Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 3501–3520 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

CritPublished 03 Apr 2025, 04:38 WIB

CVE-2025-31484

conda-forge infrastructure uses a bad token for Azure's cf-staging access

conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a package to the conda-forge c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:38:03.493Z. Updated 2025-04-03T19:38:18.563Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 02:38 WIB

Official record

MedPublished 03 Apr 2025, 04:31 WIB

CVE-2025-3120

SourceCodester Apartment Visitors Management System add-apartment.php sql injection

A vulnerability was found in SourceCodester Apartment Visitors Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /add-apartment.php. The manipulation of the argument apartmentno leads to sql injection. The attack may be initiated remotely. The exploit has been …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3501 to 3520 of 4033.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:31:07.699Z. Updated 2025-04-06T05:30:16.175Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated06 Apr 2025, 12:30 WIB

Official record

MedPublished 03 Apr 2025, 04:31 WIB

CVE-2025-3119

SourceCodester Online Tutor Portal manage_course.php sql injection

A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /tutor/courses/manage_course.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:31:05.341Z. Updated 2025-04-06T05:29:59.698Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated06 Apr 2025, 12:29 WIB

Official record

LowPublished 03 Apr 2025, 04:23 WIB

CVE-2025-30218

Next.js may leak x-middleware-subrequest-id to external hosts

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host as the Next.js applicat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:23:14.660Z. Updated 2025-10-13T15:37:02.310Z.

CVSS1.7v4.0KEVNot listedEPSSPresentUpdated13 Oct 2025, 22:37 WIB

Official record

UnscoredPublished 03 Apr 2025, 04:10 WIB

CVE-2025-3130

Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obfuscate: from 0.0.0 before 2.0.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:10:46.804Z. Updated 2025-04-03T13:18:28.164Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2025, 20:18 WIB

Official record

UnscoredPublished 03 Apr 2025, 04:10 WIB

CVE-2025-3129

Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.4.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:10:22.236Z. Updated 2025-04-15T14:11:12.235Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Apr 2025, 21:11 WIB

Official record

CritPublished 03 Apr 2025, 04:10 WIB

CVE-2025-31477

Improper Scope Validation in the open Endpoint of tauri-plugin-shell

The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener (e.g. xdg-open on Linux). This was meant to be restricte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:10:14.264Z. Updated 2025-04-03T13:59:36.712Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated03 Apr 2025, 20:59 WIB

Official record

HighPublished 03 Apr 2025, 04:09 WIB

CVE-2025-31479

canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output

canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:09:34.354Z. Updated 2025-04-03T14:01:08.763Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated03 Apr 2025, 21:01 WIB

Official record

LowPublished 03 Apr 2025, 04:09 WIB

CVE-2025-27608

Self Cross-Site Scripting in Arduino IDE

Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within the Arduino-IDE prior to version v2.3.5. The vulnerability occurs in the Additional Board Manager URLs field, which can be found in the Preferences -> Settings s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:09:16.943Z. Updated 2025-04-03T14:01:53.189Z.

CVSS1v4.0KEVNot listedEPSSPresentUpdated03 Apr 2025, 21:01 WIB

Official record

UnscoredPublished 03 Apr 2025, 04:00 WIB

CVE-2025-2704

CVE-2025-2704

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:00:58.582Z. Updated 2025-10-23T10:53:34.373Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Oct 2025, 17:53 WIB

Official record

MedPublished 03 Apr 2025, 04:00 WIB

CVE-2025-3118

SourceCodester Online Tutor Portal view_course.php sql injection

A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been classified as critical. This affects an unknown part of the file /tutor/courses/view_course.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T21:00:12.775Z. Updated 2025-04-06T05:29:44.536Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated06 Apr 2025, 12:29 WIB

Official record

MedPublished 02 Apr 2025, 23:39 WIB

CVE-2025-31286

CVE-2025-31286

An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this issue has already been addressed on the backend service and is no longer considered an active vulnerability.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:39:41.799Z. Updated 2025-04-07T13:43:02.128Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated07 Apr 2025, 20:43 WIB

Official record

MedPublished 02 Apr 2025, 23:39 WIB

CVE-2025-31285

CVE-2025-31285

A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:39:33.203Z. Updated 2026-02-26T18:28:58.468Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 02 Apr 2025, 23:39 WIB

CVE-2025-31284

CVE-2025-31284

A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and is n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:39:23.853Z. Updated 2026-02-26T18:28:58.756Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 02 Apr 2025, 23:39 WIB

CVE-2025-31283

CVE-2025-31283

A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:39:12.847Z. Updated 2026-02-26T18:28:59.175Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 02 Apr 2025, 23:38 WIB

CVE-2025-31282

CVE-2025-31282

A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users who could then change the role of the account and ultimately escalate privileges. Please note: ths issue has already been addressed on the backend service an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:38:38.227Z. Updated 2026-02-26T18:28:59.472Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

HighPublished 02 Apr 2025, 23:20 WIB

CVE-2024-36336

CVE-2024-36336

Integer overflow within the AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to a loss of confidentiality, integrity, or availability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:20:06.723Z. Updated 2025-04-02T16:30:34.551Z.

CVSS7.9v3.1KEVNot listedEPSSPresentUpdated02 Apr 2025, 23:30 WIB

Official record

HighPublished 02 Apr 2025, 23:18 WIB

CVE-2024-36328

CVE-2024-36328

Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of integrity or availability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:18:15.926Z. Updated 2025-04-02T16:30:20.527Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated02 Apr 2025, 23:30 WIB

Official record

MedPublished 02 Apr 2025, 23:17 WIB

CVE-2025-20203

CVE-2025-20203

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against users of the interface of an affected system. The vulnerability exists …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:17:24.683Z. Updated 2025-04-02T16:32:01.718Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated02 Apr 2025, 23:32 WIB

Official record

MedPublished 02 Apr 2025, 23:16 WIB

CVE-2025-20120

CVE-2025-20120

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T16:16:54.694Z. Updated 2025-04-02T16:33:02.226Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated02 Apr 2025, 23:33 WIB

Official record