Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 211 published records · 10 KEV · 211 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

211 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit211100%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Apr 25211

Signal coverage

KEV-listed: 10
With a forecast: 211
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 4.7% · forecast 100% · unscored 0.00%.

Showing 1–20 of 211By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

CritPublished 01 May 2025, 01:27 WIB

CVE-2025-46558

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to before 8.9, the Markdown syntax is vulnerable to cross-site scripting (XSS) through HTML. In particular, using Markdown syntax, it's possible for any user to embed Ja…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T18:27:30.953Z. Updated 2025-04-30T19:01:32.321Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated01 May 2025, 02:01 WIB

Official record

CritPublished 01 May 2025, 00:14 WIB

CVE-2025-30392

Azure AI Bot Elevation of Privilege Vulnerability

Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:14:52.419Z. Updated 2026-08-10T15:13:24.123Z.

Showing 1 to 20 of 211.Next page

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated10 Aug 2026, 22:13 WIB

Official record

CritPublished 01 May 2025, 00:14 WIB

CVE-2025-30390

Azure ML Compute Elevation of Privilege Vulnerability

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T17:14:51.736Z. Updated 2026-08-10T15:13:23.509Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated10 Aug 2026, 22:13 WIB

Official record

CritPublished 30 Apr 2025, 21:55 WIB

CVE-2025-32973

org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without programming rights and contains an XWiki.Component…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T14:55:04.478Z. Updated 2025-04-30T15:15:04.046Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 Apr 2025, 22:15 WIB

Official record

CritPublished 30 Apr 2025, 21:55 WIB

CVE-2025-32974

org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type

XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.8 and from 16.0.0-rc-1 to before 16.2.0, the required rights analysis doesn't consider TextAreas with default content type. When editing a page, XWiki warns since version 15.9 when there is content on the page like a script macro that…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T14:55:01.470Z. Updated 2025-04-30T15:15:51.720Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated30 Apr 2025, 22:15 WIB

Official record

CritPublished 30 Apr 2025, 07:25 WIB

CVE-2025-32444

vLLM Vulnerable to Remote Code Execution via Mooncake Integration

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-30T00:25:00.655Z. Updated 2025-04-30T13:08:35.928Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated30 Apr 2025, 20:08 WIB

Official record

CritPublished 30 Apr 2025, 03:39 WIB

CVE-2025-46348

YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-29T20:39:40.423Z. Updated 2025-04-30T13:19:35.339Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated30 Apr 2025, 20:19 WIB

Official record

CritPublished 30 Apr 2025, 02:35 WIB

CVE-2025-0520

ShowDoc < 2.8.7 Unauthenticated File Upload Remote Code Execution

An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-29T19:35:37.829Z. Updated 2026-10-08T15:21:14.516Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:21 WIB

Official record

CritPublished 29 Apr 2025, 22:45 WIB

CVE-2025-40619

Improper access control vulnerability in Bookgy

Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to reach private areas and/or areas intended for other roles.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-29T15:45:19.090Z. Updated 2025-04-29T16:06:37.247Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 23:06 WIB

Official record

CritPublished 29 Apr 2025, 22:43 WIB

CVE-2025-40618

SQL injection vulnerability in Bookgy

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDRESERVA" parameter in /bkg_imprimir_comprobante.php

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-29T15:43:11.900Z. Updated 2025-04-29T15:51:07.236Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 22:51 WIB

Official record

CritPublished 29 Apr 2025, 22:42 WIB

CVE-2025-40617

SQL injection vulnerability in Bookgy

SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkg_seleccionar_hora_ajax.php.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-29T15:42:32.647Z. Updated 2025-04-29T16:17:03.869Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Apr 2025, 23:17 WIB

Official record

CritPublished 28 Apr 2025, 16:37 WIB

CVE-2025-3200

Com-Server Exposed via Weak TLS

An unauthenticated remote attacker could exploit the used, insecure TLS 1.0 and TLS 1.1 protocols to intercept and manipulate encrypted communications between the Com-Server and connected systems.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T09:37:02.366Z. Updated 2025-04-28T12:23:31.446Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 19:23 WIB

Official record

CritPublished 28 Apr 2025, 07:00 WIB

CVE-2015-2079

CVE-2015-2079

Usermin 0.980 through 1.x before 1.660 allows uconfig_save.cgi sig_file_free remote code execution because it uses the two argument (not three argument) form of Perl open.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T00:00:00.000Z. Updated 2025-04-28T15:26:11.894Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 22:26 WIB

Official record

CritPublished 28 Apr 2025, 07:00 WIB

CVE-2025-46661

CVE-2025-46661

IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side Template-Injection. All instances have been patched by the Supplier.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-28T00:00:00.000Z. Updated 2025-04-28T16:31:04.425Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Apr 2025, 23:31 WIB

Official record

CritPublished 28 Apr 2025, 06:56 WIB

CVE-2025-26692

CVE-2025-26692

Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, arbitrary code may be executed by a remote unauthenticated attacker with the Windows system privilege where the product is running.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-27T23:56:48.261Z. Updated 2025-04-28T15:26:59.179Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated28 Apr 2025, 22:26 WIB

Official record

CritKEVPublished 25 Apr 2025, 22:04 WIB

CVE-2025-32432

Craft CMS Allows Remote Code Execution

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This iss…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2025-04-25T15:04:06.272Z. Updated 2026-03-21T04:00:57.147Z.

CVSS10v3.1KEVListedEPSSPresentUpdated21 Mar 2026, 11:00 WIB

Official record

CritPublished 25 Apr 2025, 18:12 WIB

CVE-2025-2470

Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'

The Service Finder Bookings plugin for WordPress, used by the Service Finder - Directory and Job Board WordPress Theme, is vulnerable to privilege escalation in all versions up to, and including, 5.1. This is due to a lack of restriction on user role in the 'nsl_registration_store_extra_input' function. This makes it p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T11:12:53.066Z. Updated 2026-04-08T17:12:32.520Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:12 WIB

Official record

CritPublished 25 Apr 2025, 07:00 WIB

CVE-2025-46616

CVE-2025-46616

Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution (RCE) via upload of a file. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-25T00:00:00.000Z. Updated 2025-04-25T15:21:30.937Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated25 Apr 2025, 22:21 WIB

Official record

CritPublished 25 Apr 2025, 05:58 WIB

CVE-2025-46275

Planet Technology Network Products Missing Authentication for Critical Function

WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing credentials.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T22:58:52.561Z. Updated 2025-04-25T16:02:47.621Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Apr 2025, 23:02 WIB

Official record

CritPublished 25 Apr 2025, 05:57 WIB

CVE-2025-46274

Planet Technology Network Products Use of Hard-coded Credentials

UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T22:57:55.619Z. Updated 2025-04-25T15:24:43.875Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Apr 2025, 22:24 WIB

Official record