Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 341–360 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 27 Apr 2025, 08:00 WIB

CVE-2025-3955

codeprojects Patient Record Management System edit_rpatient.php.php sql injection

A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. This affects an unknown part of the file /edit_rpatient.php.php. The manipulation of the argument id/lastname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T01:00:08.866Z. Updated 2025-04-28T18:09:36.809Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 01:09 WIB

Official record

HighPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46657

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-28T16:19:40.784Z.

Showing 341 to 360 of 4033.First page Next page

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:19 WIB

Official record

LowPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46672

CVE-2025-46672

NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-29T15:22:18.313Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:22 WIB

Official record

MedPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46673

CVE-2025-46673

NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security protocol (SDLS).

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-29T15:22:12.623Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:22 WIB

Official record

LowPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46674

CVE-2025-46674

NASA CryptoLib before 1.3.2 uses Extended Procedures that are a Work in Progress (not intended for use during flight), potentially leading to a keystream oracle.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-28T16:19:53.199Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:19 WIB

Official record

LowPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46675

CVE-2025-46675

In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-28T16:19:46.895Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:19 WIB

Official record

MedPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46687

CVE-2025-46687

quickjs-ng through 0.9.0 has a missing length check in JS_ReadString for a string, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-28T16:19:35.018Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:19 WIB

Official record

MedPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46688

CVE-2025-46688

quickjs-ng through 0.9.0 has an incorrect size calculation in JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-28T16:19:28.938Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:19 WIB

Official record

MedPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46689

CVE-2025-46689

Ververica Platform 2.14.0 contain an Reflected XSS vulnerability via a namespaces/default/formats URI.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-28T16:19:22.673Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:19 WIB

Official record

MedPublished 27 Apr 2025, 07:00 WIB

CVE-2025-46690

CVE-2025-46690

Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request.

Excerpt language: en.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T00:00:00.000Z. Updated 2025-04-28T16:19:16.655Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:19 WIB

Official record

MedPublished 27 Apr 2025, 04:31 WIB

CVE-2025-3954

ChurchCRM Referer server-side request forgery

A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Affected by this issue is some unknown functionality of the component Referer Handler. The manipulation leads to server-side request forgery. The attack may be launched remotely. The complexity of an attack is rather high. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T21:31:03.683Z. Updated 2025-04-28T21:57:19.743Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 04:57 WIB

Official record

HighPublished 26 Apr 2025, 15:23 WIB

CVE-2025-2101

Edumall <= 4.2.4 - Unauthenticated Local File Inclusion

The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_lazy_load_template' AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T08:23:20.508Z. Updated 2026-04-08T17:02:19.375Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:02 WIB

Official record

MedPublished 26 Apr 2025, 15:23 WIB

CVE-2024-13812

Anps Theme plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution

The The Anps Theme plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T08:23:19.926Z. Updated 2026-04-08T16:53:01.290Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:53 WIB

Official record

HighPublished 26 Apr 2025, 15:00 WIB

CVE-2025-2851

GL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflow

A vulnerability classified as critical has been found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T08:00:08.117Z. Updated 2025-04-28T18:09:44.918Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 01:09 WIB

Official record

MedPublished 26 Apr 2025, 14:31 WIB

CVE-2025-2850

GL.iNet GL-A1300 Slate Plus Download Interface improper authorization

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T07:31:03.631Z. Updated 2025-04-28T18:09:52.772Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 01:09 WIB

Official record

MedPublished 26 Apr 2025, 14:00 WIB

CVE-2025-2811

GL.iNet GL-A1300 Slate Plus API redos

A vulnerability was found in GL.iNet GL-A1300 Slate Plus, GL-AR300M16 Shadow, GL-AR300M Shadow, GL-AR750 Creta, GL-AR750S-EXT Slate, GL-AX1800 Flint, GL-AXT1800 Slate AX, GL-B1300 Convexa-B, GL-B3000 Marble, GL-BE3600 Slate 7, GL-E750, GL-E750V2 Mudi, GL-MT300N-V2 Mango, GL-MT1300 Beryl, GL-MT2500 Brume 2, GL-MT3000 Be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T07:00:05.770Z. Updated 2025-04-28T18:09:59.404Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 01:09 WIB

Official record

UnscoredPublished 26 Apr 2025, 13:00 WIB

CVE-2025-2907

Order Delivery Date Pro for WooCommerce < 12.3.1 - Unauthenticated Arbitrary Option Update

The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_rol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T06:00:05.145Z. Updated 2025-04-29T15:22:24.627Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:22 WIB

Official record

MedPublished 26 Apr 2025, 12:34 WIB

CVE-2025-3915

Aeropage Sync for Airtable <= 3.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The Aeropage Sync for Airtable plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'aeropageDeletePost' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T05:34:25.018Z. Updated 2026-04-08T17:34:11.484Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:34 WIB

Official record

HighPublished 26 Apr 2025, 12:34 WIB

CVE-2025-3906

Integração entre Eduzz e Woocommerce 1.5.0 - 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Integração entre Eduzz e Woocommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wep_opcoes' function in all versions up to, and including, 1.7.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to edit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T05:34:24.565Z. Updated 2026-04-08T17:31:14.104Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:31 WIB

Official record

HighPublished 26 Apr 2025, 12:34 WIB

CVE-2025-3914

Aeropage Sync for Airtable <= 3.2.0 - Authenticated (Subscriber+) Arbitrary File Upload

The Aeropage Sync for Airtable plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aeropage_media_downloader' function in all versions up to, and including, 3.2.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T05:34:24.102Z. Updated 2026-04-08T17:13:12.020Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:13 WIB

Official record