Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 401–420 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

UnscoredPublished 29 Jan 2025, 02:13 WIB

CVE-2024-34732

CVE-2024-34732

In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T19:13:40.171Z. Updated 2025-01-28T21:10:13.134Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 04:10 WIB

Official record

CritPublished 29 Jan 2025, 02:01 WIB

CVE-2025-24480

FactoryTalk® View Machine Editon - Remote Code Execution

A Remote Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to lack of input sanitation and could allow a remote attacker to run commands or code as a high privileged user.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T19:01:41.484Z. Updated 2025-02-05T18:49:55.832Z.

Showing 401 to 420 of 4273.First page Next page

CVSS9.3v4.0

KEVNot listed

EPSSPresent

Updated06 Feb 2025, 01:49 WIB

Official record

HighPublished 29 Jan 2025, 01:52 WIB

CVE-2025-24479

FactoryTalk® View Machine Edition - Local Code Injection

A Local Code Execution Vulnerability exists in the product and version listed above. The vulnerability is due to a default setting in Windows and allows access to the Command Prompt as a higher privileged user.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T18:52:18.429Z. Updated 2025-02-12T20:01:10.925Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:01 WIB

Official record

HighPublished 29 Jan 2025, 01:41 WIB

CVE-2025-24478

5380/5580 Denial-of-Service Vulnerability

A denial-of-service vulnerability exists in the affected products. The vulnerability could allow a remote, non-privileged user to send malicious requests resulting in a major nonrecoverable fault causing a denial-of-service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T18:41:30.887Z. Updated 2025-02-06T21:25:38.074Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated07 Feb 2025, 04:25 WIB

Official record

HighPublished 29 Jan 2025, 01:33 WIB

CVE-2025-22217

CVE-2025-22217

Avi Load Balancer contains an unauthenticated blind SQL Injection vulnerability which was privately reported to VMware. Patches are available to remediate this vulnerability in affected VMware products. A malicious user with network access may be able to use specially crafted SQL queries to gain database access.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T18:33:36.486Z. Updated 2026-02-26T19:08:56.525Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 02:08 WIB

Official record

MedPublished 29 Jan 2025, 01:31 WIB

CVE-2025-0783

pankajindevops scale API Endpoint access control

A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why inform…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T18:31:04.836Z. Updated 2025-01-28T18:53:37.145Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Jan 2025, 01:53 WIB

Official record

HighPublished 29 Jan 2025, 01:27 WIB

CVE-2025-0631

PowerFlex® 755 Credential Exposure Vulnerability

A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T18:27:32.084Z. Updated 2025-02-06T21:26:17.072Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated07 Feb 2025, 04:26 WIB

Official record

HighPublished 29 Jan 2025, 00:54 WIB

CVE-2024-13484

Openshift-gitops-operator-container: namespace isolation break

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out clus…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T17:54:28.701Z. Updated 2026-06-26T04:27:26.108Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated26 Jun 2026, 11:27 WIB

Official record

MedPublished 29 Jan 2025, 00:21 WIB

CVE-2025-23053

Authenticated privilege escalation via broken access control

A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T17:21:45.987Z. Updated 2025-03-13T18:13:52.965Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated14 Mar 2025, 01:13 WIB

Official record

MedPublished 29 Jan 2025, 00:17 WIB

CVE-2025-23054

Authenticated Response Manipulation allows Unauthorized Actions in Management Interface

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to un…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T17:17:17.694Z. Updated 2025-03-13T14:27:35.564Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 Mar 2025, 21:27 WIB

Official record

MedPublished 29 Jan 2025, 00:12 WIB

CVE-2025-23057

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T17:12:23.359Z. Updated 2025-03-13T14:39:29.316Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated13 Mar 2025, 21:39 WIB

Official record

MedPublished 29 Jan 2025, 00:11 WIB

CVE-2025-23056

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T17:11:58.146Z. Updated 2025-03-13T14:47:58.938Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated13 Mar 2025, 21:47 WIB

Official record

MedPublished 29 Jan 2025, 00:11 WIB

CVE-2025-23055

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T17:11:38.749Z. Updated 2025-03-13T13:39:21.174Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated13 Mar 2025, 20:39 WIB

Official record

UnscoredPublished 28 Jan 2025, 23:53 WIB

CVE-2018-9378

CVE-2018-9378

In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T16:53:30.767Z. Updated 2025-01-28T19:37:36.790Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 02:37 WIB

Official record

UnscoredPublished 28 Jan 2025, 23:52 WIB

CVE-2018-9373

CVE-2018-9373

In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T16:52:42.889Z. Updated 2025-01-28T19:49:40.008Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 02:49 WIB

Official record

UnscoredPublished 28 Jan 2025, 23:51 WIB

CVE-2017-13318

CVE-2017-13318

In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T16:51:05.070Z. Updated 2025-01-28T19:51:54.881Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 02:51 WIB

Official record

UnscoredPublished 28 Jan 2025, 23:50 WIB

CVE-2017-13317

CVE-2017-13317

In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T16:50:03.206Z. Updated 2025-01-28T19:58:14.472Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 02:58 WIB

Official record

MedPublished 28 Jan 2025, 23:35 WIB

CVE-2024-8401

CVE-2024-8401

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an authenticated attacker modifies folder names within the context of the product.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T16:35:55.532Z. Updated 2025-01-28T18:58:12.602Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Jan 2025, 01:58 WIB

Official record

HighPublished 28 Jan 2025, 23:34 WIB

CVE-2025-0781

Incorrect Authorization in SimGear

An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T16:34:21.881Z. Updated 2025-02-12T20:01:11.702Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated13 Feb 2025, 03:01 WIB

Official record

HighPublished 28 Jan 2025, 23:01 WIB

CVE-2025-23385

CVE-2025-23385

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T16:01:55.084Z. Updated 2025-01-28T16:26:10.127Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 23:26 WIB

Official record