Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 1,145 published records · 6 KEV · 1,145 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

1,145 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored1,145100%

Matching records by UTC month

Jan 251,145

Signal coverage

KEV-listed: 6
With a forecast: 1,145
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.52% · forecast 100% · unscored 100%.

Showing 1–20 of 1,145By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 1,145

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21683

bpf: Fix bpf_sk_select_reuseport() memory leak

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_EBPF set before it was ESTABLISHED. In other words, a non-N…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:42.903Z. Updated 2026-10-15T01:03:01.511Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:03 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21681

openvswitch: fix lockup on tx to unregistering netdev with carrier

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a fixes tag attempted to fix the issue in the following sequence of calls: do_output -> ovs_vport_send -> dev_queue_xmit -> __dev_queue_xmit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 1145.Next page

Published 2025-01-31T11:25:41.491Z. Updated 2026-05-23T15:56:52.799Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:56 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21679

btrfs: add the missing error handling inside get_canonical_dev_path

In the Linux kernel, the following vulnerability has been resolved: btrfs: add the missing error handling inside get_canonical_dev_path Inside function get_canonical_dev_path(), we call d_path() to get the final device path. But d_path() can return error, and in that case the next strscpy() call will trigger an inva…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:40.171Z. Updated 2026-05-11T21:04:21.083Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21675

net/mlx5: Clear port select structure when fail to create

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create Clear the port select structure on error so no stale values left after definers are destroyed. That's because the mlx5_lag_destroy_definers() always try to destroy all lag definers in the tt_m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:37.457Z. Updated 2026-05-11T21:04:16.290Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21674

net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt to enable IPsec packet offload in tunnel mode in debug kernel generates the following kernel panic, which is happening due to two issues: 1. In SA add section, the should…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:36.661Z. Updated 2026-05-11T21:04:15.154Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21672

afs: Fix merge preference rule failure condition

In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returning to userspace[1]. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released. Fix this by store the error …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:35.246Z. Updated 2026-05-11T21:04:12.853Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21671

zram: fix potential UAF of zram table

In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table if user reset an failed and uninitialized device.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:34.546Z. Updated 2026-05-11T21:04:11.691Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21670

vsock/bpf: return early if transport is not assigned

In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core functions can only be called if the transport has been assigned. As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:33.874Z. Updated 2026-05-11T21:04:10.374Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21668

pmdomain: imx8mp-blk-ctrl: add missing loop break condition

In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: add missing loop break condition Currently imx8mp_blk_ctrl_remove() will continue the for loop until an out-of-bounds exception occurs. pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : dev_pm_domain_det…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:32.477Z. Updated 2026-05-11T21:04:08.102Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21667

iomap: avoid avoid truncating 64-bit offset to 32 bits

In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_delalloc_scan() was inadvertently using a 32-bit position due to folio_next_index() returning an unsigned long. This could lead to an infinite loop when writing to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:31.792Z. Updated 2026-05-23T15:56:50.659Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:56 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21666

vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]

In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see attached links), but we shouldn't. Previous commits should…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:31.138Z. Updated 2026-10-15T01:02:53.911Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:02 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2025-21665

filemap: avoid truncating 64-bit offset to 32 bits

In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, folio_seek_hole_data() was inadvertently truncating a 64-bit value to 32 bits, leading to a possible infinite loop when writing to an xfs filesystem.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:30.468Z. Updated 2026-05-11T21:04:04.640Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:04 WIB

Official record

UnscoredPublished 31 Jan 2025, 18:25 WIB

CVE-2024-57948

mac802154: check local interfaces before deleting sdata list

In the Linux kernel, the following vulnerability has been resolved: mac802154: check local interfaces before deleting sdata list syzkaller reported a corrupted list in ieee802154_if_remove. [1] Remove an IEEE 802.15.4 network interface after unregister an IEEE 802.15.4 hardware device from the system. CPU0 CPU1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T11:25:29.762Z. Updated 2026-10-15T01:00:53.320Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:00 WIB

Official record

UnscoredPublished 31 Jan 2025, 13:00 WIB

CVE-2024-13226

A5 Custom Login Page <= 2.8.1 - Reflected XSS

The A5 Custom Login Page WordPress plugin through 2.8.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T06:00:17.007Z. Updated 2025-03-24T17:32:53.150Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 00:32 WIB

Official record

UnscoredPublished 31 Jan 2025, 13:00 WIB

CVE-2024-13225

ECT Home Page Products <= 1.9 - Reflected XSS

The ECT Home Page Products WordPress plugin through 1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T06:00:16.734Z. Updated 2025-03-19T13:38:30.205Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 20:38 WIB

Official record

UnscoredPublished 31 Jan 2025, 13:00 WIB

CVE-2024-13224

SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS

The SlideDeck 1 Lite Content Slider WordPress plugin through 1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T06:00:16.447Z. Updated 2025-03-20T20:38:46.928Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Mar 2025, 03:38 WIB

Official record

UnscoredPublished 31 Jan 2025, 13:00 WIB

CVE-2024-13223

Tabulate <= 2.10.3 - Reflected XSS

The Tabulate WordPress plugin through 2.10.3 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T06:00:16.215Z. Updated 2025-03-14T17:12:59.114Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Mar 2025, 00:12 WIB

Official record

UnscoredPublished 31 Jan 2025, 13:00 WIB

CVE-2024-13222

User Messages <= 1.2.4 - Reflected XSS

The User Messages WordPress plugin through 1.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T06:00:15.995Z. Updated 2025-03-19T13:54:40.038Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 20:54 WIB

Official record

UnscoredPublished 31 Jan 2025, 13:00 WIB

CVE-2024-13221

Fantastic Elasticsearch <= 4.1.0 - Reflected XSS

The Fantastic ElasticSearch WordPress plugin through 4.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T06:00:15.775Z. Updated 2025-03-14T15:15:10.009Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Mar 2025, 22:15 WIB

Official record

UnscoredPublished 31 Jan 2025, 13:00 WIB

CVE-2024-13220

Google Map Professional <= 1.0 - Reflected XSS

The WordPress Google Map Professional (Map In Your Language) WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T06:00:15.556Z. Updated 2025-03-20T14:35:39.859Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:35 WIB

Official record