Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 3541–3560 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

HighPublished 02 Apr 2025, 20:41 WIB

CVE-2024-45064

CVE-2024-45064

A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted set of network packets can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T13:41:58.080Z. Updated 2025-04-02T22:03:12.067Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated03 Apr 2025, 05:03 WIB

Official record

MedPublished 02 Apr 2025, 20:41 WIB

CVE-2024-50385

CVE-2024-50385

A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3541 to 3560 of 4033.First page Next page

Published 2025-04-02T13:41:57.295Z. Updated 2025-11-03T19:31:49.760Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:31 WIB

Official record

MedPublished 02 Apr 2025, 20:41 WIB

CVE-2024-50384

CVE-2024-50384

A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T13:41:57.136Z. Updated 2025-11-03T19:31:48.392Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:31 WIB

Official record

MedPublished 02 Apr 2025, 20:41 WIB

CVE-2024-50595

CVE-2024-50595

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T13:41:56.435Z. Updated 2025-11-03T19:31:52.516Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:31 WIB

Official record

MedPublished 02 Apr 2025, 20:41 WIB

CVE-2024-50594

CVE-2024-50594

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T13:41:56.253Z. Updated 2025-11-03T19:31:51.151Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:31 WIB

Official record

MedPublished 02 Apr 2025, 20:41 WIB

CVE-2024-50597

CVE-2024-50597

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Component H…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T13:41:55.517Z. Updated 2025-11-03T19:31:55.240Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:31 WIB

Official record

MedPublished 02 Apr 2025, 20:41 WIB

CVE-2024-50596

CVE-2024-50596

An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects the NetX Duo Web Compone…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T13:41:55.311Z. Updated 2025-11-03T19:31:53.881Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:31 WIB

Official record

UnscoredPublished 02 Apr 2025, 19:53 WIB

CVE-2025-21993

iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()

In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:53:15.513Z. Updated 2026-05-11T21:10:34.056Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:10 WIB

Official record

UnscoredPublished 02 Apr 2025, 19:53 WIB

CVE-2025-21992

HID: ignore non-functional sensor in HP 5MP Camera

In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-functional sensor via iio_info causes system hangs as runtime PM tr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:53:14.833Z. Updated 2026-05-11T21:10:32.913Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:10 WIB

Official record

UnscoredPublished 02 Apr 2025, 19:53 WIB

CVE-2025-21991

x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes

In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses per-CPU data for the first CPU of each mask. According to D…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:53:14.230Z. Updated 2026-05-23T15:57:34.986Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:57 WIB

Official record

UnscoredPublished 02 Apr 2025, 19:53 WIB

CVE-2025-21990

drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags PRT BOs may not have any backing store, so bo->tbo.resource will be NULL. Check for that before dereferencing. (cherry picked from commit 3e3fcd29b505cebed659311337ea03b76987…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:53:13.590Z. Updated 2026-05-11T21:10:30.585Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:10 WIB

Official record

UnscoredPublished 02 Apr 2025, 19:53 WIB

CVE-2025-21989

drm/amd/display: fix missing .is_two_pixels_per_container

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix missing .is_two_pixels_per_container Starting from 6.11, AMDGPU driver, while being loaded with amdgpu.dc=1, due to lack of .is_two_pixels_per_container function in dce60_tg_funcs, causes a NULL pointer dereference on PCs with ol…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:53:12.956Z. Updated 2026-05-11T21:10:29.475Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:10 WIB

Official record

CritPublished 02 Apr 2025, 19:53 WIB

CVE-2025-21988

fs/netfs/read_collect: add to next->prev_donated

In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to the same "next" request (depending on the subrequest completion order), each of them would overwrite the `prev_donated` field, causing data corruption and a BUG()…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:53:12.170Z. Updated 2026-08-05T11:55:52.895Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:55 WIB

Official record

UnscoredPublished 02 Apr 2025, 19:53 WIB

CVE-2025-1805

Crypt::Salt for Perl uses insecure rand() function when generating salts for cryptographic purposes

Crypt::Salt for Perl version 0.01 uses insecure rand() function when generating salts for cryptographic purposes.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:53:08.960Z. Updated 2025-04-03T19:11:47.221Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Apr 2025, 02:11 WIB

Official record

UnscoredPublished 02 Apr 2025, 19:30 WIB

CVE-2025-21987

drm/amdgpu: init return value in amdgpu_ttm_clear_buffer

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: init return value in amdgpu_ttm_clear_buffer Otherwise an uninitialized value can be returned if amdgpu_res_cleared returns true for all regions. Possibly closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3812 (cherry picked from …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T12:30:11.811Z. Updated 2026-05-11T21:10:27.082Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:10 WIB

Official record

MedPublished 02 Apr 2025, 18:09 WIB

CVE-2025-2842

Tempo-operator: tempo operator token exposition lead to read sensitive data

A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T11:09:55.496Z. Updated 2026-09-08T21:26:21.988Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Sep 2026, 04:26 WIB

Official record

MedPublished 02 Apr 2025, 18:07 WIB

CVE-2025-2786

Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessRevie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T11:07:43.285Z. Updated 2026-09-08T21:26:17.376Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Sep 2026, 04:26 WIB

Official record

MedPublished 02 Apr 2025, 16:21 WIB

CVE-2025-3097

wp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T09:21:45.939Z. Updated 2026-04-08T17:33:07.262Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:33 WIB

Official record

HighPublished 02 Apr 2025, 16:21 WIB

CVE-2025-3063

Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajax_callback_update_sa_option() function in versions 2.0 to 2.1. This makes it possible for authenticated attackers, with Subscriber-level …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T09:21:45.582Z. Updated 2025-04-02T14:03:20.932Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated02 Apr 2025, 21:03 WIB

Official record

MedPublished 02 Apr 2025, 16:21 WIB

CVE-2025-2483

Gift Certificate Creator <= 1.1.0 - Reflected Cross-Site Scripting via receip_address Parameter

The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receip_address’ parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-02T09:21:45.192Z. Updated 2026-04-08T17:15:12.168Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:15 WIB

Official record