Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,682 published records · 18 KEV · 3,682 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,682 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2155.8%
High97827%
Med1,75848%
Low1233.3%
None30.08%
Legacy00.00%
Unscored60516%

Matching records by UTC month

Jun 253,682

Signal coverage

KEV-listed: 18
With a forecast: 3,682
Unknown date: 0
Unscored severity: 605

Share of cohort: KEV 0.49% · forecast 100% · unscored 16%.

Showing 2141–2160 of 3,682By severity band: Critical · 9.0–10.0 215, High · 7.0–8.9 978, Medium · 4.0–6.9 1,758, Low · 0.1–3.9 123, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 605

HighPublished 11 Jun 2025, 07:00 WIB

CVE-2025-49091

CVE-2025-49091

KDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports loading URLs from the scheme handlers such as a ssh:// or telnet:// or rlogin:// URL. This can be executed regardless of whether the ssh, telnet, or rlogin binary is available. In this mode, there is a code path where if that bin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-11T00:00:00.000Z. Updated 2025-06-18T00:12:14.361Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated18 Jun 2025, 07:12 WIB

Official record

HighPublished 11 Jun 2025, 06:25 WIB

CVE-2024-9062

macOS Archify: Local Privilege Escalation

The Archify application contains a local privilege escalation vulnerability due to insufficient client validation in its privileged helper tool, com.oct4pie.archifyhelper, which is exposed via XPC. Archify follows the "factored applications" model, delegating privileged operations—such as arbitrary file deletion and fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2141 to 2160 of 3682.First page Next page

Published 2025-06-10T23:25:30.420Z. Updated 2025-06-11T13:41:12.653Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:41 WIB

Official record

MedPublished 11 Jun 2025, 06:23 WIB

CVE-2025-1055

K7 Security Anti-Malware: IOCTL in K7RKScan.sys Allows Arbitrary Termination of High-Privilege and System Processes by a Low-Privilege User

A vulnerability in the K7RKScan.sys driver, part of the K7 Security Anti-Malware suite, allows a local low-privilege user to send crafted IOCTL requests to terminate a wide range of processes running with administrative or system-level privileges, with the exception of those inherently protected by the operating system…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:23:19.887Z. Updated 2025-06-11T13:48:09.364Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:48 WIB

Official record

MedPublished 11 Jun 2025, 06:22 WIB

CVE-2024-8270

macOS Rocket.Chat: TCC Policy Bypass via Dylib Injection Due to Missing Code Signing Flags and Dangerous Entitlements

The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control (TCC) policies, enabling the exploitation or abuse of permissions specified in its entitlements (e.g., microphone, camera, automation, network client). Since Rocket.Chat was not signed with the Har…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:22:10.307Z. Updated 2025-06-11T13:49:40.053Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:49 WIB

Official record

HighPublished 11 Jun 2025, 06:19 WIB

CVE-2024-7457

macOS Stash network-management utility: Unauthorized Manipulation of System Network Preferences

The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's authorization reference, the helper invokes AuthorizationCopyRights() using its own privileged context (root), effectively authorizing itself rather than the cli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:19:47.186Z. Updated 2025-06-11T13:52:22.705Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:52 WIB

Official record

HighPublished 11 Jun 2025, 06:15 WIB

CVE-2025-32717

Microsoft Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:15:25.299Z. Updated 2026-02-20T16:00:55.219Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated20 Feb 2026, 23:00 WIB

Official record

MedPublished 11 Jun 2025, 06:12 WIB

CVE-2025-30675

Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins

In Apache CloudStack, a flaw in access control affects the listTemplates and listIsos APIs. A malicious Domain Admin or Resource Admin can exploit this issue by intentionally specifying the 'domainid' parameter along with the 'filter=self' or 'filter=selfexecutable' values. This allows the attacker to gain unauthorized…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:12:23.838Z. Updated 2025-06-11T13:52:21.335Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:52 WIB

Official record

LowPublished 11 Jun 2025, 06:11 WIB

CVE-2025-22829

Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin

The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the envi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:11:24.828Z. Updated 2025-06-11T13:53:45.517Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:53 WIB

Official record

UnscoredPublished 11 Jun 2025, 06:08 WIB

CVE-2025-26521

Apache CloudStack: CKS cluster in project exposes user API keys

When an Apache CloudStack user-account creates a CKS-based Kubernetes cluster in a project, the API key and the secret key of the 'kubeadmin' user of the caller account are used to create the secret config in the CKS-based Kubernetes cluster. A member of the project who can access the CKS-based Kubernetes cluster, can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:08:48.602Z. Updated 2026-02-26T17:50:42.855Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

UnscoredPublished 11 Jun 2025, 06:07 WIB

CVE-2025-47849

Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can get the API key and secret key of user-accounts of Admin role type in the same domain. This operation is not appropriately restricted and allows the attacker to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:07:54.526Z. Updated 2026-02-26T17:50:43.214Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

UnscoredPublished 11 Jun 2025, 06:06 WIB

CVE-2025-47713

Apache CloudStack: Domain Admin can reset Admin password in Root Domain

A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in the ROOT domain can reset the password of user-accounts of Admin role type. This operation is not appropriately restricted and allows the attacker to assume control over higher-priv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T23:06:45.585Z. Updated 2026-02-26T17:50:43.568Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Feb 2026, 00:50 WIB

Official record

MedPublished 11 Jun 2025, 05:31 WIB

CVE-2025-5985

code-projects School Fees Payment System improper authentication

A vulnerability was found in code-projects School Fees Payment System 1.0 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:31:07.011Z. Updated 2025-06-11T13:48:03.673Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:48 WIB

Official record

MedPublished 11 Jun 2025, 05:31 WIB

CVE-2025-5984

SourceCodester Online Student Clearance System add-fee.php cross site scripting

A vulnerability has been found in SourceCodester Online Student Clearance System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Admin/add-fee.php. The manipulation of the argument txtamt leads to cross site scripting. The attack can be launched remotely. The e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:31:05.242Z. Updated 2025-06-11T13:37:59.598Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:37 WIB

Official record

MedPublished 11 Jun 2025, 05:20 WIB

CVE-2025-46995

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:20:35.818Z. Updated 2025-06-11T13:41:52.681Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:41 WIB

Official record

MedPublished 11 Jun 2025, 05:20 WIB

CVE-2025-46917

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:20:35.058Z. Updated 2025-06-11T13:43:30.305Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:43 WIB

Official record

MedPublished 11 Jun 2025, 05:20 WIB

CVE-2025-46901

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:20:34.283Z. Updated 2025-06-11T13:45:09.141Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:45 WIB

Official record

MedPublished 11 Jun 2025, 05:20 WIB

CVE-2025-47052

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:20:33.125Z. Updated 2025-06-11T13:52:46.480Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 20:52 WIB

Official record

MedPublished 11 Jun 2025, 05:20 WIB

CVE-2025-46954

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:20:32.374Z. Updated 2025-06-11T14:14:11.633Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 21:14 WIB

Official record

MedPublished 11 Jun 2025, 05:20 WIB

CVE-2025-47077

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:20:31.597Z. Updated 2025-06-11T14:19:26.549Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 21:19 WIB

Official record

MedPublished 11 Jun 2025, 05:20 WIB

CVE-2025-47091

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page contai…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-06-10T22:20:30.113Z. Updated 2025-06-11T14:21:35.152Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated11 Jun 2025, 21:21 WIB

Official record