Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 361–380 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

HighPublished 26 Apr 2025, 12:34 WIB

CVE-2025-3491

Add custom page template <= 2.0.1 - Authenticated (Administrator+) PHP Code Injection to Remote Code Execution

The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possible for authenticated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T05:34:23.629Z. Updated 2026-04-08T17:11:24.134Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:11 WIB

Official record

MedPublished 26 Apr 2025, 12:34 WIB

CVE-2025-1458

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) <= 5.10.29 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Element Pack Addons for Elementor – Free Templates and Widgets for Your WordPress Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets like Dual Button, Creative Button, Image Stack and more in all versions up to, and including, 5.10.29 due to insufficient input sanitizatio…

Showing 361 to 380 of 4033.First page Next page

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T05:34:23.210Z. Updated 2026-04-08T17:03:25.162Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:03 WIB

Official record

HighPublished 26 Apr 2025, 12:34 WIB

CVE-2025-2105

Jupiter X Core <= 4.8.11 - Unauthenticated PHP Object Injection via PHAR

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'raven_download_file' function. This makes it possible for attackers to inject a PHP Object through a PHAR file. No known POP…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T05:34:22.050Z. Updated 2026-04-08T16:45:40.367Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

HighPublished 26 Apr 2025, 11:22 WIB

CVE-2024-13808

Xpro Elementor Addons - Pro <= 1.4.9 - Authenticated (Contributor+) Remote Code Execution

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for authenticated attackers, with Con…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T04:22:36.503Z. Updated 2026-04-08T16:34:12.115Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:34 WIB

Official record

HighPublished 26 Apr 2025, 10:24 WIB

CVE-2025-2801

Create custom forms for WordPress with a smart form plugin for smart businesses <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution

The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate a value before running …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T03:24:24.464Z. Updated 2026-04-08T17:29:36.019Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:29 WIB

Official record

MedPublished 26 Apr 2025, 07:00 WIB

CVE-2024-53636

CVE-2024-53636

An arbitrary file upload vulnerability via writefile.php of Serosoft Academia Student Information System (SIS) EagleR-1.0.118 allows attackers to execute arbitrary code via ../ in the filePath parameter.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T00:00:00.000Z. Updated 2025-12-12T15:18:04.085Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated12 Dec 2025, 22:18 WIB

Official record

MedPublished 26 Apr 2025, 07:00 WIB

CVE-2025-46646

CVE-2025-46646

In Artifex Ghostscript before 10.05.0, decode_utf8 in base/gp_utf8.c mishandles overlong UTF-8 encoding. NOTE: this issue exists because of an incomplete fix for CVE-2024-46954.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T00:00:00.000Z. Updated 2025-04-29T15:23:02.330Z.

CVSS4.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:23 WIB

Official record

MedPublished 26 Apr 2025, 07:00 WIB

CVE-2025-46652

CVE-2025-46652

In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T00:00:00.000Z. Updated 2025-10-24T19:23:47.167Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated25 Oct 2025, 02:23 WIB

Official record

LowPublished 26 Apr 2025, 07:00 WIB

CVE-2025-46653

CVE-2025-46653

Formidable (aka node-formidable) 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." (Also, there is a scenario in which only the last two characters of a hexoid string need to be guessed, but…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T00:00:00.000Z. Updated 2025-04-29T15:22:37.440Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:22 WIB

Official record

MedPublished 26 Apr 2025, 07:00 WIB

CVE-2025-46654

CVE-2025-46654

CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T00:00:00.000Z. Updated 2025-04-29T15:22:49.333Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:22 WIB

Official record

MedPublished 26 Apr 2025, 07:00 WIB

CVE-2025-46655

CVE-2025-46655

CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted JavaScript content, but t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T00:00:00.000Z. Updated 2025-04-29T15:22:43.429Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:22 WIB

Official record

LowPublished 26 Apr 2025, 07:00 WIB

CVE-2025-46656

CVE-2025-46656

python-markdownify (aka markdownify) before 0.14.1 allows large headline prefixes such as <h9999999> in addition to <h1> through <h6>. This causes memory consumption.

Excerpt language: en.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-26T00:00:00.000Z. Updated 2025-04-29T15:22:30.630Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:22 WIB

Official record

HighPublished 26 Apr 2025, 03:20 WIB

CVE-2025-46333

z2d OOB composition could lead to invalid memory access and corruption

z2d is a pure Zig 2D graphics library. Versions of z2d after `0.5.1` and up to and including `0.6.0`, when writing from one surface to another using `z2d.compositor.StrideCompositor.run`, and higher-level operations when the anti-aliasing mode is set to `.default` (such as `Context.fill`, `Context.stroke`, `painter.fil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T20:20:22.202Z. Updated 2025-04-28T14:17:45.653Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 21:17 WIB

Official record

HighKEVPublished 26 Apr 2025, 01:27 WIB

CVE-2025-3935

ScreenConnect Exposure to ASP.NET ViewState Code Injection

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-04-25T18:27:44.244Z. Updated 2026-02-26T18:28:01.567Z.

CVSS8.1v3.1KEVListedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 26 Apr 2025, 00:55 WIB

CVE-2024-30152

HCL SX is affected by usage of a weak cryptographic algorithm

HCL SX v21 is affected by usage of a weak cryptographic algorithm. An attacker could exploit this weakness to gain access to sensitive information, modify data, or other impacts.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T17:55:53.888Z. Updated 2025-04-25T18:23:52.243Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Apr 2025, 01:23 WIB

Official record

HighKEVPublished 25 Apr 2025, 22:56 WIB

CVE-2025-3928

Commvault Web Server unspecified vulnerability

Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-04-25T15:56:28.112Z. Updated 2026-10-07T17:54:32.426Z.

CVSS8.7v4.0KEVListedEPSSPresentUpdated08 Oct 2026, 00:54 WIB

Official record

MedPublished 25 Apr 2025, 22:27 WIB

CVE-2025-2070

CVE-2025-2070

An improper XML parsing vulnerability was reported in the FileZ client that could allow arbitrary file reads on the system if a crafted url is visited by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T15:27:19.989Z. Updated 2025-04-25T16:46:25.734Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Apr 2025, 23:46 WIB

Official record

MedPublished 25 Apr 2025, 22:26 WIB

CVE-2025-2069

CVE-2025-2069

A cross-site scripting vulnerability was reported in the FileZ client that could allow execution of code if a crafted url is visited by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T15:26:55.806Z. Updated 2025-04-25T16:47:20.616Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Apr 2025, 23:47 WIB

Official record

MedPublished 25 Apr 2025, 22:26 WIB

CVE-2025-2068

CVE-2025-2068

An open redirect vulnerability was reported in the FileZ client that could allow information disclosure if a crafted url is visited by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T15:26:34.159Z. Updated 2025-04-25T16:48:08.800Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated25 Apr 2025, 23:48 WIB

Official record

MedPublished 25 Apr 2025, 22:08 WIB

CVE-2024-56156

Halo Vulnerable to Stored XSS and RCE via File Upload Bypass

Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote cod…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T15:08:00.942Z. Updated 2026-02-03T18:07:18.738Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated04 Feb 2026, 01:07 WIB

Official record