classified as problematic, was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. Affected is an unknown function of the file /profile.php of the component Admin Profile Page. The manipulation of the argument email leads to cross site scripting. It is possible to launch …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T11:31:06.000Z. Updated 2025-03-17T16:06:21.510Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 23:06 WIB

Official record

MedPublished 17 Mar 2025, 18:00 WIB

CVE-2025-2374

PHPGurukul Human Metapneumovirus Testing Management System profile.php sql injection

A vulnerability, which was classified as critical, has been found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This issue affects some unknown processing of the file /profile.php. The manipulation of the argument aid/adminname/mobilenumber/email leads to sql injection. The attack may be initiated …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T11:00:18.566Z. Updated 2025-03-17T12:06:05.126Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 19:06 WIB

Official record

MedPublished 17 Mar 2025, 17:31 WIB

CVE-2025-2373

PHPGurukul Human Metapneumovirus Testing Management System check_availability.php sql injection

A vulnerability classified as critical was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. This vulnerability affects unknown code of the file /check_availability.php. The manipulation of the argument mobnumber/employeeid leads to sql injection. The attack can be initiated remotely. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T10:31:05.429Z. Updated 2025-03-17T12:07:44.253Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 19:07 WIB

Official record

MedPublished 17 Mar 2025, 17:14 WIB

CVE-2025-2202

Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php

Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-17T10:14:37.246Z. Updated 2025-03-17T12:15:05.683Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 19:15 WIB

Official record