Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 3941–3960 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

UnscoredPublished 01 Apr 2025, 14:56 WIB

CVE-2025-29868

Apache Answer: Using externally referenced images can leak user privacy.

Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T07:56:28.633Z. Updated 2025-04-10T15:03:07.021Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Apr 2025, 22:03 WIB

Official record

CritPublished 01 Apr 2025, 14:53 WIB

CVE-2025-30065

Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata

Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3941 to 3960 of 4033.First page Next page

Published 2025-04-01T07:53:42.993Z. Updated 2026-02-26T18:29:05.414Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:29 WIB

Official record

HighPublished 01 Apr 2025, 14:29 WIB

CVE-2025-2891

WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Upload

The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.php' file in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with Seller-level access and above, to upload arbitrary …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T07:29:12.911Z. Updated 2026-04-08T16:55:37.998Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:55 WIB

Official record

LowPublished 01 Apr 2025, 14:26 WIB

CVE-2025-27427

Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permission

A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. When combined with the send permi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T07:26:59.994Z. Updated 2025-04-02T22:03:20.210Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated03 Apr 2025, 05:03 WIB

Official record

MedPublished 01 Apr 2025, 13:52 WIB

CVE-2025-1512

PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom Cursor Extension in all versions up to, and including, 2.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T06:52:05.756Z. Updated 2026-04-08T17:06:46.407Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:06 WIB

Official record

MedPublished 01 Apr 2025, 13:52 WIB

CVE-2025-1267

Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter

The Groundhogg plugin for Wordpress is vulnerable to Stored Cross-Site Scripting via the ‘label' parameter in versions up to, and including, 3.7.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web sc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T06:52:05.370Z. Updated 2026-04-08T17:01:27.970Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:01 WIB

Official record

MedPublished 01 Apr 2025, 13:52 WIB

CVE-2024-12189

WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom widgets in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for aut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T06:52:04.579Z. Updated 2026-04-08T16:44:26.760Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:44 WIB

Official record

HighPublished 01 Apr 2025, 13:52 WIB

CVE-2024-12278

Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via any location that typically sanitizes data using wp_kses, like comments, in all versions up to, and including, 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T06:52:03.749Z. Updated 2026-04-08T16:41:55.393Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:41 WIB

Official record

UnscoredPublished 01 Apr 2025, 13:00 WIB

CVE-2025-2048

Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path Traversal

The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks and download arbitrary files on the server

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T06:00:05.541Z. Updated 2025-04-01T14:58:56.415Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Apr 2025, 21:58 WIB

Official record

UnscoredPublished 01 Apr 2025, 13:00 WIB

CVE-2025-1986

Gutentor < 3.4.7 - Admin+ SQL Injection

The Gutentor WordPress plugin before 3.4.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T06:00:04.734Z. Updated 2025-04-01T15:06:41.276Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Apr 2025, 22:06 WIB

Official record

MedPublished 01 Apr 2025, 12:32 WIB

CVE-2025-31409

WordPress Bridge Core plugin < 3.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Bridge Core allows Stored XSS. This issue affects Bridge Core: from n/a through n/a.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:32:24.989Z. Updated 2026-04-28T16:12:06.089Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 01 Apr 2025, 12:32 WIB

CVE-2025-31024

WordPress RJ Quickcharts plugin <= 0.6.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in randyjensen RJ Quickcharts rj-quickcharts allows SQL Injection.This issue affects RJ Quickcharts: from n/a through <= 0.6.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:32:24.749Z. Updated 2026-04-28T16:12:03.902Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 01 Apr 2025, 12:32 WIB

CVE-2025-31001

WordPress GTM Kit plugin <= 2.4.0 - Sensitive Data Exposure vulnerability

Debug Messages Revealing Unnecessary Information vulnerability in TLA Media GTM Kit gtm-kit allows Retrieve Embedded Sensitive Data.This issue affects GTM Kit: from n/a through <= 2.4.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:32:24.584Z. Updated 2026-04-29T09:51:54.810Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

CritPublished 01 Apr 2025, 12:32 WIB

CVE-2025-30971

WordPress XV Random Quotes plugin <= 2.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xavi Ivars XV Random Quotes xv-random-quotes allows SQL Injection.This issue affects XV Random Quotes: from n/a through <= 2.0.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:32:24.447Z. Updated 2026-04-28T16:12:02.292Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 01 Apr 2025, 12:32 WIB

CVE-2025-22277

WordPress Vitepos plugin <= 3.1.4 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:32:24.249Z. Updated 2026-04-28T16:10:57.813Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 01 Apr 2025, 12:31 WIB

CVE-2025-31415

WordPress YayExtra <= 1.5.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in YayCommerce YayExtra yayextra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayExtra: from n/a through <= 1.5.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:31:42.561Z. Updated 2026-04-28T16:12:06.286Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 01 Apr 2025, 12:31 WIB

CVE-2025-31095

WordPress Material Dashboard plugin <= 1.4.5 - Privilege Escalation Vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Hossein Material Dashboard material-dashboard allows Authentication Bypass.This issue affects Material Dashboard: from n/a through <= 1.4.5.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:31:42.244Z. Updated 2026-04-28T16:12:05.083Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 01 Apr 2025, 12:31 WIB

CVE-2025-31087

WordPress Multiple Shipping And Billing Address For Woocommerce plugin <= 1.5 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in silverplugins217 Multiple Shipping And Billing Address For Woocommerce different-shipping-and-billing-address-for-woocommerce allows Object Injection.This issue affects Multiple Shipping And Billing Address For Woocommerce: from n/a through <= 1.5.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:31:42.090Z. Updated 2026-04-28T16:12:05.062Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 01 Apr 2025, 12:31 WIB

CVE-2025-31084

WordPress Sunshine Photo Cart plugin <= 3.4.10 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through <= 3.4.10.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:31:41.938Z. Updated 2026-05-12T00:01:29.785Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:01 WIB

Official record

HighPublished 01 Apr 2025, 12:31 WIB

CVE-2025-31074

WordPress MDJM Event Management plugin <= 1.7.5.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Object Injection.This issue affects Mobile DJ Manager: from n/a through <= 1.7.5.2.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-01T05:31:41.729Z. Updated 2026-04-28T16:12:04.822Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record