Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 921–940 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 19 Apr 2025, 02:59 WIB

CVE-2025-32377

Rasa Pro Missing Authentication For Voice Connector APIs

Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement authentication even when a token is configured in the credentials.yml file. This c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T19:59:32.286Z. Updated 2025-04-18T20:35:41.744Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Apr 2025, 03:35 WIB

Official record

MedPublished 19 Apr 2025, 02:17 WIB

CVE-2025-36625

Log Poisoning in Nessus

In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipulating http requests to the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T19:17:30.612Z. Updated 2025-04-18T19:40:24.201Z.

Showing 921 to 940 of 4033.First page Next page

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated19 Apr 2025, 02:40 WIB

Official record

HighPublished 19 Apr 2025, 01:18 WIB

CVE-2025-24914

Local Priviledge Escalation

When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. - CVE-2025-24914

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T18:18:02.729Z. Updated 2026-02-26T18:28:09.421Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 19 Apr 2025, 00:43 WIB

CVE-2025-1697

HP Touchpoint Analytics Service – Potential Escalation of Privilege

A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing software updates to mitigate this potential vulnerability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T17:43:54.423Z. Updated 2026-02-26T18:28:09.811Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:28 WIB

Official record

MedPublished 18 Apr 2025, 23:06 WIB

CVE-2025-32796

Dify Allows Unauthorized APP Enable/Disable via API

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users can enable or disable apps through the API, even though the web UI button for this action is disabled and normal users are not permitted to make such changes. This access control f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T16:06:47.577Z. Updated 2025-04-18T16:36:51.064Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:36 WIB

Official record

MedPublished 18 Apr 2025, 23:05 WIB

CVE-2025-32795

Dify Allows Insecure User Role Access Control for APP Editing

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite being restricted from v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T16:05:11.644Z. Updated 2025-04-18T16:37:49.329Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:37 WIB

Official record

HighPublished 18 Apr 2025, 23:04 WIB

CVE-2025-32792

ses's global contour bindings leak into Compartment lexical scope

SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0, web pages and web extensions using `ses` and the Compartment API to evaluate third-party code in an isolated execution environment that have also elsewhere used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T16:04:16.778Z. Updated 2025-04-21T13:28:59.847Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated21 Apr 2025, 20:28 WIB

Official record

HighPublished 18 Apr 2025, 22:59 WIB

CVE-2025-32442

Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass

Fastify is a fast and low overhead web framework, for Node.js. In versions 5.0.0 to 5.3.0 as well as version 4.29.0, applications that specify different validation strategies for different content types have a possibility to bypass validation by providing a _slightly altered_ content type such as with different casing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:59:06.670Z. Updated 2025-08-22T20:50:43.059Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated23 Aug 2025, 03:50 WIB

Official record

HighPublished 18 Apr 2025, 22:56 WIB

CVE-2025-32389

NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure `?param[0]=a&param[1]=b&param[2]=c` utilized …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:56:39.962Z. Updated 2025-04-18T16:24:24.300Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:24 WIB

Official record

MedPublished 18 Apr 2025, 22:52 WIB

CVE-2025-31120

NamelessMC Vulnerable to Cookie-Based View Count Manipulation

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, an insecure view count mechanism in the forum page allows an unauthenticated attacker to artificially increase the view count. The application relies on a client-side cookie (nl-topic-[tid]) (or session vari…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:52:57.791Z. Updated 2025-04-18T20:01:03.192Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated19 Apr 2025, 03:01 WIB

Official record

HighPublished 18 Apr 2025, 22:52 WIB

CVE-2025-31118

NamelessMC Has Forum Reply Submission Time Limit Bypass

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, forum quick reply feature (view_topic.php) does not implement any spam prevention mechanism. This allows authenticated users to continuously post replies without any time restriction, resulting in an uncontr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:52:36.923Z. Updated 2025-04-18T16:02:09.007Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:02 WIB

Official record

HighPublished 18 Apr 2025, 22:51 WIB

CVE-2025-30357

NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator deletes the malicious u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:51:21.670Z. Updated 2025-04-18T16:04:12.364Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:04 WIB

Official record

HighPublished 18 Apr 2025, 22:50 WIB

CVE-2025-30158

NamelessMC Forum iframe width/height abuse causing UI-based Denial of Service

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the forum allows users to post iframe elements inside forum topics/comments/feed with no restriction on the iframe's width and height attributes. This allows an authenticated attacker to perform a UI-based d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:50:49.309Z. Updated 2025-04-18T16:04:53.740Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:04 WIB

Official record

HighPublished 18 Apr 2025, 22:50 WIB

CVE-2025-29784

NamelessMC Has Lack of Length Validation for s Parameter in GET Requests

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, the s parameter in GET requests for forum search functionality lacks length validation, allowing attackers to submit excessively long search queries. This oversight can lead to performance degradation and po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:50:17.656Z. Updated 2025-04-18T16:05:30.640Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:05 WIB

Official record

MedPublished 18 Apr 2025, 22:49 WIB

CVE-2025-27599

Element X Android vulnerable to loading malicious web pages via received intent

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to micro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:49:11.899Z. Updated 2025-04-18T16:06:04.952Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Apr 2025, 23:06 WIB

Official record

CritPublished 18 Apr 2025, 22:48 WIB

CVE-2025-32434

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

PyTorch is a Python package that provides tensor computation with strong GPU acceleration and deep neural networks built on a tape-based autograd system. In version 2.5.1 and prior, a Remote Command Execution (RCE) vulnerability exists in PyTorch when loading a model using torch.load with weights_only=True. This issue …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:48:18.851Z. Updated 2025-12-01T07:05:28.923Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated01 Dec 2025, 14:05 WIB

Official record

UnscoredPublished 18 Apr 2025, 22:23 WIB

CVE-2025-29953

Apache ActiveMQ NMS OpenWire Client: deserialization allowlist bypass

Deserialization of Untrusted Data vulnerability in Apache ActiveMQ NMS OpenWire Client. This issue affects Apache ActiveMQ NMS OpenWire Client before 2.1.1 when performing connections to untrusted servers. Such servers could abuse the unbounded deserialization in the client to provide malicious responses that may even…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:23:31.658Z. Updated 2025-04-23T15:39:08.654Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Apr 2025, 22:39 WIB

Official record

MedPublished 18 Apr 2025, 22:00 WIB

CVE-2025-3792

SeaCMS admin_link.php sql injection

A vulnerability, which was classified as critical, has been found in SeaCMS up to 13.3. This issue affects some unknown processing of the file /admin_link.php?action=delall. The manipulation of the argument e_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T15:00:05.436Z. Updated 2025-04-18T15:29:02.407Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated18 Apr 2025, 22:29 WIB

Official record

MedPublished 18 Apr 2025, 21:50 WIB

CVE-2025-2950

IBM i improper HTTP header neutralization

IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper neutralization of HTTP header content by IBM Navigator for i. An authenticated user can manipulate the host header in HTTP requests to change domain/IP address which may lead to unexpected behavior.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T14:50:21.165Z. Updated 2025-08-28T16:41:27.679Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 23:41 WIB

Official record

MedPublished 18 Apr 2025, 21:31 WIB

CVE-2025-3791

symisc UnQLite unqlite.c jx9MemObjStore heap-based overflow

A vulnerability classified as critical was found in symisc UnQLite up to 957c377cb691a4f617db9aba5cc46d90425071e2. This vulnerability affects the function jx9MemObjStore of the file /data/src/benchmarks/unqlite/unqlite.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-18T14:31:04.680Z. Updated 2025-04-18T14:43:56.559Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated18 Apr 2025, 21:43 WIB

Official record