Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 141–160 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-53357

CVE-2024-53357

Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote authenticated attackers, with low privileges, to (1) add an admin user via the /api/user/addalias route; (2) modifiy a user via the /api/user/updatealiasroute; (4) delete users via the /api/user/delalias route; (4) g…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-02-10T22:16:33.382Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Feb 2025, 05:16 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-53537

CVE-2024-53537

An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-03-20T14:29:25.608Z.

CVSS

Showing 141 to 160 of 4273.First page Next page

—

KEVNot listed

EPSSPresent

Updated20 Mar 2025, 21:29 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-53582

CVE-2024-53582

An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-03-24T16:27:40.139Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 23:27 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-53584

CVE-2024-53584

OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-03-18T18:43:24.465Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 01:43 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-55062

CVE-2024-55062

Code Injection vulnerability in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary code to /api/license/sendlicense/.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-02-11T21:42:13.300Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Feb 2025, 04:42 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-57432

CVE-2024-57432

macrozheng mall-tiny 1.0.1 suffers from Insecure Permissions. The application's JWT signing keys are hardcoded and do not change. User information is explicitly written into the JWT and used for subsequent privilege management, making it is possible to forge the JWT of any user to achieve authentication bypass.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-03-13T13:52:46.610Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Mar 2025, 20:52 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-57433

CVE-2024-57433

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-03-18T18:32:28.577Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 01:32 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-57434

CVE-2024-57434

macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control. The project imports users by default, and the test user is made a super administrator.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-02-03T20:15:40.987Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 03:15 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-57435

CVE-2024-57435

In macrozheng mall-tiny 1.0.1, an attacker can send null data through the resource creation interface resulting in a null pointer dereference occurring in all subsequent operations that require authentication, which triggers a denial-of-service attack and service restart failure.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-02-03T20:12:31.830Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 03:12 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2024-57587

CVE-2024-57587

Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.0 and CO2Scope <= 1.3.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to /api/auth/login.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-04-03T14:09:42.467Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2025, 21:09 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2025-22957

CVE-2025-22957

A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. This vulnerability could potentially allow attackers to gain unauthorized access to the database and extract sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-03-20T15:46:39.473Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:46 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2025-22994

CVE-2025-22994

O2OA 9.1.3 is vulnerable to Cross Site Scripting (XSS) in Meetings - Settings.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-03-19T14:41:31.955Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 21:41 WIB

Official record

UnscoredPublished 31 Jan 2025, 07:00 WIB

CVE-2025-23001

CVE-2025-23001

A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header. An attacker can manipulate the Host header in HTTP requests, which may lead to phishing attacks, reset password, or cache poisoning. NOTE: the Supplier's position is that the end …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-31T00:00:00.000Z. Updated 2025-02-21T16:51:29.844Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Feb 2025, 23:51 WIB

Official record

HighPublished 31 Jan 2025, 06:57 WIB

CVE-2024-23963

Alpine Halo9 Stack-based Buffer Overflow

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The specific flaw exists within the PBAP_Decode…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T23:57:24.401Z. Updated 2025-07-01T13:41:46.822Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated01 Jul 2025, 20:41 WIB

Official record

MedPublished 31 Jan 2025, 06:53 WIB

CVE-2024-23962

Alpine Halo9 Missing Authentication

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DLT interface, which listens on TCP port 3490 by default. The issue results from the lack of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T23:53:33.224Z. Updated 2025-07-01T13:43:07.238Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated01 Jul 2025, 20:43 WIB

Official record

LowPublished 31 Jan 2025, 06:45 WIB

CVE-2023-6195

Server-Side Request Forgery (SSRF) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses a malicious URL in the markdown image value when importing a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T23:45:10.780Z. Updated 2025-02-18T18:59:19.527Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 01:59 WIB

Official record

MedPublished 31 Jan 2025, 06:45 WIB

CVE-2024-1211

Cross-Site Request Forgery (CSRF) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T23:45:00.772Z. Updated 2025-01-31T20:51:47.207Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated01 Feb 2025, 03:51 WIB

Official record

HighPublished 31 Jan 2025, 06:42 WIB

CVE-2024-23971

ChargePoint Home Flex OCPP bswitch Command Injection

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OCPP messages. The issue results from the lack of proper val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T23:42:57.796Z. Updated 2025-08-26T21:08:23.253Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:08 WIB

Official record

MedPublished 31 Jan 2025, 06:40 WIB

CVE-2024-23970

ChargePoint Home Flex Improper Certificate Validation

This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CURLOPT_SSL_VERIFYHOST setting. The issue results from the lack o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T23:40:49.963Z. Updated 2025-08-26T21:02:52.773Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:02 WIB

Official record

HighPublished 31 Jan 2025, 06:37 WIB

CVE-2024-23969

ChargePoint Home Flex wlanchnllst Out-Of-Bounds Write

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the wlanchnllst function. The issue results from the lack of proper validati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-30T23:37:22.462Z. Updated 2025-08-26T21:02:16.174Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:02 WIB

Official record