Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 75 published records · 0 KEV · 75 with a forecast · 0 unknown dates
75 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.00% · forecast 100% · unscored 0.00%.
CVE-2020-11936
gdbus setgid privilege escalation
Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-31T01:18:21.509Z. Updated 2025-02-07T16:08:28.466Z.
CVE-2025-24336
SXF Common Library handles input data improperly. If a product using the library reads a crafted file, the product may be crashed.
Severity low: primary CNA CVSS 3.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-31T00:02:56.347Z. Updated 2025-01-31T17:43:46.505Z.
Server-Side Request Forgery (SSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a…
Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-30T23:45:10.780Z. Updated 2025-02-18T18:59:19.527Z.
Zoom Workplace app for macOS - Symlink Following
Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access.
Severity low: primary CNA CVSS 3.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-30T19:47:26.128Z. Updated 2025-01-30T21:22:42.397Z.
Zoom Workplace Apps - Out-of-bounds Write
Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access.
Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-30T19:44:06.908Z. Updated 2025-01-30T21:29:47.382Z.
Unsanitized Filenames in Flutter package image_picker_android Allow File Overwrites
The file names constructed within image_picker are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select an image file from that provider while using your app and could potentially override inter…
Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-29T11:52:05.386Z. Updated 2025-02-12T19:51:14.154Z.
Unsanitized Filenames in Flutter package file_selector_android Allow File Overwrites
The file names constructed within file_selector are missing sanitization checks leaving them vulnerable to malicious document providers. This may result in cases where a user with a malicious document provider installed can select a document file from that provider while using your app and could potentially override in…
Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-29T11:51:04.255Z. Updated 2025-02-12T19:51:14.271Z.
CVE-2024-0149
NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerability might lead to limited information disclosure.
Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-28T04:04:19.542Z. Updated 2025-03-27T20:03:01.774Z.
Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0
Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce (such as 42069), and then …
Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-27T22:57:26.728Z. Updated 2025-01-28T15:18:44.746Z.
Postman profapi.dll untrusted search path
A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to b…
Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-27T18:00:13.776Z. Updated 2025-01-27T19:52:30.190Z.
Discord profapi.dll untrusted search path
A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather hi…
Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-27T18:00:11.934Z. Updated 2025-01-27T20:03:52.901Z.
Improper check of permissions in Generic Interface
An improper privilege management vulnerability in OTRS Generic Interface module allows change of the Ticket status even if the user only has ro permissions. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * ((OTRS)) Community Edition: 6.0.x Products based on the ((OTRS)) …
Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-27T05:58:29.271Z. Updated 2025-02-12T20:41:31.804Z.
IBM Security Directory Integrator information disclosure
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that could aid in further attacks against the system.
Severity low: primary CNA CVSS 2.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-27T01:14:42.274Z. Updated 2025-02-12T20:41:32.572Z.
Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery
The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for authenticated attackers, wit…
Severity low: primary CNA CVSS 3.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-25T08:23:15.871Z. Updated 2026-04-08T17:27:04.057Z.
IBM i denial of service
IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user can configure a referential constraint with the privileges of a user socially engineered to access the target file.
Severity low: primary CNA CVSS 2.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T17:27:26.745Z. Updated 2025-09-29T15:10:26.137Z.
Coolify Vulnerable to Reflected XSS on Tag Search
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.380, the tags page allows users to search for tags. If the search does not return any results, the query gets reflected on the error modal, which leads to cross-site scripting. Version 4.0.0-b…
Severity low: primary CNA CVSS 1.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T16:46:04.276Z. Updated 2025-01-24T21:01:40.445Z.
Himmelblau leaks credentials in the debug log
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive aut…
Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:38:57.957Z. Updated 2025-02-12T20:41:29.818Z.
ECOVACS lawnmowers and vacuums insecurely store audio warning files
ECOVACS robot lawnmowers and vacuums insecurely store audio files used to indicate that the camera is on. An attacker with access to the /data filesystem can delete or modify warning files such that users may not be aware that the camera is on.
Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T16:35:23.197Z. Updated 2025-02-12T20:41:29.266Z.
HCL BigFix Patch Download Plug-ins are affected by an insecure protocol support
BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation.
Severity low: primary CNA CVSS 2.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T02:47:40.896Z. Updated 2025-01-23T15:01:15.665Z.
HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
Severity low: primary CNA CVSS 2.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T02:10:02.525Z. Updated 2025-01-23T14:51:45.463Z.