Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 821–840 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 22 Apr 2025, 03:31 WIB

CVE-2025-3842

panhainan DS-Java FileUpload.java uploadUserPic.action code injection

A vulnerability was found in panhainan DS-Java 1.0 and classified as critical. This issue affects the function uploadUserPic.action of the file src/com/phn/action/FileUpload.java. The manipulation of the argument fileUpload leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T20:31:04.375Z. Updated 2025-04-22T02:22:52.550Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated22 Apr 2025, 09:22 WIB

Official record

MedPublished 22 Apr 2025, 02:31 WIB

CVE-2025-3841

wix-incubator jam Jinja2 Template jam.py special elements used in a template engine

A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown part of the file jam.py of the component Jinja2 Template Handler. The manipulation of the argument config['template'] leads to improper neutralization of special e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 821 to 840 of 4033.First page Next page

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T19:31:04.546Z. Updated 2025-04-24T12:10:27.236Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated24 Apr 2025, 19:10 WIB

Official record

UnscoredPublished 22 Apr 2025, 01:07 WIB

CVE-2025-27086

CVE-2025-27086

A vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T18:07:11.498Z. Updated 2025-04-22T13:18:03.464Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Apr 2025, 20:18 WIB

Official record

HighPublished 21 Apr 2025, 23:53 WIB

CVE-2025-23174

Yoel Geva - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T16:53:08.584Z. Updated 2025-04-21T17:09:00.394Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated22 Apr 2025, 00:09 WIB

Official record

MedPublished 21 Apr 2025, 22:34 WIB

CVE-2025-32793

Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T15:34:14.315Z. Updated 2025-04-21T15:48:55.214Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated21 Apr 2025, 22:48 WIB

Official record

HighPublished 21 Apr 2025, 22:34 WIB

CVE-2025-32431

Traefik has a possible vulnerability with the path matchers

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher ba…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T15:34:04.637Z. Updated 2025-04-21T15:55:15.087Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 22:55 WIB

Official record

MedPublished 21 Apr 2025, 22:14 WIB

CVE-2024-12543

A user enumeration and subsequent data integrity vulnerability affecting barcode functionality

User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows and Linux allows a malicous authenticated attacker to potentially alter barcode attributes.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T15:14:20.984Z. Updated 2025-04-21T15:36:51.036Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 22:36 WIB

Official record

HighPublished 21 Apr 2025, 22:13 WIB

CVE-2025-3857

Infinite loop condition in Amazon.IonDotnet

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition that could potentially res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T15:13:51.905Z. Updated 2025-10-14T18:18:25.003Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 01:18 WIB

Official record

MedPublished 21 Apr 2025, 22:13 WIB

CVE-2024-12863

Stored XSS in Discussions functionality

Stored XSS in Discussions in OpenText Content Management CE 20.2 to 25.1 on Windows and Linux allows authenticated malicious users to inject code into the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T15:13:04.555Z. Updated 2025-04-21T15:24:29.951Z.

CVSS5.6v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 22:24 WIB

Official record

HighPublished 21 Apr 2025, 22:12 WIB

CVE-2025-2298

Authenticated API Endpoint Allows Arbitrary File Deletion in Dremio Software

An improper authorization vulnerability in Dremio Software allows authenticated users to delete arbitrary files that the system has access to, including system files and files stored in remote locations such as S3, Azure Blob Storage, and local filesystems. This vulnerability exists due to insufficient access controls …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T15:12:24.391Z. Updated 2025-04-21T15:56:03.117Z.

CVSS8.4v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 22:56 WIB

Official record

LowPublished 21 Apr 2025, 21:26 WIB

CVE-2025-2517

Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager

Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T14:26:04.804Z. Updated 2025-04-21T14:55:54.336Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 21:55 WIB

Official record

MedPublished 21 Apr 2025, 21:22 WIB

CVE-2024-12862

REST API allows users without permissions to remove external collaborators

Incorrect Authorization vulnerability in the OpenText Content Server REST API on Windows, Linux allows users without the appropriate permissions to remove external collaborators.This issue affects Content Server: 20.2-24.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T14:22:59.811Z. Updated 2025-04-21T15:15:07.571Z.

CVSS5.5v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 22:15 WIB

Official record

LowPublished 21 Apr 2025, 16:39 WIB

CVE-2025-3840

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

An improper neutralization of input vulnerability was identified in the End of Life (EOL) OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An actor can manipulate t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T09:39:16.343Z. Updated 2025-04-21T12:38:16.967Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 19:38 WIB

Official record

MedPublished 21 Apr 2025, 16:33 WIB

CVE-2025-3838

Improper Authorization in the installer for the EOL OVA based connect component

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed credentials of the insta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T09:33:33.390Z. Updated 2025-04-21T12:47:37.813Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 19:47 WIB

Official record

MedPublished 21 Apr 2025, 16:20 WIB

CVE-2025-3837

Improper Input Validation vulnerability in the End of Life (EOL) OVA based connect component

An improper input validation vulnerability is identified in the End of Life (EOL) OVA based connect component which is deployed for installation purposes in the customer internal network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. Under certain circumstances, an …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T09:20:14.110Z. Updated 2025-04-21T13:05:14.280Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 20:05 WIB

Official record

UnscoredPublished 21 Apr 2025, 14:16 WIB

CVE-2025-25228

Extension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla

A SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL commands in the product management area in backend.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T07:16:45.498Z. Updated 2025-05-07T04:36:46.068Z.

CVSS—KEVNot listedEPSSPresentUpdated07 May 2025, 11:36 WIB

Official record

CritPublished 21 Apr 2025, 12:27 WIB

CVE-2025-0632

Local File Inclusion (LFI) leading to sensitive data exposure

Local File Inclusion (LFI) vulnerability in a Render function of Formulatrix Rock Maker Web (RMW) allows a remote attacker to obtain sensitive data via arbitrary code execution. A malicious actor could execute malicious scripts to automatically download configuration files in known locations to exfiltrate data includin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T05:27:06.090Z. Updated 2025-04-28T02:49:47.566Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 09:49 WIB

Official record

UnscoredPublished 21 Apr 2025, 07:00 WIB

CVE-2024-41446

CVE-2024-41446

A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T00:00:00.000Z. Updated 2026-07-05T16:05:33.166Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 23:05 WIB

Official record

UnscoredPublished 21 Apr 2025, 07:00 WIB

CVE-2024-42699

CVE-2024-42699

Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image field

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T00:00:00.000Z. Updated 2025-04-21T16:06:19.068Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Apr 2025, 23:06 WIB

Official record

UnscoredPublished 21 Apr 2025, 07:00 WIB

CVE-2024-57394

CVE-2024-57394

The quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0 allows user to restore a malicious file to an arbitrary file path. Attackers can write malicious DLL to system path and perform privilege escalation by leveraging Windows DLL hijacking vulnerabilities.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-21T00:00:00.000Z. Updated 2025-05-12T14:10:32.845Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2025, 21:10 WIB

Official record