Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 921–940 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

HighPublished 26 Mar 2026, 20:26 WIB

CVE-2026-2511

JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTickets()` function in all versions up to, and including, 3.0.4. This is due to the user-supplied `multiformid` value being passed to `esc_sql()` without enclosing th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:26:05.601Z. Updated 2026-04-08T16:43:19.181Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:43 WIB

Official record

HighPublished 26 Mar 2026, 20:24 WIB

CVE-2019-25650

River Past CamDo 3.7.6 Structured Exception Handler Buffer Overflow

River Past CamDo 3.7.6 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lame_enc.dll name field. Attackers can craft a payload with a 280-byte buffer, NSEH jump instruction, and SEH handler address po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 921 to 940 of 6236.First page Next page

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:20.734Z. Updated 2026-03-26T18:52:11.464Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:52 WIB

Official record

MedPublished 26 Mar 2026, 20:24 WIB

CVE-2019-25649

River Past Audio Converter 7.7.16 Local Buffer Overflow DoS

River Past Audio Converter 7.7.16 contains a local buffer overflow vulnerability in the activation code field that allows local attackers to crash the application by supplying an oversized input string. Attackers can paste a large payload of repeated characters into the 'E-Mail and Activation Code' field and click 'Act…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:20.028Z. Updated 2026-03-26T18:24:51.477Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:24 WIB

Official record

MedPublished 26 Mar 2026, 20:24 WIB

CVE-2019-25648

MyVideoConverter Pro 3.14 Denial of Service Buffer Overflow

MyVideoConverter Pro 3.14 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string to the registration code input field. Attackers can paste a malicious payload containing 10000 bytes into the 'Copy and Paste Registration Code' field to trigge…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:19.319Z. Updated 2026-03-26T18:52:29.783Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:52 WIB

Official record

HighPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25219

PassFab Excel Password Recovery 8.3.1 SEH Buffer Overflow

PassFab Excel Password Recovery 8.3.1 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the registration code field. Attackers can craft a buffer overflow payload with a pop-pop-ret gadget and shellcode that t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:18.674Z. Updated 2026-07-28T01:46:40.696Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

HighPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25218

PassFab RAR Password Recovery 9.3.2 SEH Buffer Overflow

PassFab RAR Password Recovery 9.3.2 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload. Attackers can craft a payload with a buffer overflow, NSEH jump, and shellcode, then paste it into the 'Licensed E-mail …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:18.014Z. Updated 2026-03-28T02:19:51.015Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated28 Mar 2026, 09:19 WIB

Official record

HighPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25217

PDF Explorer 1.5.66.2 Structured Exception Handler Local Code Execution

PDF Explorer 1.5.66.2 contains a structured exception handler (SEH) overflow vulnerability that allows local attackers to execute arbitrary code by overwriting SEH records with malicious data. Attackers can craft a payload with buffer overflow, NSEH jump, and ROP gadget chains that execute when the Custom fields settin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:17.314Z. Updated 2026-03-26T13:57:21.296Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:57 WIB

Official record

MedPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25216

AnyBurn 4.3 Denial of Service Local Buffer Overflow

AnyBurn 4.3 contains a local buffer overflow vulnerability that allows local attackers to crash the application by supplying an excessively long string in the image file name field. Attackers can paste a 10000-byte payload into the 'Image file name' parameter during the 'Copy disk to Image' operation to trigger a denia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:16.609Z. Updated 2026-10-01T15:19:08.557Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:19 WIB

Official record

MedPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25215

Excel Password Recovery Professional 8.2.0.0 Local Buffer Overflow DoS

Excel Password Recovery Professional 8.2.0.0 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by supplying an excessively long string to the 'E-Mail and Registrations Code' field. Attackers can paste a crafted payload containing 5000 bytes of data into the registration f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:15.903Z. Updated 2026-07-28T01:46:39.680Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated28 Jul 2026, 08:46 WIB

