Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates
4,033 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.
CVE-2025-22928
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the cp_id parameter at /modules/messages/Inbox.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-21T18:33:52.217Z.
CVE-2025-22929
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-21T18:32:23.657Z.
CVE-2025-22930
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-21T18:31:14.783Z.
CVE-2025-22931
An insecure direct object reference (IDOR) in the component /assets/stafffiles of OS4ED openSIS v7.0 to v9.1 allows unauthenticated attackers to access files uploaded by staff members.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-21T18:26:32.580Z.
CVE-2025-26817
Netwrix Password Secure 9.2.0.32454 allows OS command injection.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-05-29T13:28:16.752Z.
CVE-2025-26818
Netwrix Password Secure through 9.2 allows command injection.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-04T15:26:39.643Z.
CVE-2025-29064
An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-07T18:36:12.254Z.
CVE-2025-29369
Code-Projects Matrimonial Site V1.0 is vulnerable to SQL Injection in /view_profile.php?id=1.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-10T20:36:55.239Z.
CVE-2025-29462
A buffer overflow vulnerability has been discovered in Tenda Ac15 V15.13.07.13. The vulnerability occurs when the webCgiGetUploadFile function calls the socketRead function to process HTTP request messages, resulting in the overwriting of a buffer on the stack.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-07T14:54:47.596Z.
CVE-2025-29504
Insecure Permission vulnerability in student-manage 1 allows a local attacker to escalate privileges via the Unsafe permission verification.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-04T15:20:58.512Z.
CVE-2025-29570
An issue in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 allows a local attacker to escalate privileges via the function tftp_image_check of a binary named rc.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-07T14:52:50.027Z.
CVE-2025-29647
SeaCMS v13.3 has a SQL injection vulnerability in the component admin_tempvideo.php.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-04T15:32:51.279Z.
CVE-2025-29991
Yubico YubiKey 5.4.1 through 5.7.3 before 5.7.4 has an incorrect FIDO CTAP PIN/UV Auth Protocol Two implementation. It uses the signature length from CTAP PIN/UV Auth Protocol One, even when CTAP PIN/UV Auth Protocol Two was chosen, resulting in a partial signature verification.
Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-04-03T14:06:05.266Z.
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to a…
Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-10-21T22:55:22.155Z.
CVE-2025-31161
CrushFTP 10 before 10.8.4 and 11 before 11.3.1 allows authentication bypass and takeover of the crushadmin account (unless a DMZ proxy instance is used), as exploited in the wild in March and April 2025, aka "Unauthenticated HTTP(S) port access." A race condition exists in the AWS4-HMAC (compatible with S3) authorizati…
Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.
Published 2025-04-03T00:00:00.000Z. Updated 2025-10-21T22:55:22.326Z.
WonderCMS Theme Installation/Plugin Installation installUpdateModuleAction unrestricted upload
A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclos…
Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-02T22:31:04.900Z. Updated 2025-04-03T14:07:27.286Z.
Out-of-bounds array write due to invalid VerticesPerRow in Xpdf 4.05
Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid VerticesPerRow value in a PDF shading dictionary.
Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-02T22:18:46.033Z. Updated 2025-04-03T19:15:26.279Z.
HCL DevOps Deploy / HCL Launch is susceptible to unauthorized access to other services
HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its Agent Relay service.
Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-02T22:04:02.098Z. Updated 2025-04-03T19:17:23.547Z.
WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereference
A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctionBody of the file src/interp/binary-reader-interp.cc. The manipulation leads to null pointer dereference. The attack can be launched remotely. The complexity of …
Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-02T22:00:14.705Z. Updated 2025-04-03T19:18:20.492Z.
PyTorch torch.jit.jit_module_from_flatbuffer memory corruption
A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-04-02T22:00:12.390Z. Updated 2025-04-03T19:26:25.202Z.