Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 2281–2300 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

HighPublished 15 Mar 2025, 09:22 WIB

CVE-2025-1657

Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection

The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-15T02:22:41.764Z. Updated 2026-04-08T16:35:28.754Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

HighKEVPublished 15 Mar 2025, 07:00 WIB

CVE-2025-30066

CVE-2025-30066

tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)

Excerpt language: en.

Showing 2281 to 2300 of 4001.First page Next page

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-03-15T00:00:00.000Z. Updated 2026-02-26T19:09:29.628Z.

CVSS8.6v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

MedPublished 15 Mar 2025, 05:00 WIB

CVE-2025-2320

274056675 springboot-openai-chatgpt User submit improper authorization

A vulnerability has been found in 274056675 springboot-openai-chatgpt e84f6f5 and classified as critical. Affected by this vulnerability is the function submit of the file /api/blade-user/submit of the component User Handler. The manipulation leads to improper authorization. The attack can be launched remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T22:00:09.313Z. Updated 2025-03-17T15:20:06.922Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated17 Mar 2025, 22:20 WIB

Official record

LowPublished 15 Mar 2025, 04:35 WIB

CVE-2025-2295

Potential iSCSI R2T PDU Vulnerability

EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T21:35:10.484Z. Updated 2025-03-18T16:19:50.500Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated18 Mar 2025, 23:19 WIB

Official record

MedPublished 15 Mar 2025, 04:00 WIB

CVE-2025-2310

HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow

A vulnerability was found in HDF5 1.14.6 and classified as critical. This issue affects the function H5MM_strndup of the component Metadata Attribute Decoder. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T21:00:09.852Z. Updated 2025-05-08T08:59:00.157Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated08 May 2025, 15:59 WIB

Official record

MedPublished 15 Mar 2025, 04:00 WIB

CVE-2025-2309

HDF5 Type Conversion Logic H5T__bit_copy heap-based overflow

A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5T__bit_copy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T21:00:07.781Z. Updated 2025-05-08T08:58:58.349Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated08 May 2025, 15:58 WIB

Official record

MedPublished 15 Mar 2025, 03:31 WIB

CVE-2025-2308

HDF5 Scale-Offset Filter H5Z__scaleoffset_decompress_one_byte heap-based overflow

A vulnerability, which was classified as critical, was found in HDF5 1.14.6. This affects the function H5Z__scaleoffset_decompress_one_byte of the component Scale-Offset Filter. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T20:31:04.336Z. Updated 2025-05-08T08:58:56.350Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated08 May 2025, 15:58 WIB

Official record

MedPublished 15 Mar 2025, 02:05 WIB

CVE-2025-29782

WeGIA Cross-Site Scripting (XSS) Stored in endpoint `adicionar_tipo_docs_atendido.php` parameter `tipo`

WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpoint in versions of the WeGIA application prior to 3.2.17. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The inject…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T19:05:40.774Z. Updated 2025-03-18T16:26:11.648Z.

CVSS6.4v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 23:26 WIB

Official record

MedPublished 15 Mar 2025, 01:56 WIB

CVE-2025-29771

HtmlSanitizer vulnerable to XSS when used with contentEditable

HtmlSanitizer is a client-side HTML Sanitizer. Versions prior to 2.0.3 have a cross-site scripting vulnerability when the sanitizer is used with a `contentEditable` element to set the elements `innerHTML` to a sanitized string produced by the package. If the code is particularly crafted to abuse the code beautifier, th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T18:56:24.504Z. Updated 2025-03-18T14:26:06.976Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:26 WIB

Official record

HighPublished 15 Mar 2025, 01:11 WIB

CVE-2024-12245

Blind SQL Injection in Logout

Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T18:11:14.218Z. Updated 2025-03-18T17:05:58.045Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated19 Mar 2025, 00:05 WIB

Official record

MedPublished 15 Mar 2025, 01:09 WIB

CVE-2024-12020

Reflected Cross-Site Scripting (XSS)

There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance. An unauthenticated attacker could deceive a user into clicking a crafted link to trigger the vulnerability. Stealing the session cookie is not possible due to cookie security flags, however the XSS may be used to in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T18:09:24.810Z. Updated 2025-03-18T14:09:12.073Z.

CVSS6.4v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:09 WIB

Official record

HighPublished 15 Mar 2025, 01:07 WIB

CVE-2024-12019

Arbitrary File Read via Document API

The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerabilit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T18:07:01.253Z. Updated 2025-03-18T16:26:57.725Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 23:26 WIB

Official record

HighPublished 15 Mar 2025, 01:04 WIB

CVE-2024-54449

Remote Code Execution (RCE) via Arbitrary File Write In Document API

The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘write’ privileges on at lea…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T18:04:20.149Z. Updated 2025-03-18T16:27:46.227Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 23:27 WIB

Official record

HighPublished 15 Mar 2025, 01:01 WIB

CVE-2024-54448

Remote Code Execution (RCE) via Automation Scripting

The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T18:01:25.311Z. Updated 2026-08-26T17:55:52.628Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 00:55 WIB

Official record

HighPublished 15 Mar 2025, 00:57 WIB

CVE-2024-54447

Blind SQLi in Saved Search

Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T17:57:26.356Z. Updated 2025-03-18T16:37:33.586Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated18 Mar 2025, 23:37 WIB

Official record

HighPublished 15 Mar 2025, 00:53 WIB

CVE-2024-54446

Blind SQLi in Document History

Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T17:53:01.300Z. Updated 2025-03-14T18:13:21.649Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated15 Mar 2025, 01:13 WIB

Official record

HighPublished 15 Mar 2025, 00:49 WIB

CVE-2024-54445

Blind SQLi in Login

Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or lack thereof entries in certain database tables.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T17:49:44.090Z. Updated 2025-03-14T18:15:11.612Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Mar 2025, 01:15 WIB

Official record

MedPublished 15 Mar 2025, 00:26 WIB

CVE-2025-29780

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `feldman_vss` library contains timing side-channel vulnerabilities in its matrix operations, specifically within the `_find_secure_pivot` funct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T17:26:58.453Z. Updated 2025-03-19T15:27:58.698Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated19 Mar 2025, 22:27 WIB

Official record

MedPublished 15 Mar 2025, 00:24 WIB

CVE-2025-29779

Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`

Post-Quantum Secure Feldman's Verifiable Secret Sharing provides a Python implementation of Feldman's Verifiable Secret Sharing (VSS) scheme. In versions 0.8.0b2 and prior, the `secure_redundant_execution` function in feldman_vss.py attempts to mitigate fault injection attacks by executing a function multiple times and…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T17:24:10.215Z. Updated 2025-03-19T15:27:08.671Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated19 Mar 2025, 22:27 WIB

Official record

CritPublished 15 Mar 2025, 00:11 WIB

CVE-2025-29775

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T17:11:05.590Z. Updated 2025-03-15T20:45:45.927Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated16 Mar 2025, 03:45 WIB

Official record