Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,980 published records · 19 KEV · 3,980 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,980 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2446.1%
High95724%
Med1,53639%
Low1193.0%
None00.00%
Legacy00.00%
Unscored1,12428%

Matching records by UTC month

May 253,980

Signal coverage

KEV-listed: 19
With a forecast: 3,980
Unknown date: 0
Unscored severity: 1,124

Share of cohort: KEV 0.48% · forecast 100% · unscored 28%.

Showing 221–240 of 3,980By severity band: Critical · 9.0–10.0 244, High · 7.0–8.9 957, Medium · 4.0–6.9 1,536, Low · 0.1–3.9 119, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,124

UnscoredPublished 29 May 2025, 07:00 WIB

CVE-2024-54952

CVE-2024-54952

MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability. Remote, unauthenticated attackers can exploit this issue by sending specially crafted packets, triggering a null pointer dereference. This leads to a Remote Denial of Service (DoS), rendering the SMB service unavailable.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T00:00:00.000Z. Updated 2025-05-29T20:40:25.786Z.

CVSS—KEVNot listedEPSSPresentUpdated30 May 2025, 03:40 WIB

Official record

UnscoredPublished 29 May 2025, 07:00 WIB

CVE-2025-29632

CVE-2025-29632

Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP, security.go, handler_generated.go, handleInitialUEMessageMain, DecodePlainNasNoIntegrityCheck, GetSecurityHeaderType components

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T00:00:00.000Z. Updated 2025-05-29T18:07:21.167Z.

Showing 221 to 240 of 3980.First page Next page

CVSS

—

KEVNot listed

EPSSPresent

Updated30 May 2025, 01:07 WIB

Official record

UnscoredPublished 29 May 2025, 07:00 WIB

CVE-2025-45474

CVE-2025-45474

maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T00:00:00.000Z. Updated 2025-05-29T15:54:17.872Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:54 WIB

Official record

UnscoredPublished 29 May 2025, 07:00 WIB

CVE-2025-46078

CVE-2025-46078

HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T00:00:00.000Z. Updated 2025-05-29T14:02:03.442Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 21:02 WIB

Official record

UnscoredPublished 29 May 2025, 07:00 WIB

CVE-2025-46080

CVE-2025-46080

HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and craft malicious files with specific suffixes, thereby gaining control of the server.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T00:00:00.000Z. Updated 2025-05-29T14:09:30.325Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 21:09 WIB

Official record

UnscoredPublished 29 May 2025, 07:00 WIB

CVE-2025-48748

CVE-2025-48748

Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-29T00:00:00.000Z. Updated 2025-05-29T15:20:20.774Z.

CVSS—KEVNot listedEPSSPresentUpdated29 May 2025, 22:20 WIB

Official record

MedPublished 29 May 2025, 04:01 WIB

CVE-2025-27706

Cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.54

CVE-2025-27706 is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator visits the page. Attack com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T21:01:08.548Z. Updated 2025-05-28T23:55:03.442Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated29 May 2025, 06:55 WIB

Official record

HighPublished 29 May 2025, 03:56 WIB

CVE-2025-27703

Privilege escalation in the management console of Absolute Secure Access prior to version 13.54

CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to a specific subset of privileged features in the console can elevate their permissions to access additional features in the console. The attack co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T20:56:53.459Z. Updated 2025-05-28T23:57:51.968Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated29 May 2025, 06:57 WIB

Official record

MedPublished 29 May 2025, 03:42 WIB

CVE-2025-27702

Permissions bypass in the management console of Absolute Secure Access prior to version 13.54

CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly modify settings. The attack complexity is low, there ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T20:42:34.657Z. Updated 2025-05-28T23:54:02.125Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 May 2025, 06:54 WIB

Official record

MedPublished 29 May 2025, 00:47 WIB

CVE-2025-5256

Open Redirect vulnerability on user unlock path

SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. Open Redirection via returnUrl Paramete…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T17:47:05.674Z. Updated 2025-05-28T17:57:39.395Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 May 2025, 00:57 WIB

Official record

MedPublished 29 May 2025, 00:34 WIB

CVE-2024-47055

Segment cloning doesn't have a proper permission check

SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks. Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T17:34:32.181Z. Updated 2025-05-29T19:02:53.247Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated30 May 2025, 02:02 WIB

Official record

MedPublished 29 May 2025, 00:26 WIB

CVE-2025-1461

Vuetify XSS through 'eventMoreText' prop of VCalendar

Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsanitized HTML to be inserted into the page. This can lead to a Cross-Site Scripting (XSS) https://owasp.org/www-community/attacks/xss attack. The vulnerability occurs because the default Vuetify tran…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T17:26:51.320Z. Updated 2025-05-29T19:02:08.446Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated30 May 2025, 02:02 WIB

Official record

MedPublished 29 May 2025, 00:23 WIB

CVE-2024-47057

User name enumeration possible due to response time difference on password reset form

SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate valid usernames. User Enumeration via Timing Attack: A user enumeration vulnerability exists in the "Forget your password" f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T17:23:53.064Z. Updated 2025-05-29T18:59:24.381Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated30 May 2025, 01:59 WIB

Official record

MedPublished 29 May 2025, 00:08 WIB

CVE-2025-32803

Insecure file permissions can result in confidential information leakage

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T17:08:20.769Z. Updated 2025-05-28T17:28:58.513Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated29 May 2025, 00:28 WIB

Official record

MedPublished 29 May 2025, 00:08 WIB

CVE-2025-32802

Insecure handling of file paths allows multiple local attacks

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T17:08:11.180Z. Updated 2025-05-28T17:23:22.213Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 May 2025, 00:23 WIB

Official record

HighPublished 29 May 2025, 00:03 WIB

CVE-2025-32801

Loading a malicious hook library can lead to local privilege escalation

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T17:03:34.499Z. Updated 2025-05-28T17:33:50.355Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated29 May 2025, 00:33 WIB

Official record

MedPublished 28 May 2025, 23:24 WIB

CVE-2024-47056

Mautic does not shield .env files from web traffic

SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of sensitive information, including database credentials, API keys, and other critical system configurations. Sensitive Inf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T16:24:57.162Z. Updated 2025-05-28T23:47:09.780Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated29 May 2025, 06:47 WIB

Official record

MedPublished 28 May 2025, 23:17 WIB

CVE-2025-5257

Predictable Page Indexing Might Lead to Sensitive Data Exposure

SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. Unauthorized Access to Unpublished Page Preview…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T16:17:54.013Z. Updated 2025-05-28T23:43:08.966Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 May 2025, 06:43 WIB

Official record

MedPublished 28 May 2025, 23:14 WIB

CVE-2025-36572

CVE-2025-36572

Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image file. A low privileged attacker with remote access, with the knowledge of the hard-coded credentials, could potentially exploit this vulnerability to gain unauthorized access based on the hardcoded acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T16:14:20.913Z. Updated 2025-05-28T16:26:34.111Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 May 2025, 23:26 WIB

Official record

MedPublished 28 May 2025, 22:22 WIB

CVE-2024-51453

IBM Sterling Secure Proxy directory traversal

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-05-28T15:22:39.745Z. Updated 2025-08-15T14:35:08.705Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated15 Aug 2025, 21:35 WIB

Official record