Official record

MedPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25214

MegaPing Local Buffer Overflow Denial of Service

MegaPing contains a local buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload to the Destination Address List field in the Finger function. Attackers can paste a crafted buffer exceeding expected input limits into the vulnerable field and trigger the Star…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:15.316Z. Updated 2026-03-26T18:34:08.615Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:34 WIB

Official record

HighPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25213

Nsauditor 3.0.28.0 Local SEH Buffer Overflow

Nsauditor 3.0.28.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying malicious input to the DNS Lookup tool. Attackers can craft a payload with SEH chain overwrite and inject shellcode through the DNS Query field to achieve code exe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:14.608Z. Updated 2026-03-26T14:46:20.591Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:46 WIB

Official record

HighPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25212

Boxoft wav-wma Converter 1.0 Local Buffer Overflow SEH

Boxoft wav-wma Converter 1.0 contains a local buffer overflow vulnerability in structured exception handling that allows attackers to execute arbitrary code by crafting malicious WAV files. Attackers can create a specially crafted WAV file with excessive data and ROP gadgets to overwrite the SEH chain and achieve code …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:13.757Z. Updated 2026-07-15T01:23:29.658Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:23 WIB

Official record

HighPublished 26 Mar 2026, 20:24 WIB

CVE-2018-25211

Allok Video Splitter 3.1.1217 Buffer Overflow via License Name

Allok Video Splitter 3.1.1217 contains a buffer overflow vulnerability that allows local attackers to cause a denial of service or execute arbitrary code by supplying an oversized string in the License Name field. Attackers can craft a malicious payload exceeding 780 bytes, paste it into the License Name registration f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:24:13.066Z. Updated 2026-03-26T13:57:48.223Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:57 WIB

Official record

NonePublished 26 Mar 2026, 20:23 WIB

CVE-2026-33343

etcd: Nested etcd transactions bypass RBAC authorization checks

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.42, 3.5.28, and 3.6.9, an authenticated user with RBAC restricted permissions on key ranges can use nested transactions to bypass all key-level authorization. This allows any authenticated user with direct access to etcd t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity none: primary CNA CVSS 0 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:23:48.247Z. Updated 2026-03-26T18:25:09.851Z.

CVSS0v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:25 WIB

Official record

HighPublished 26 Mar 2026, 20:10 WIB

CVE-2025-55261

HCL Aftermarket DPC is affected by Missing Functional Level Access Control

HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:10:27.889Z. Updated 2026-03-26T14:58:51.799Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 21:58 WIB

Official record

HighPublished 26 Mar 2026, 20:07 WIB

CVE-2025-55262

HCL Aftermarket DPC is affected by SQL Injection

HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:07:04.407Z. Updated 2026-03-26T15:05:41.196Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated26 Mar 2026, 22:05 WIB

Official record

MedPublished 26 Mar 2026, 20:05 WIB

CVE-2026-4877

itsourcecode Payroll Management System index.php cross site scripting

A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument page results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:05:39.008Z. Updated 2026-03-26T18:25:16.231Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:25 WIB

Official record

MedPublished 26 Mar 2026, 20:05 WIB

CVE-2026-4876

itsourcecode Free Hotel Reservation System index.php sql injection

A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:05:36.261Z. Updated 2026-03-26T13:58:15.118Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Mar 2026, 20:58 WIB

Official record

HighPublished 26 Mar 2026, 20:05 WIB

CVE-2025-55263

HCL Aftermarket DPC is affected by Hardcoded Sensitive Data

HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories, they can easily retrieve these hardcoded secrets.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:05:07.172Z. Updated 2026-03-26T18:34:31.869Z.

CVSS7.3v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:34 WIB

Official record

MedPublished 26 Mar 2026, 20:04 WIB

CVE-2025-55264

HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change

HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-26T13:04:01.614Z. Updated 2026-03-26T18:35:17.005Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Mar 2026, 01:35 WIB

Official record