Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 3081–3100 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

MedPublished 14 Apr 2026, 07:06 WIB

CVE-2026-24318

Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously issued tokens after authentication…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:06:18.337Z. Updated 2026-04-14T13:14:19.302Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:14 WIB

Official record

MedPublished 14 Apr 2026, 07:06 WIB

CVE-2026-0512

Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)

Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL, that if accessed by a victim, results in execution of malicious content within the victim's browser. This could allow the attacker to acce…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3081 to 3100 of 5813.First page Next page

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:06:08.757Z. Updated 2026-04-14T13:14:19.450Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:14 WIB

Official record

MedPublished 14 Apr 2026, 07:03 WIB

CVE-2026-39417

MaxKB: RCE via MCP stdio command injection in workflow engine

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an incomplete fix for CVE-2025-53928, where a Remote Code Execution vulnerability still exists in the MCP node of the workflow engine. MaxKB only restricts the referencing code path (loading MCP config from the database). The else bra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:03:16.020Z. Updated 2026-04-14T13:34:07.454Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated14 Apr 2026, 20:34 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2025-61260

CVE-2025-61260

A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context Protocol) configuration files. The attack is triggered when a user runs the codex command inside a malicious or compromised repository. Codex automatically loads project-local .env and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-07-05T01:33:53.866Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:33 WIB

Official record

CritPublished 14 Apr 2026, 07:00 WIB

CVE-2025-63939

CVE-2025-63939

Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:53:49.359Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 00:53 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2025-65132

CVE-2025-65132

alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute arbitrary JavaScript via the room_id GET parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T18:02:48.116Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Apr 2026, 01:02 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2025-65133

CVE-2025-65133

A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580. An unauthenticated or authenticated remote attacker can supply a crafted HTTP request to the affected endpoint to manipulate SQL query logic and extract sensitive database information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-16T12:06:24.330Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Apr 2026, 19:06 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2025-65134

CVE-2025-65134

In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-05-10T20:01:56.964Z.

CVSS—KEVNot listedEPSSPresentUpdated11 May 2026, 03:01 WIB

Official record

CritPublished 14 Apr 2026, 07:00 WIB

CVE-2025-65135

CVE-2025-65135

In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T17:49:30.241Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 00:49 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2025-65136

CVE-2025-65136

In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T18:04:46.651Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Apr 2026, 01:04 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2025-69893

CVE-2025-69893

A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. This originates from the BIP-39 standard guidelines, which induce non-constant time execution and speci…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-07-05T01:33:37.768Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 08:33 WIB

Official record

MedPublished 14 Apr 2026, 07:00 WIB

CVE-2025-69993

CVE-2025-69993

Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., <img src=x onerror="alert('XSS')">)…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-21T17:36:25.753Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated22 Apr 2026, 00:36 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2025-70023

CVE-2025-70023

An issue pertaining to CWE-843: Access of Resource Using Incompatible Type was discovered in transloadit uppy v0.25.6.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-16T12:06:09.148Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Apr 2026, 19:06 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2026-30480

CVE-2026-30480

A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attackers to include arbitrary PHP files from the server filesystem via path traversal sequences in the nfsen parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-16T12:06:38.149Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Apr 2026, 19:06 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2026-31049

CVE-2026-31049

An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code and escalate privileges via the CSV registration field

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-16T12:06:52.366Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Apr 2026, 19:06 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2026-37589

CVE-2026-37589

SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/maintenance/manage_storage_unit.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:33:11.824Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:33 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2026-37590

CVE-2026-37590

SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:29:38.686Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:29 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2026-37591

CVE-2026-37591

Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/view_details.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:29:26.653Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:29 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2026-37592

CVE-2026-37592

Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:29:15.190Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:29 WIB

Official record

UnscoredPublished 14 Apr 2026, 07:00 WIB

CVE-2026-37593

CVE-2026-37593

SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-14T00:00:00.000Z. Updated 2026-04-14T15:29:02.156Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Apr 2026, 22:29 WIB

Official record