Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,319 published records · 16 KEV · 4,319 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,319 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2265.2%
High95922%
Med1,81142%
Low1283.0%
None00.00%
Legacy00.00%
Unscored1,19528%

Matching records by UTC month

Sep 254,319

Signal coverage

KEV-listed: 16
With a forecast: 4,319
Unknown date: 0
Unscored severity: 1,195

Share of cohort: KEV 0.37% · forecast 100% · unscored 28%.

Showing 4001–4020 of 4,319By severity band: Critical · 9.0–10.0 226, High · 7.0–8.9 959, Medium · 4.0–6.9 1,811, Low · 0.1–3.9 128, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,195

HighPublished 03 Sep 2025, 20:49 WIB

CVE-2025-47421

Privilege escalation via SCP login

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP command sent via SSH login string can lead a valid administrat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T13:49:40.856Z. Updated 2025-09-03T13:59:32.186Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 20:59 WIB

Official record

HighPublished 03 Sep 2025, 20:25 WIB

CVE-2025-2416

OTP Bypass in Akinsoft's LimonDesk

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from s1.02.14 before v1.02.17.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T13:25:02.837Z. Updated 2026-06-06T05:58:28.070Z.

Showing 4001 to 4020 of 4319.First page Next page

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 12:58 WIB

Official record

MedPublished 03 Sep 2025, 20:16 WIB

CVE-2025-0878

XSS in Akinsoft's LimonDesk

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS). This issue affects LimonDesk: from s1.02.14 before v1.02.17.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T13:16:51.212Z. Updated 2026-06-06T07:08:16.799Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 14:08 WIB

Official record

HighPublished 03 Sep 2025, 20:12 WIB

CVE-2024-13068

Host Header Injection in Akinsoft's LimonDesk

Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: from s1.02.14 before v1.02.17.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T13:12:12.966Z. Updated 2026-06-01T12:34:42.572Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:34 WIB

Official record

MedPublished 03 Sep 2025, 20:05 WIB

CVE-2024-13066

iFrame Injection in Akinsoft's LimonDesk

Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking. This issue affects LimonDesk: from s1.02.14 before v1.02.17.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T13:05:20.054Z. Updated 2026-06-01T12:37:01.708Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:37 WIB

Official record

HighPublished 03 Sep 2025, 20:01 WIB

CVE-2025-38678

netfilter: nf_tables: reject duplicate device on updates

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T13:01:15.799Z. Updated 2026-10-15T22:02:27.949Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

MedPublished 03 Sep 2025, 19:50 WIB

CVE-2025-3701

WordPress Malcure Malware Scanner plugin <= 16.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through <= 16.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T12:50:27.597Z. Updated 2026-04-28T16:12:29.054Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 03 Sep 2025, 19:36 WIB

CVE-2025-53691

Sitecore Experience Remote Code Execution through Insecure Deserialization

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T12:36:59.561Z. Updated 2025-09-03T13:49:39.605Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 20:49 WIB

Official record

CritPublished 03 Sep 2025, 19:36 WIB

CVE-2025-53693

HTML Cache Poisoning through Unsafe Reflections

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T12:36:53.745Z. Updated 2025-09-03T13:53:40.699Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 20:53 WIB

Official record

HighPublished 03 Sep 2025, 19:36 WIB

CVE-2025-53694

Information Disclosure in ItemServices API

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T12:36:37.520Z. Updated 2025-09-03T13:57:58.828Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 20:57 WIB

Official record

MedPublished 03 Sep 2025, 19:32 WIB

CVE-2025-9901

Libsoup: improper handling of http vary header in libsoup caching

A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached content can be incorrectly reused across diffe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T12:32:27.414Z. Updated 2026-06-30T01:53:03.102Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 08:53 WIB

Official record

LowPublished 03 Sep 2025, 18:04 WIB

CVE-2025-41000

Cross-Frame Scripting (XFS) in BoomCMS

Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits specific browser bugs to spy on users via JavaScript. This type of attack is based on social engineering and depends entirely on the browser chosen by the user, so it is perceived as a minor threat t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T11:04:01.811Z. Updated 2025-09-03T14:04:36.130Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated03 Sep 2025, 21:04 WIB

Official record

LowPublished 03 Sep 2025, 16:39 WIB

CVE-2025-9821

SSRF via webhook function

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See http…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T09:39:01.005Z. Updated 2025-09-03T14:12:35.814Z.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 21:12 WIB

Official record

UnscoredPublished 03 Sep 2025, 16:10 WIB

CVE-2024-43166

CVE-2024-43166

Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T09:10:24.401Z. Updated 2025-11-04T21:08:48.628Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:08 WIB

Official record

HighPublished 03 Sep 2025, 15:54 WIB

CVE-2025-2415

OTP Bypass in Akinsoft's MyRezzta

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass. This issue affects MyRezzta: from s2.03.01 before v2.05.01.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T08:54:31.583Z. Updated 2026-06-06T06:00:08.410Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:00 WIB

Official record

CritPublished 03 Sep 2025, 15:52 WIB

CVE-2025-1740

Authentication Bypass in Akinsoft's MyRezzta

Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft MyRezzta allows Authentication Bypass, Password Recovery Exploitation, Brute Force. This issue affects MyRezzta: from s2.03.01 before v2.05.01.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T08:52:05.634Z. Updated 2026-06-06T06:49:26.341Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:49 WIB

Official record

MedPublished 03 Sep 2025, 15:48 WIB

CVE-2024-13065

Business Logic Error in Akinsoft's MyRezzta

Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 - Flooding. This issue affects MyRezzta: from s2.02.02 before v2.05.01.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T08:48:48.851Z. Updated 2026-06-01T12:38:57.151Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:38 WIB

Official record

MedPublished 03 Sep 2025, 15:40 WIB

CVE-2024-13064

XSS in Akinsoft's MyRezzta

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft MyRezzta allows Cross-Site Scripting (XSS). This issue affects MyRezzta: from s2.02.02 before v2.05.01.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T08:40:36.938Z. Updated 2026-06-01T12:40:03.664Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:40 WIB

Official record

UnscoredPublished 03 Sep 2025, 15:38 WIB

CVE-2024-43115

Apache DolphinScheduler: Alert Script Attack

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T08:38:32.442Z. Updated 2025-11-04T21:08:47.334Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:08 WIB

Official record

HighPublished 03 Sep 2025, 15:35 WIB

CVE-2014-125127

Denial of Service (DoS) vulnerability in mikecao/flight

The mikecao/flight PHP framework in versions prior to v1.2 is vulnerable to Denial of Service (DoS) attacks due to eager loading of request bodies in the Request class constructor. The framework automatically reads the entire request body on every HTTP request, regardless of whether the application needs it. An attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-09-03T08:35:05.988Z. Updated 2025-09-03T13:20:06.873Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 20:20 WIB

Official record