Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 361–380 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54807

CVE-2024-54807

In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient parameter of the AddPortMapping SOAPAction into a system call without sanitation. An attacker can send a specially crafted SOAPAction request for AddPortMapping vi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T14:04:38.356Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 21:04 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54808

CVE-2024-54808

Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained use of sscanf. The vulnerability allows for control of the program counter and can be utilized to achieve arbitrary code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T13:57:20.705Z.

Showing 361 to 380 of 4001.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 20:57 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2024-54809

CVE-2024-54809

Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header parameter in a strncpy where size is determined based on the input specified. By sending a specially crafted packet, an attacker can take control of the program c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-02T13:55:32.964Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2025, 20:55 WIB

Official record

MedPublished 31 Mar 2025, 07:00 WIB

CVE-2024-55093

CVE-2024-55093

phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-03-31T13:41:23.227Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:41 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2025-22937

CVE-2025-22937

An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-08-18T16:31:00.932Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2025, 23:31 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2025-22938

CVE-2025-22938

Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-08-18T16:32:07.671Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2025, 23:32 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2025-22939

CVE-2025-22939

A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-08-18T16:33:18.049Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2025, 23:33 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2025-22940

CVE-2025-22940

Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-08-18T16:34:32.253Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2025, 23:34 WIB

Official record

UnscoredPublished 31 Mar 2025, 07:00 WIB

CVE-2025-22941

CVE-2025-22941

A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-08-18T16:35:49.116Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Aug 2025, 23:35 WIB

Official record

CritPublished 31 Mar 2025, 07:00 WIB

CVE-2025-29266

CVE-2025-29266

Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-03-31T13:03:44.987Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:03 WIB

Official record

CritPublished 31 Mar 2025, 07:00 WIB

CVE-2025-30095

CVE-2025-30095

VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private host keys across different installations. Thus, an attacker can conduct active man-in-the-middle attacks against SSH connections if Dropbear is enabled as the SSH daemon. I n VyOS…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-31T00:00:00.000Z. Updated 2025-04-21T18:55:28.219Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated22 Apr 2025, 01:55 WIB

Official record

MedPublished 31 Mar 2025, 04:31 WIB

CVE-2025-2961

opensolon org.noear.solon.core.handle.RenderManager aa render_mav path traversal

A vulnerability classified as problematic was found in opensolon up to 3.1.0. This vulnerability affects the function render_mav of the file /aa of the component org.noear.solon.core.handle.RenderManager. The manipulation of the argument template with the input ../org/example/HelloApp.class leads to path traversal: '..…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T21:31:05.057Z. Updated 2025-03-31T15:46:30.775Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 22:46 WIB

Official record

UnscoredPublished 31 Mar 2025, 04:10 WIB

CVE-2024-13804

CVE-2024-13804

Unauthenticated RCE in HPE Insight Cluster Management Utility

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T21:10:54.859Z. Updated 2025-03-31T23:35:39.658Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Apr 2025, 06:35 WIB

Official record

HighPublished 31 Mar 2025, 04:00 WIB

CVE-2025-2960

TRENDnet TEW-637AP/TEW-638APB HTTP Request goahead sub_41DED0 null pointer dereference

A vulnerability classified as problematic has been found in TRENDnet TEW-637AP and TEW-638APB 1.2.7/1.3.0.106. This affects the function sub_41DED0 of the file /bin/goahead of the component HTTP Request Handler. The manipulation leads to null pointer dereference. Access to the local network is required for this attack.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T21:00:10.878Z. Updated 2025-03-31T14:28:21.693Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 21:28 WIB

Official record

HighPublished 31 Mar 2025, 03:31 WIB

CVE-2025-2959

TRENDnet TEW-410APB HTTP Request httpd sub_4019A0 null pointer dereference

A vulnerability was found in TRENDnet TEW-410APB 1.3.06b. It has been rated as problematic. Affected by this issue is the function sub_4019A0 of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack needs to be initiated within the local network. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T20:31:05.582Z. Updated 2025-03-31T14:29:10.736Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 21:29 WIB

Official record

HighPublished 31 Mar 2025, 03:00 WIB

CVE-2025-2958

TRENDnet TEW-818DRU HTTP Request httpd denial of service

A vulnerability was found in TRENDnet TEW-818DRU 1.0.14.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to denial of service. The attack needs to be done within the local network.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T20:00:09.476Z. Updated 2025-04-01T14:36:33.881Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 21:36 WIB

Official record

HighPublished 31 Mar 2025, 02:00 WIB

CVE-2025-2957

TRENDnet TEW-411BRP+ HTTP Request httpd sub_401DB0 null pointer dereference

A vulnerability was found in TRENDnet TEW-411BRP+ 2.07. It has been classified as problematic. Affected is the function sub_401DB0 of the file /usr/sbin/httpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack can only be initiated within the local network. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T19:00:07.178Z. Updated 2025-04-01T14:36:56.637Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 21:36 WIB

Official record

HighPublished 31 Mar 2025, 01:00 WIB

CVE-2025-2956

TRENDnet TI-G102i HTTP Request lighttpd plugins_call_handle_uri_raw null pointer dereference

A vulnerability was found in TRENDnet TI-G102i 1.0.7.S0_ /1.0.8.S0_ and classified as problematic. This issue affects the function plugins_call_handle_uri_raw of the file /usr/sbin/lighttpd of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack can only be done within the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T18:00:09.819Z. Updated 2025-03-31T14:01:26.813Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 21:01 WIB

Official record

MedPublished 31 Mar 2025, 00:31 WIB

CVE-2025-2955

TOTOLINK A3000RU IBMS Configuration File ExportIbmsConfig.sh access control

A vulnerability has been found in TOTOLINK A3000RU up to 5.9c.5185 and classified as problematic. This vulnerability affects unknown code of the file /cgi-bin/ExportIbmsConfig.sh of the component IBMS Configuration File Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T17:31:06.954Z. Updated 2025-04-01T14:37:10.335Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Apr 2025, 21:37 WIB

Official record

MedPublished 30 Mar 2025, 23:31 WIB

CVE-2025-2954

mannaandpoem OpenManus File file_saver.py execute access control

A vulnerability, which was classified as problematic, was found in mannaandpoem OpenManus up to 2025.3.13. This affects the function execute of the file app/tool/file_saver.py of the component File Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-30T16:31:05.242Z. Updated 2025-03-31T13:04:26.725Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated31 Mar 2025, 20:04 WIB

Official record