Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 2301–2320 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

CritPublished 15 Mar 2025, 00:05 WIB

CVE-2025-29774

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T17:05:53.943Z. Updated 2025-03-15T20:50:21.614Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated16 Mar 2025, 03:50 WIB

Official record

MedPublished 14 Mar 2025, 23:56 WIB

CVE-2025-27606

Element Android PIN autologout bypass

Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wrong PIN more than the configured amount of times. An attacker with physical access to a device can exploit this to guess the PIN. Version 1.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2301 to 2320 of 4001.First page Next page

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T16:56:23.217Z. Updated 2025-03-14T18:11:03.936Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 01:11 WIB

Official record

MedPublished 14 Mar 2025, 23:25 WIB

CVE-2024-55594

CVE-2024-55594

An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T16:25:33.078Z. Updated 2025-03-14T16:58:29.982Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated14 Mar 2025, 23:58 WIB

Official record

MedPublished 14 Mar 2025, 23:11 WIB

CVE-2025-1888

Reflected Cross Site Scripting in Aperio Eslide Manager

The Leica Web Viewer within the Aperio Eslide Manager Application is vulnerable to reflected cross-site scripting (XSS). An authenticated user can access the slides within a project and injecting malicious JavaScript into the "memo" field. The memo field has a hover over action that will display a Microsoft Tool Tip wh…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T16:11:24.455Z. Updated 2025-03-14T17:06:23.438Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:06 WIB

Official record

MedPublished 14 Mar 2025, 22:46 WIB

CVE-2023-48785

CVE-2023-48785

An improper certificate validation vulnerability [CWE-295] in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the HTTPS communication channel between the FortiOS device, an inventory, and FortiNAC-F.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:46:57.799Z. Updated 2025-03-14T17:17:09.570Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:17 WIB

Official record

MedPublished 14 Mar 2025, 22:46 WIB

CVE-2023-33300

CVE-2023-33300

A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted request in inter-server communication port.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:46:48.352Z. Updated 2025-03-14T17:24:11.918Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:24 WIB

Official record

HighPublished 14 Mar 2025, 22:46 WIB

CVE-2023-45588

CVE-2023-45588

An external control of file name or path vulnerability [CWE-73] in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:46:35.063Z. Updated 2025-03-14T17:40:22.223Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:40 WIB

Official record

MedPublished 14 Mar 2025, 22:45 WIB

CVE-2024-40585

CVE-2024-40585

An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, version 6.2.11 and below and FortiAnalyzer version 7.4.0, version 7.2.3 and below, version 7.0.8 and below, version 6.4.12 and below, v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:45:46.084Z. Updated 2025-03-14T17:48:37.323Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:48 WIB

Official record

LowPublished 14 Mar 2025, 22:45 WIB

CVE-2022-29059

CVE-2022-29059

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb version 7.0.1 and below, 6.4.2 and below, 6.3.20 and below, 6.2.7 and below may allow a privileged attacker to execute SQL commands over the log database via specifically crafted strings parameters…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:45:33.731Z. Updated 2025-03-14T17:52:08.746Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:52 WIB

Official record

MedPublished 14 Mar 2025, 22:04 WIB

CVE-2024-47573

CVE-2024-47573

An improper validation of integrity check value vulnerability [CWE-354] in FortiNDR version 7.4.2 and below, version 7.2.1 and below, version 7.1.1 and below, version 7.0.6 and below may allow an authenticated attacker with at least Read/Write permission on system maintenance to install a corrupted firmware image.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:04:55.721Z. Updated 2025-03-14T17:53:27.052Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:53 WIB

Official record

HighPublished 14 Mar 2025, 22:03 WIB

CVE-2024-46662

CVE-2024-46662

A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiManager versions 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3 allows attacker to escalation of privilege via specifically crafted packets

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:03:27.830Z. Updated 2026-02-26T19:09:30.163Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

MedPublished 14 Mar 2025, 22:02 WIB

CVE-2024-40590

CVE-2024-40590

An improper certificate validation vulnerability [CWE-295] in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a Man-in-the-Middle position to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T15:02:47.500Z. Updated 2025-03-14T18:02:38.328Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated15 Mar 2025, 01:02 WIB

Official record

MedPublished 14 Mar 2025, 21:49 WIB

CVE-2024-45638

IBM QRadar EDR information disclosure

IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T14:49:52.646Z. Updated 2025-09-01T01:05:22.574Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2025, 08:05 WIB

Official record

MedPublished 14 Mar 2025, 21:49 WIB

CVE-2024-45643

IBM QRadar EDR information disclosure

IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T14:49:01.428Z. Updated 2026-02-26T19:09:30.494Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

HighPublished 14 Mar 2025, 21:25 WIB

CVE-2023-52927

netfilter: allow exp not to be removed in nf_ct_find_expectation

In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T14:25:59.166Z. Updated 2026-10-15T00:17:11.022Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated15 Oct 2026, 07:17 WIB

Official record

MedPublished 14 Mar 2025, 20:33 WIB

CVE-2025-2268

HP LaserJet MFP M232-M237 Printer Series - Potential Denial of Service

The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP).

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T13:33:33.887Z. Updated 2025-03-14T14:37:32.621Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Mar 2025, 21:37 WIB

Official record

HighPublished 14 Mar 2025, 20:13 WIB

CVE-2025-29776

Azle calling `setTimer` causes infinite loop of timers

Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to clean up the global state of the previous timer. The infinite loop will occur with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T13:13:27.137Z. Updated 2025-03-15T20:49:42.369Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated16 Mar 2025, 03:49 WIB

Official record

CritPublished 14 Mar 2025, 20:04 WIB

CVE-2025-2000

Qiskit SDK code execution

A maliciously crafted QPY file can potential execute arbitrary-code embedded in the payload without privilege escalation when deserialising QPY formats < 13. A python process calling Qiskit 0.18.0 through 1.4.1's `qiskit.qpy.load()` function could potentially execute any arbitrary Python code embedded in the correct pl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T13:04:46.351Z. Updated 2026-02-26T19:09:30.796Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:09 WIB

Official record

CritPublished 14 Mar 2025, 19:53 WIB

CVE-2025-27595

Weak hashing alghrythm

The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password can be easily calculated by an attacker. This impacts the security and the integrity of the device.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T12:53:13.682Z. Updated 2025-03-14T13:35:00.490Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated14 Mar 2025, 20:35 WIB

Official record

HighPublished 14 Mar 2025, 19:50 WIB

CVE-2025-27594

Unencrypted transmission of password hash

The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-14T12:50:15.198Z. Updated 2025-03-14T13:35:28.200Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Mar 2025, 20:35 WIB

Official record