Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 421–440 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 28 Mar 2025, 22:27 WIB

CVE-2025-2713

Improper File Permission Handling in Google gVisor runsc

Google gVisor's runsc component exhibited a local privilege escalation vulnerability due to incorrect handling of file access permissions, which allowed unprivileged users to access restricted files. This occurred because the process initially ran with root-like permissions until the first fork.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:27:43.231Z. Updated 2025-09-08T09:47:48.152Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated08 Sep 2025, 16:47 WIB

Official record

MedPublished 28 Mar 2025, 22:12 WIB

CVE-2025-31010

WordPress SimplyRETS Real Estate IDX plugin <= 3.0.5 - CSRF to Multiple Admin Actions vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets allows Cross Site Request Forgery.This issue affects SimplyRETS Real Estate IDX: from n/a through <= 3.0.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:26.626Z. Updated 2026-04-28T16:12:03.607Z.

Showing 421 to 440 of 4001.First page Next page

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22767

WordPress GlobalPayments WooCommerce Plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Reflected XSS.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.13.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:26.436Z. Updated 2026-05-12T23:56:42.137Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:56 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22575

WordPress SUPER RESPONSIVE SLIDER Plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb SUPER RESPONSIVE SLIDER super-slider allows Reflected XSS.This issue affects SUPER RESPONSIVE SLIDER: from n/a through <= 1.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:26.217Z. Updated 2026-04-28T16:11:01.984Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22566

WordPress ULTIMATE VIDEO GALLERY Plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendyourweb ULTIMATE VIDEO GALLERY ultimate-gallery allows Reflected XSS.This issue affects ULTIMATE VIDEO GALLERY: from n/a through <= 1.4.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:26.059Z. Updated 2026-04-28T16:11:01.859Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22526

WordPress PHP/MySQL CPU performance statistics Plugin <= 1.2.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This issue affects PHP/MySQL CPU performance statistics: from n/a through <= 1.2.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:25.884Z. Updated 2026-04-28T16:11:00.877Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22523

WordPress Schedule Plugin <= 1.0.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scheduler Schedule schedule allows Blind SQL Injection.This issue affects Schedule: from n/a through <= 1.0.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:25.734Z. Updated 2026-04-28T16:11:00.839Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22501

WordPress Improve My City plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Improve My City Improve My City improve-my-city allows Reflected XSS.This issue affects Improve My City: from n/a through <= 1.6.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:25.557Z. Updated 2026-04-28T16:11:00.337Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22360

WordPress WP Azure offload plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in promact WP Azure offload wp-azure-offload allows Reflected XSS.This issue affects WP Azure offload: from n/a through <= 2.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:25.404Z. Updated 2026-04-28T16:11:00.329Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2025-22356

WordPress Stencies plugin <= 0.58 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stencies Stencies stencies allows Reflected XSS.This issue affects Stencies: from n/a through <= 0.58.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:25.213Z. Updated 2026-04-28T16:10:59.859Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2024-54362

WordPress GetShop ecommerce plugin <= 1.3 - Path Traversal vulnerability

Path Traversal: '.../...//' vulnerability in boggibill GetShop ecommerce getshop-ecommerce allows Path Traversal.This issue affects GetShop ecommerce: from n/a through <= 1.3.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:25.053Z. Updated 2026-04-28T16:10:51.024Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2024-54291

WordPress PluginPass plugin <= 0.9.10 - Arbitrary File Download/Delete vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in labs64 PluginPass pluginpass-pro-plugintheme-licensing allows Manipulating Web Input to File System Calls.This issue affects PluginPass: from n/a through <= 0.9.10.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:24.866Z. Updated 2026-04-28T16:10:49.187Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 28 Mar 2025, 22:12 WIB

CVE-2024-51624

WordPress Já-Já Pagamentos for WooCommerce plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-pagamentos-multicaixa-express allows Reflected XSS.This issue affects Já-Já Pagamentos for WooCommerce: from n/a through <= 1.3.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T15:12:24.688Z. Updated 2026-05-12T23:56:27.684Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:56 WIB

Official record

HighPublished 28 Mar 2025, 21:55 WIB

CVE-2025-30211

KEX init error results with excessive memory usage

Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously formed KEX init message can result with high memory usage. Implementation does not verify RFC specified limits on algorithm names (64 characters) provided in KEX init message. Big …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T14:55:47.778Z. Updated 2025-11-03T19:46:46.745Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:46 WIB

Official record

HighPublished 28 Mar 2025, 21:51 WIB

CVE-2025-30372

Emlog Pro contains an SQL injection vulnerability.

Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_controller.php` does not use addslashes after urldecode, allowing the preceeding addslashes to be bypassed by URL double encoding. This could result in potential leakage of sensiti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T14:51:41.664Z. Updated 2025-03-28T15:43:43.798Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated28 Mar 2025, 22:43 WIB

Official record

LowPublished 28 Mar 2025, 21:47 WIB

CVE-2025-30371

Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint

Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention of local link access protection in GeoJson endpoint. Self hosted Metabase instances that are using the GeoJson feature could be potentially impacted if their Me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T14:47:36.718Z. Updated 2025-03-28T15:42:10.181Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated28 Mar 2025, 22:42 WIB

Official record

HighPublished 28 Mar 2025, 21:42 WIB

CVE-2025-29928

authentik's deletion of sessions did not revoke sessions when using database session storage

authentik is an open-source identity provider. Prior to versions 2024.12.4 and 2025.2.3, when authentik was configured to use the database for session storage (which is a non-default setting), deleting sessions via the Web Interface or the API would not revoke the session and the session holder would continue to have a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T14:42:39.542Z. Updated 2025-03-28T15:41:39.773Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated28 Mar 2025, 22:41 WIB

Official record

LowPublished 28 Mar 2025, 21:38 WIB

CVE-2024-39311

Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction

Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the `publify_core` rubygem, publisher on a `publify` application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T14:38:03.816Z. Updated 2025-03-28T15:37:35.064Z.

CVSS1.8v4.0KEVNot listedEPSSPresentUpdated28 Mar 2025, 22:37 WIB

Official record

MedPublished 28 Mar 2025, 21:05 WIB

CVE-2025-2877

Event-driven-ansible: exposure inventory passwords in plain text when starting a rulebook activation with verbosity set to debug in eda

A flaw was found in the Ansible Automation Platform's Event-Driven Ansible. In configurations where verbosity is set to "debug", inventory passwords are exposed in plain text when starting a rulebook activation. This issue exists for any "debug" action in a rulebook and also affects Event Streams.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T14:05:18.308Z. Updated 2026-03-20T17:57:38.922Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Mar 2026, 00:57 WIB

Official record

HighPublished 28 Mar 2025, 20:48 WIB

CVE-2025-1781

CVE-2025-1781

There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to read arbitrary local files if an attacker has access to exception messages.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-28T13:48:22.127Z. Updated 2025-03-28T14:31:48.212Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated28 Mar 2025, 21:31 WIB

Official record