Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 1,122 published records · 1 KEV · 1,122 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

1,122 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit00.00%
High00.00%
Med1,122100%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Feb 251,122

Signal coverage

KEV-listed: 1
With a forecast: 1,122
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 0.09% · forecast 100% · unscored 0.00%.

Showing 1–20 of 1,122By severity band: Critical · 9.0–10.0 0, High · 7.0–8.9 0, Medium · 4.0–6.9 1,122, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

MedPublished 01 Mar 2025, 04:25 WIB

CVE-2025-26466

Openssh: denial-of-service in openssh

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increas…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:25:28.861Z. Updated 2026-10-21T16:55:55.131Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 23:55 WIB

Official record

MedPublished 01 Mar 2025, 04:06 WIB

CVE-2025-27414

MinIO SFTP authentication bypass due to improperly trusted SSH key

MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data access. On a MinIO server with SFTP access configured and u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 1122.Next page

Published 2025-02-28T21:06:58.155Z. Updated 2025-03-04T20:03:45.107Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated05 Mar 2025, 03:03 WIB

Official record

MedPublished 01 Mar 2025, 04:02 WIB

CVE-2025-27413

PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality allows an administrator to import raw data into the database, including Path Traversal (`../`) sequences. This is problematic for the template update functionality as it uses the path from the database to write …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:02:35.656Z. Updated 2025-03-04T20:09:20.769Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Mar 2025, 03:09 WIB

Official record

MedPublished 01 Mar 2025, 04:00 WIB

CVE-2025-27410

PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin

PwnDoc is a penetration test reporting application. Prior to version 1.2.0, the backup restore functionality is vulnerable to path traversal in the TAR entry's name, allowing an attacker to overwrite any file on the system with their content. By overwriting an included `.js` file and restarting the container, this allo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T21:00:11.328Z. Updated 2025-03-04T20:31:01.435Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated05 Mar 2025, 03:31 WIB

Official record

MedPublished 01 Mar 2025, 03:01 WIB

CVE-2025-0769

PixelYourSite 10.1.1.1 - Insecure deserialization

PixelYourSite - Your smart PIXEL (TAG) and API Manager 10.1.1.1 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/modules/facebook/facebook-server-a sync-task.php.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T20:01:30.324Z. Updated 2025-02-28T20:29:26.478Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 03:29 WIB

Official record

MedPublished 01 Mar 2025, 00:26 WIB

CVE-2025-27408

Manifest Uses a One-Way Hash without a Salt

Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if an attacker gains access to the database. Without the use of a salt, identical passwords across…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T17:26:15.196Z. Updated 2025-03-04T22:23:15.608Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated05 Mar 2025, 05:23 WIB

Official record

MedPublished 01 Mar 2025, 00:11 WIB

CVE-2025-24316

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Exposure of Sensitive Information Due to Incompatible Policies

The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details, which could lead to unsafe functionality.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T17:11:56.571Z. Updated 2025-02-28T18:17:46.143Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 01:17 WIB

Official record

MedPublished 01 Mar 2025, 00:09 WIB

CVE-2025-24318

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag

Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session compromise.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T17:09:05.687Z. Updated 2025-02-28T18:19:26.403Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 01:19 WIB

Official record

MedPublished 28 Feb 2025, 23:56 WIB

CVE-2025-24843

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Storage of Sensitive Data in a Mechanism without Access Control

Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity, authenticity, and attestation of stored data.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:56:11.789Z. Updated 2025-02-28T21:50:42.235Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 04:50 WIB

Official record

MedPublished 28 Feb 2025, 23:54 WIB

CVE-2025-23405

Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For Logs

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks (ex log injection).

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:54:01.759Z. Updated 2025-02-28T21:51:08.124Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Mar 2025, 04:51 WIB

Official record

MedPublished 28 Feb 2025, 23:21 WIB

CVE-2025-0985

IBM MQ information disclosure

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:21:35.830Z. Updated 2025-08-26T19:48:05.547Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 02:48 WIB

Official record

MedPublished 28 Feb 2025, 23:19 WIB

CVE-2024-54175

IBM MQ denial of service

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T16:19:56.817Z. Updated 2025-08-27T21:43:05.342Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 04:43 WIB

Official record

MedPublished 28 Feb 2025, 20:46 WIB

CVE-2025-1776

Cross-Site Scripting (XSS) vulnerability in Soteshop

Cross-Site Scripting (XSS) vulnerability in Soteshop, versions prior to 8.3.4, which could allow remote attackers to execute arbitrary code via the ‘query’ parameter in /app-google-custom-search/searchResults. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T13:46:38.948Z. Updated 2025-02-28T14:08:03.217Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated28 Feb 2025, 21:08 WIB

Official record

MedPublished 28 Feb 2025, 20:43 WIB

CVE-2025-1749

HTML injection vulnerability in OpenCart

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/voucher.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T13:43:25.866Z. Updated 2025-02-28T14:11:59.634Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Feb 2025, 21:11 WIB

Official record

MedPublished 28 Feb 2025, 20:43 WIB

CVE-2025-1748

HTML injection vulnerability in OpenCart

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/register.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T13:43:11.346Z. Updated 2025-02-28T14:27:25.289Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Feb 2025, 21:27 WIB

Official record

MedPublished 28 Feb 2025, 20:42 WIB

CVE-2025-1747

HTML injection vulnerability in OpenCart

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/login.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T13:42:34.071Z. Updated 2025-02-28T14:30:46.213Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Feb 2025, 21:30 WIB

Official record

MedPublished 28 Feb 2025, 20:38 WIB

CVE-2025-1746

Cross-Site Scripting vulnerability in OpenCart

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal sensitive user data, suc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T13:38:23.895Z. Updated 2025-02-28T14:33:34.329Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated28 Feb 2025, 21:33 WIB

Official record

MedPublished 28 Feb 2025, 19:47 WIB

CVE-2025-1300

Open redirect in CodeChecker web server

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker web server contains an open redirect vulnerability due to missing protections against multiple slashes after the product name in the URL. This results in bypassing the protections aga…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T12:47:19.205Z. Updated 2025-02-28T14:39:43.357Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated28 Feb 2025, 21:39 WIB

Official record

MedPublished 28 Feb 2025, 19:32 WIB

CVE-2025-22271

IP Spoofing in CyberArk Endpoint Privilege Manager

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unk…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T12:32:55.955Z. Updated 2025-03-05T15:49:31.652Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated05 Mar 2025, 22:49 WIB

Official record

MedPublished 28 Feb 2025, 16:22 WIB

CVE-2024-10860

NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission

The NextMove Lite – Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized submission of data due to a missing capability check on the _submit_uninstall_reason_action() function in all versions up to, and including, 2.19.0. This makes it possible for authenticated attackers, with Subscriber-l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-02-28T09:22:44.490Z. Updated 2026-04-08T16:55:44.638Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:55 WIB

Official record