Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 2201–2220 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 11 Apr 2025, 08:45 WIB

CVE-2025-0121

Cortex XDR Agent: Local Windows User Can Crash the Agent

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-11T01:45:54.148Z. Updated 2025-04-11T16:02:36.119Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:02 WIB

Official record

HighPublished 11 Apr 2025, 08:44 WIB

CVE-2025-0120

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution requires that the local user can also successfully exploit a race c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2201 to 2220 of 4033.First page Next page

Published 2025-04-11T01:44:48.253Z. Updated 2025-05-02T19:08:27.987Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated03 May 2025, 02:08 WIB

Official record

MedPublished 11 Apr 2025, 08:20 WIB

CVE-2025-26335

CVE-2025-26335

Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-11T01:20:28.507Z. Updated 2025-04-11T16:02:52.857Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:02 WIB

Official record

MedPublished 11 Apr 2025, 08:13 WIB

CVE-2024-51461

IBM QRadar WinCollect Agent denial of service

IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume memory resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-11T01:13:57.207Z. Updated 2025-09-01T00:54:56.805Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Sep 2025, 07:54 WIB

Official record

HighPublished 11 Apr 2025, 07:00 WIB

CVE-2025-32367

CVE-2025-32367

The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-11T00:00:00.000Z. Updated 2025-04-11T17:40:00.539Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated12 Apr 2025, 00:40 WIB

Official record

HighPublished 11 Apr 2025, 07:00 WIB

CVE-2025-32808

CVE-2025-32808

W. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their quiz performance into the backend, because only client-side access control exists.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-11T00:00:00.000Z. Updated 2025-04-11T16:03:30.292Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:03 WIB

Official record

MedPublished 11 Apr 2025, 07:00 WIB

CVE-2025-32809

CVE-2025-32809

W. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against educators via a bonus description, feedback.choice_fb[], or question_id.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-11T00:00:00.000Z. Updated 2025-04-11T16:03:21.550Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:03 WIB

Official record

LowPublished 11 Apr 2025, 07:00 WIB

CVE-2025-32816

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-11T00:00:00.000Z. Updated 2025-04-11T16:03:10.125Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:03 WIB

Official record

MedPublished 11 Apr 2025, 04:02 WIB

CVE-2025-29918

Suricata pcre: negated pcr can cause infinite loop

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. A PCRE rule can be written that leads to an infinite loop when negated PCRE is used. Packet processing thread becomes stuck in infinite loop limiting visibility and availability in inline mode. This vul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T21:02:32.646Z. Updated 2025-11-03T19:46:43.978Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:46 WIB

Official record

MedPublished 11 Apr 2025, 04:00 WIB

CVE-2025-29917

Suricata decode_base64: signature can do large memory allocation

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The bytes setting in the decode_base64 keyword is not properly limited. Due to this, signatures using the keyword and setting can cause large memory allocations of up to 4 GiB per thread. This vulnerabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T21:00:05.924Z. Updated 2025-04-11T16:03:53.438Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 23:03 WIB

Official record

MedPublished 11 Apr 2025, 03:03 WIB

CVE-2025-29916

Suricata datasets: ruleset declared settings can lead to resource starvation

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Datasets declared in rules have an option to specify the `hashsize` to use. This size setting isn't properly limited, so the hash table allocation can be large. Untrusted rules can lead to large memory …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T20:03:16.834Z. Updated 2025-04-10T20:21:27.471Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 03:21 WIB

Official record

HighPublished 11 Apr 2025, 02:51 WIB

CVE-2025-29915

Suricata af-packet: defrag option can lead to truncated packets affecting visibility

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. The AF_PACKET defrag option is enabled by default and allows AF_PACKET to re-assemble fragmented packets before reaching Suricata. However the default packet size in Suricata is based on the network int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T19:51:48.289Z. Updated 2025-04-10T20:05:50.746Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 03:05 WIB

Official record

UnscoredPublished 11 Apr 2025, 01:57 WIB

CVE-2025-23010

CVE-2025-23010

An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to manipulate file paths.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:57:59.176Z. Updated 2025-04-17T15:56:20.519Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Apr 2025, 22:56 WIB

Official record

UnscoredPublished 11 Apr 2025, 01:55 WIB

CVE-2025-23009

CVE-2025-23009

A local privilege escalation vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to trigger an arbitrary file deletion.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:55:52.641Z. Updated 2025-04-17T15:57:11.699Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Apr 2025, 22:57 WIB

Official record

UnscoredPublished 11 Apr 2025, 01:55 WIB

CVE-2025-23008

CVE-2025-23008

An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configurations.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:55:06.669Z. Updated 2025-04-10T19:13:49.010Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Apr 2025, 02:13 WIB

Official record

LowPublished 11 Apr 2025, 01:31 WIB

CVE-2025-32700

AbuseFilter log interfaces expose global private and hidden filters when central DB is not available

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php, includes/View/AbuseFilterViewExamine.Php. This issue …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:31:03.497Z. Updated 2025-04-10T18:49:53.510Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 01:49 WIB

Official record

LowPublished 11 Apr 2025, 01:30 WIB

CVE-2025-32699

Potential javascript injection attack enabled by Unicode normalization in Action API

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:30:24.238Z. Updated 2025-11-03T19:53:36.439Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:53 WIB

Official record

LowPublished 11 Apr 2025, 01:29 WIB

CVE-2025-32698

LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

Excerpt language: en.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:29:52.354Z. Updated 2025-11-03T19:53:35.072Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:53 WIB

Official record

NonePublished 11 Apr 2025, 01:29 WIB

CVE-2025-32697

Cascading protection is not preventing file reversions

Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php. This issue affects MediaWiki: before 1.42.6, 1.43.1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:29:17.482Z. Updated 2025-04-10T19:05:48.098Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated11 Apr 2025, 02:05 WIB

Official record

NonePublished 11 Apr 2025, 01:28 WIB

CVE-2025-32696

"reupload-own" restriction can be bypassed by reverting file

Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/RevertAction.Php, includes/api/ApiFileRevert.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:28:48.161Z. Updated 2025-11-03T19:53:33.707Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:53 WIB

Official record