Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 2221–2240 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

NonePublished 11 Apr 2025, 01:28 WIB

CVE-2025-3469

i18n XSS vulnerability in HTMLMultiSelectField when sections are used

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

Excerpt language: en.

Severity none: primary CNA CVSS 0 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T18:28:13.370Z. Updated 2025-11-03T19:53:59.985Z.

CVSS0v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:53 WIB

Official record

MedPublished 11 Apr 2025, 00:26 WIB

CVE-2025-22232

Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: * You have Spring Vault on the classpath of your Spring Cloud Config Server and * You are using the X-CONFIG-TOKEN hea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2221 to 2240 of 4033.First page Next page

Published 2025-04-10T17:26:56.755Z. Updated 2025-04-10T18:08:28.560Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated11 Apr 2025, 01:08 WIB

Official record

LowPublished 10 Apr 2025, 22:33 WIB

CVE-2025-24866

Unauthorized Access to User Activity Logs API by delegated granular administration roles

Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T15:33:21.882Z. Updated 2025-04-10T15:43:54.351Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 22:43 WIB

Official record

LowPublished 10 Apr 2025, 21:40 WIB

CVE-2025-32382

Snowflake credentials logged by the Metabase backend

Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T14:40:53.861Z. Updated 2025-04-10T15:23:19.566Z.

CVSS1.8v4.0KEVNot listedEPSSPresentUpdated10 Apr 2025, 22:23 WIB

Official record

MedPublished 10 Apr 2025, 21:32 WIB

CVE-2025-32027

Yii does not prevent XSS in scenarios where fallback error renderer is used

Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T14:32:31.116Z. Updated 2025-04-10T14:54:23.272Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 21:54 WIB

Official record

MedPublished 10 Apr 2025, 21:31 WIB

CVE-2025-0362

Improper Restriction of Rendered UI Layers or Frames in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions, an attacker could potentially trick users into unintentionally authorizing sensitive actions on their behalf.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T14:31:17.009Z. Updated 2025-04-10T14:56:33.843Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 21:56 WIB

Official record

LowPublished 10 Apr 2025, 20:30 WIB

CVE-2025-2469

Debug Messages Revealing Unnecessary Information in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific service was accessible to unauthenticated users.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:30:43.136Z. Updated 2025-04-10T14:13:00.917Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 21:13 WIB

Official record

MedPublished 10 Apr 2025, 20:26 WIB

CVE-2023-43035

IBM Sterling Control Center information disclosure

IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:26:44.672Z. Updated 2025-08-17T00:05:25.920Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated17 Aug 2025, 07:05 WIB

Official record

MedPublished 10 Apr 2025, 20:25 WIB

CVE-2025-32395

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec (RFC 9112) does not allow # in request-target. Although an attacker can send such a request. F…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:25:19.177Z. Updated 2025-04-10T14:14:40.591Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated10 Apr 2025, 21:14 WIB

Official record

MedPublished 10 Apr 2025, 20:24 WIB

CVE-2023-42007

IBM Sterling Control Center cross-site scripting

IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:24:46.308Z. Updated 2025-08-17T00:09:35.887Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated17 Aug 2025, 07:09 WIB

Official record

MedPublished 10 Apr 2025, 20:19 WIB

CVE-2023-43037

IBM Maximo Application Suite improper access control

IBM Maximo Application Suite 8.11 and 9.0 could allow an authenticated user to perform unauthorized actions due to improper input validation.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:19:47.338Z. Updated 2025-08-16T23:43:52.116Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated17 Aug 2025, 06:43 WIB

Official record

MedPublished 10 Apr 2025, 20:11 WIB

CVE-2025-32391

HedgeDoc allows XSS possibility through malicious SVG uploads

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the possibility of XSS when opened in a new tab instead of the editor itself. The XSS is possible by exploiting the JSONP capabilities of GitHub Gist embeddings. Only i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:11:48.634Z. Updated 2025-04-10T13:34:59.611Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:34 WIB

Official record

MedPublished 10 Apr 2025, 20:07 WIB

CVE-2025-32383

MaxKB has a reverse shell vulnerability in function library

MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG). A reverse shell vulnerability exists in the module of function library. The vulnerability allow privileged‌ users to create a reverse shell. This vulnerability …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:07:12.404Z. Updated 2025-04-10T13:35:56.129Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:35 WIB

Official record

MedPublished 10 Apr 2025, 20:02 WIB

CVE-2024-11129

Generation of Error Message Containing Sensitive Information in GitLab

An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:02:48.148Z. Updated 2025-04-10T13:16:35.153Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:16 WIB

Official record

MedPublished 10 Apr 2025, 20:02 WIB

CVE-2025-30148

Silverstripe Framework has a XSS vulnerability in HTML editor

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitized …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T13:02:22.415Z. Updated 2025-04-10T13:34:14.930Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:34 WIB

Official record

MedPublished 10 Apr 2025, 19:58 WIB

CVE-2025-25197

Silverstripe Elemental enables XSS attacks in elemental "Content blocks in use" reports

Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field. An elemental block can include an XSS payload, which can be executed when viewing the "Content blocks in use" report. The vulnerability is specific to that repo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T12:58:13.674Z. Updated 2025-04-10T13:34:47.431Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:34 WIB

Official record

MedPublished 10 Apr 2025, 19:30 WIB

CVE-2025-1677

Allocation of Resources Without Limits or Throttling in GitLab

A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T12:30:58.715Z. Updated 2025-04-10T13:02:54.300Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:02 WIB

Official record

MedPublished 10 Apr 2025, 19:30 WIB

CVE-2025-2408

Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access restrictions and view sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T12:30:48.931Z. Updated 2025-04-10T13:03:28.479Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:03 WIB

Official record

UnscoredPublished 10 Apr 2025, 18:21 WIB

CVE-2025-32755

CVE-2025-32755

In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Je…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T11:21:31.212Z. Updated 2025-04-10T13:20:19.382Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:20 WIB

Official record

UnscoredPublished 10 Apr 2025, 18:20 WIB

CVE-2025-32754

CVE-2025-32754

In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-10T11:20:29.928Z. Updated 2025-04-10T13:21:34.648Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2025, 20:21 WIB

Official record