Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 2201–2220 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25582

i-doit CMDB 1.12 Arbitrary File Download via file_manager Parameter

i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php. Attackers can send GET requests to index.php with file_manager=image and supply arbitrary file paths like src/config.inc.php to retrieve con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:40.332Z. Updated 2026-03-24T15:15:06.377Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:15 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25581

i-doit CMDB 1.12 SQL Injection via objGroupID Parameter

i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the objGroupID parameter. Attackers can send GET requests with crafted SQL payloads in the objGroupID parameter to extract sensitive database information in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2201 to 2220 of 6236.First page Next page

Published 2026-03-21T15:30:39.536Z. Updated 2026-03-23T19:55:52.869Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 02:55 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25580

ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php

ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:38.596Z. Updated 2026-03-23T16:34:46.408Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:34 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25579

phpTransformer 2016.9 Directory Traversal via jQueryFileUpload

phpTransformer 2016.9 contains a directory traversal vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the path parameter. Attackers can send requests to the jQueryFileUploadmaster server endpoint with traversal sequences ../../../../../../ to list and retrieve files outside …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:37.851Z. Updated 2026-10-01T15:19:18.485Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25578

phpTransformer 2016.9 SQL Injection via GeneratePDF.php

phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to extract sensitive database informa…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:37.160Z. Updated 2026-10-01T15:19:17.843Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

MedPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25577

SeoToaster Ecommerce 3.0.0 Local File Inclusion via backend_theme

SeoToaster Ecommerce 3.0.0 contains a local file inclusion vulnerability that allows authenticated attackers to read arbitrary files by manipulating path parameters in backend theme endpoints. Attackers can send POST requests to /backend/backend_theme/editcss/ or /backend/backend_theme/editjs/ with directory traversal …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:36.380Z. Updated 2026-03-23T16:24:31.805Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:24 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25576

Kepler Wallpaper Script 1.1 SQL Injection via category

Kepler Wallpaper Script 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the category parameter. Attackers can send GET requests to the category endpoint with URL-encoded SQL UNION statements to extract database informati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:34.815Z. Updated 2026-03-24T15:15:12.492Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:15 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25575

SimplePress CMS 1.0.7 SQL Injection via p and s Parameters

SimplePress CMS 1.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'p' and 's' parameters. Attackers can send GET requests with crafted SQL payloads to extract sensitive database information including usernames, da…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:33.799Z. Updated 2026-03-23T20:03:27.725Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 03:03 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25574

Green CMS 2.x Path Traversal Arbitrary File Download

Green CMS 2.x contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files and directories by injecting directory traversal sequences. Attackers can manipulate the theme_name parameter in the themeexporthandle action or supply base64-encoded file paths to the downfile action t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:33.098Z. Updated 2026-07-15T01:23:59.464Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

HighPublished 21 Mar 2026, 22:30 WIB

CVE-2019-25573

Green CMS 2.x SQL Injection via cat Parameter

Green CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cat parameter. Attackers can send GET requests to index.php with m=admin, c=posts, a=index parameters and inject SQL code in the cat parameter to manipulate …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:30:32.203Z. Updated 2026-07-15T01:23:58.754Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

MedPublished 21 Mar 2026, 22:02 WIB

CVE-2026-4516

Foundation Agents MetaGPT DataInterpreter write_analysis_code.py injection

A vulnerability was found in Foundation Agents MetaGPT up to 0.8.1. This vulnerability affects unknown code of the file metagpt/actions/di/write_analysis_code.py of the component DataInterpreter. The manipulation results in injection. It is possible to launch the attack remotely. The exploit has been made public and co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T15:02:11.636Z. Updated 2026-03-23T15:37:36.483Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 22:37 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25572

NordVPN 6.19.6 Denial of Service via Email Field Buffer Overflow

NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:11.466Z. Updated 2026-03-23T15:38:06.456Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 22:38 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25571

MediaMonkey 4.1.23 Denial of Service via Malformed URL

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a URL, which causes the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:10.769Z. Updated 2026-03-23T16:24:02.799Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:24 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25570

RealTerm Serial Terminal 2.0.0.70 Denial of Service via Port Field

RealTerm Serial Terminal 2.0.0.70 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Port field. Attackers can paste a buffer of 1000 characters into the Port input field and click the open button to trigger a crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:10.060Z. Updated 2026-03-24T15:15:17.526Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:15 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25569

RealTerm Serial Terminal 2.0.0.70 SEH Overflow Crash

RealTerm Serial Terminal 2.0.0.70 contains a stack-based buffer overflow vulnerability in the Echo Port field that allows local attackers to crash the application by triggering a structured exception handler (SEH) chain corruption. Attackers can craft a malicious input string with 268 bytes of padding followed by SEH o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:09.361Z. Updated 2026-03-23T20:09:18.372Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 03:09 WIB

Official record

CritPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25568

Memu Play 6.0.7 Privilege Escalation via Insecure File Permissions

Memu Play 6.0.7 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by replacing the MemuService.exe executable. Attackers can rename and overwrite MemuService.exe in the installation directory with a malicious executable, which executes with system-level privilege…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:08.620Z. Updated 2026-03-23T16:36:43.619Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:36 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25567

Valentina Studio 9.0.5 Linux Buffer Overflow via Host Field

Valentina Studio 9.0.5 Linux contains a buffer overflow vulnerability in the Host field of the connection dialog that allows local attackers to crash the application by supplying an oversized input string. Attackers can trigger the vulnerability by pasting a crafted buffer exceeding 264 bytes into the Host field during…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:07.903Z. Updated 2026-03-24T14:17:40.410Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 21:17 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25566

TransMac 12.3 Denial of Service via Volume Name Field

TransMac 12.3 contains a buffer overflow vulnerability in the volume name field that allows local attackers to crash the application by supplying an excessively long string. Attackers can create a malicious file with 1000 repeated characters, paste the content into the volume name field during disk image creation, and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:07.202Z. Updated 2026-07-15T01:23:58.074Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25565

Magic Iso Maker 5.5 Buffer Overflow Denial of Service

Magic Iso Maker 5.5 build 281 contains a buffer overflow vulnerability in the Serial Code registration field that allows local attackers to crash the application by submitting an oversized input. Attackers can generate a file containing 5000 bytes of data, paste it into the Serial Code field during registration, and tr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:06.486Z. Updated 2026-03-23T16:23:36.384Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated23 Mar 2026, 23:23 WIB

Official record

MedPublished 21 Mar 2026, 19:47 WIB

CVE-2019-25564

PCHelpWareV2 1.0.0.5 Denial of Service via Group Field

PCHelpWareV2 1.0.0.5 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Group field. Attackers can paste a buffer overflow payload into the Group property field and click Ok to trigger an application crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-21T12:47:04.862Z. Updated 2026-03-24T15:15:22.499Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated24 Mar 2026, 22:15 WIB

Official record