Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,673 published records · 15 KEV · 3,673 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,673 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1654.5%
High96026%
Med1,12231%
Low1203.3%
None10.03%
Legacy00.00%
Unscored1,30536%

Matching records by UTC month

Feb 253,673

Signal coverage

KEV-listed: 15
With a forecast: 3,673
Unknown date: 0
Unscored severity: 1,305

Share of cohort: KEV 0.41% · forecast 100% · unscored 36%.

Showing 361–380 of 3,673By severity band: Critical · 9.0–10.0 165, High · 7.0–8.9 960, Medium · 4.0–6.9 1,122, Low · 0.1–3.9 120, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,305

MedPublished 27 Feb 2025, 02:28 WIB

CVE-2025-1726

[#BUG-000172669 ArcGIS Monitor has a security vulnerability]

There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T19:28:51.480Z. Updated 2025-02-27T20:48:55.628Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Feb 2025, 03:48 WIB

Official record

HighPublished 26 Feb 2025, 23:56 WIB

CVE-2025-1634

Io.quarkus:quarkus-resteasy: memory leak in quarkus resteasy classic when client requests timeout

A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 361 to 380 of 3673.First page Next page

Published 2025-02-26T16:56:23.869Z. Updated 2026-10-20T04:21:41.384Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 11:21 WIB

Official record

MedPublished 26 Feb 2025, 23:28 WIB

CVE-2025-0941

MET ONE 3400+ Potential Credential Exposure

MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T16:28:36.746Z. Updated 2025-02-26T17:02:46.560Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2025, 00:02 WIB

Official record

MedPublished 26 Feb 2025, 23:23 WIB

CVE-2025-20119

Cisco Application Policy Infrastructure Controller Authenticated Local Denial of Service Vulnerability

A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to a race conditio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T16:23:37.170Z. Updated 2025-03-03T19:02:59.455Z.

CVSS6v3.1KEVNot listedEPSSPresentUpdated04 Mar 2025, 02:02 WIB

Official record

MedPublished 26 Feb 2025, 23:23 WIB

CVE-2025-20118

Cisco Application Policy Infrastructure Controller Authenticated Command Injection Due to Sensitive Disclosure Vulnerability

A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T16:23:28.132Z. Updated 2025-03-03T19:03:28.886Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated04 Mar 2025, 02:03 WIB

Official record

MedPublished 26 Feb 2025, 23:12 WIB

CVE-2025-20161

Cisco NX-OS Software Command Injection Vulnerability

A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker with valid Administrator credentials to execute a command injection attack on the underlying operating system of an affected devi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T16:12:03.165Z. Updated 2025-02-27T15:18:00.247Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2025, 22:18 WIB

Official record

MedPublished 26 Feb 2025, 23:11 WIB

CVE-2025-20117

Cisco Application Policy Infrastructure Controller Authenticated Command Injection Vulnerability

A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T16:11:26.187Z. Updated 2025-02-27T15:16:53.763Z.

CVSS5.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2025, 22:16 WIB

Official record

MedPublished 26 Feb 2025, 23:11 WIB

CVE-2025-20116

Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper input validation in the web UI. An authenticate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T16:11:17.385Z. Updated 2025-02-27T15:10:56.631Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2025, 22:10 WIB

Official record

HighPublished 26 Feb 2025, 23:11 WIB

CVE-2025-20111

Cisco Nexus 3000 and 9000 Series Switches Layer 2 Ethernet Denial of Service Vulnerability

A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T16:11:07.388Z. Updated 2025-02-26T18:03:22.774Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated27 Feb 2025, 01:03 WIB

Official record

UnscoredPublished 26 Feb 2025, 21:57 WIB

CVE-2022-49732

sock: redo the psock vs ULP protection check

In the Linux kernel, the following vulnerability has been resolved: sock: redo the psock vs ULP protection check Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to the new tcp_bpf_update_proto() function. I'm guessing that this …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T14:57:24.827Z. Updated 2026-05-11T19:05:45.444Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:05 WIB

Official record

MedPublished 26 Feb 2025, 21:51 WIB

CVE-2025-1716

picklescan - Security scanning bypass via 'pip main'

picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass sec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T14:51:38.085Z. Updated 2025-12-29T14:22:50.868Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Dec 2025, 21:22 WIB

Official record

MedPublished 26 Feb 2025, 21:32 WIB

CVE-2025-1249

WordPress Events Manager plugin <= 6.6.4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T14:32:10.186Z. Updated 2026-04-28T16:10:57.455Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 26 Feb 2025, 21:04 WIB

CVE-2025-0719

IBM Cloud Pak for Data cross-site scripting

IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T14:04:04.974Z. Updated 2025-02-26T14:20:27.526Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2025, 21:20 WIB

Official record

MedPublished 26 Feb 2025, 20:21 WIB

CVE-2025-26925

WordPress Admin Menu Manager plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T13:21:03.954Z. Updated 2026-04-28T16:11:44.155Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 26 Feb 2025, 19:01 WIB

CVE-2024-47051

Remote Code Execution & File Deletion in Asset Uploads

This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RCE) via Asset Upload: A Remote Code Execution vulnerability has been identified in the asset upload functionality. Insuffi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T12:01:26.374Z. Updated 2025-02-26T14:29:46.622Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated26 Feb 2025, 21:29 WIB

Official record

HighPublished 26 Feb 2025, 18:54 WIB

CVE-2024-47053

Improper Authorization in Reporting API

This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. * Improper Authorization: An authorization flaw exists in Mautic's API Authorization implementation. Any authenticated user, regardless of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T11:54:17.219Z. Updated 2025-03-12T19:51:32.738Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated13 Mar 2025, 02:51 WIB

Official record

MedPublished 26 Feb 2025, 18:48 WIB

CVE-2022-25773

Relative Path Traversal in assets file upload

This advisory addresses a file placement vulnerability that could allow assets to be uploaded to unintended directories on the server. * Improper Limitation of a Pathname to a Restricted Directory: A vulnerability exists in the asset upload functionality that allows users to upload files to directories outside of t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T11:48:33.383Z. Updated 2025-03-12T19:51:58.376Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated13 Mar 2025, 02:51 WIB

Official record

MedPublished 26 Feb 2025, 18:12 WIB

CVE-2024-6810

Quiz Organizer <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Quiz Organizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T11:12:33.394Z. Updated 2026-04-08T16:57:43.443Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:57 WIB

Official record

MedPublished 26 Feb 2025, 17:01 WIB

CVE-2025-0731

SMA: Sunny Portal Remote Code Execution

An unauthenticated remote attacker can upload a .aspx file instead of a PV system picture through the demo account. The code can only be executed in the security context of the user.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T10:01:50.336Z. Updated 2025-02-26T15:27:59.319Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2025, 22:27 WIB

Official record

LowPublished 26 Feb 2025, 15:42 WIB

CVE-2025-26698

CVE-2025-26698

Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicious files may be downloaded to the system where using the product.

Excerpt language: en.

Severity low: primary CNA CVSS 2.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-26T08:42:53.924Z. Updated 2025-02-26T15:32:14.346Z.

CVSS2.7v3.0KEVNot listedEPSSPresentUpdated26 Feb 2025, 22:32 WIB

Official record