Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,673 published records · 15 KEV · 3,673 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,673 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1654.5%
High96026%
Med1,12231%
Low1203.3%
None10.03%
Legacy00.00%
Unscored1,30536%

Matching records by UTC month

Feb 253,673

Signal coverage

KEV-listed: 15
With a forecast: 3,673
Unknown date: 0
Unscored severity: 1,305

Share of cohort: KEV 0.41% · forecast 100% · unscored 36%.

Showing 1–20 of 3,673By severity band: Critical · 9.0–10.0 165, High · 7.0–8.9 960, Medium · 4.0–6.9 1,122, Low · 0.1–3.9 120, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,305

HighPublished 01 Mar 2025, 04:52 WIB

CVE-2024-1509

Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100

Brocade ASCG before 3.2.0 Web Interface is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cook…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:52:33.870Z. Updated 2025-03-04T19:44:55.094Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated05 Mar 2025, 02:44 WIB

Official record

MedPublished 01 Mar 2025, 04:25 WIB

CVE-2025-26466

Openssh: denial-of-service in openssh

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increas…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1 to 20 of 3673.Next page

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:25:28.861Z. Updated 2026-10-21T16:55:55.131Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 23:55 WIB

Official record

MedPublished 01 Mar 2025, 04:06 WIB

CVE-2025-27414

MinIO SFTP authentication bypass due to improperly trusted SSH key

MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data access. On a MinIO server with SFTP access configured and u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:06:58.155Z. Updated 2025-03-04T20:03:45.107Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated05 Mar 2025, 03:03 WIB

Official record

MedPublished 01 Mar 2025, 04:02 WIB

CVE-2025-27413

PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (`../`) sequences. This is problematic for the template update functionality as it uses the path from the database to write …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:02:35.656Z. Updated 2025-03-04T20:09:20.769Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Mar 2025, 03:09 WIB

Official record

MedPublished 01 Mar 2025, 04:00 WIB

CVE-2025-27410

PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:00:11.328Z. Updated 2025-03-04T20:31:01.435Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Mar 2025, 03:31 WIB

Official record

MedPublished 01 Mar 2025, 03:01 WIB

CVE-2025-0769

PixelYourSite 10.1.1.1 - Insecure deserialization

PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T20:01:30.324Z. Updated 2025-02-28T20:29:26.478Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 03:29 WIB

Official record

HighPublished 01 Mar 2025, 02:02 WIB

CVE-2025-0160

IBM FlashSystem code execution

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T19:02:50.019Z. Updated 2025-02-28T19:50:37.531Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Mar 2025, 02:50 WIB

Official record

CritPublished 01 Mar 2025, 02:01 WIB

CVE-2025-0159

IBM FlashSystem authentication bypass

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T19:01:26.669Z. Updated 2026-02-26T18:29:06.038Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated27 Feb 2026, 01:29 WIB

Official record

LowPublished 01 Mar 2025, 01:59 WIB

CVE-2025-1795

Mishandling of comma during folding and unicode-encoding of email headers

During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T18:59:31.784Z. Updated 2026-07-31T14:03:23.564Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated31 Jul 2026, 21:03 WIB

Official record

MedPublished 01 Mar 2025, 00:26 WIB

CVE-2025-27408

Manifest Uses a One-Way Hash without a Salt

Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if an attacker gains access to the database. Without the use of a salt, identical passwords across…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T17:26:15.196Z. Updated 2025-03-04T22:23:15.608Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated05 Mar 2025, 05:23 WIB

Official record

MedPublished 01 Mar 2025, 00:11 WIB

CVE-2025-24316

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Sensitive Information Due to Incompatible Policies

The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details, which could lead to unsafe functionality.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T17:11:56.571Z. Updated 2025-02-28T18:17:46.143Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 01:17 WIB

Official record

MedPublished 01 Mar 2025, 00:09 WIB

CVE-2025-24318

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag

Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T17:09:05.687Z. Updated 2025-02-28T18:19:26.403Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 01:19 WIB

Official record

HighPublished 01 Mar 2025, 00:04 WIB

CVE-2025-20049

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cross-site Scripting

The Dario Health portal service application is vulnerable to XSS, which could allow an attacker to obtain sensitive information.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T17:04:11.352Z. Updated 2025-02-28T21:48:28.315Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 04:48 WIB

Official record

HighPublished 28 Feb 2025, 23:58 WIB

CVE-2025-24849

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Cleartext Transmission of Sensitive Information

Lack of encryption in transit for cloud infrastructure facilitating potential for sensitive data manipulation or exposure.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:58:55.473Z. Updated 2025-02-28T21:50:19.286Z.

CVSS7.5v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 04:50 WIB

Official record

MedPublished 28 Feb 2025, 23:56 WIB

CVE-2025-24843

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Storage of Sensitive Data in a Mechanism without Access Control

Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity, authenticity, and attestation of stored data.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:56:11.789Z. Updated 2025-02-28T21:50:42.235Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 04:50 WIB

Official record

MedPublished 28 Feb 2025, 23:54 WIB

CVE-2025-23405

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For Logs

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks (ex log injection).

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:54:01.759Z. Updated 2025-02-28T21:51:08.124Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 04:51 WIB

Official record

HighPublished 28 Feb 2025, 23:51 WIB

CVE-2025-20060

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Private Personal Information to an Unauthorized Actor

An attacker could expose cross-user personal identifiable information (PII) and personal health information transmitted to the Android device via the Dario Health application database.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:51:20.410Z. Updated 2025-02-28T21:58:18.544Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 04:58 WIB

Official record

MedPublished 28 Feb 2025, 23:21 WIB

CVE-2025-0985

IBM MQ information disclosure

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:21:35.830Z. Updated 2025-08-26T19:48:05.547Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 02:48 WIB

Official record

MedPublished 28 Feb 2025, 23:19 WIB

CVE-2024-54175

IBM MQ denial of service

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:19:56.817Z. Updated 2025-08-27T21:43:05.342Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 04:43 WIB

Official record

LowPublished 28 Feb 2025, 22:26 WIB

CVE-2025-27400

Magento vulnerable to stored XSS in theme config fields

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Versions prior to 20.12.3 and 20.13.0 contain a vulnerability that allows script execution in the admin panel which could l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T15:26:14.265Z. Updated 2025-08-26T19:32:15.324Z.

CVSS2.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 02:32 WIB

Official record