Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 1481–1500 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 21 Jan 2025, 18:09 WIB

CVE-2025-0450

Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T11:09:45.700Z. Updated 2026-04-08T16:45:39.645Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

MedPublished 21 Jan 2025, 18:04 WIB

CVE-2024-52973

Kibana allocation of resources without limits or throttling leads to crash

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/log_entries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1481 to 1500 of 4273.First page Next page

Published 2025-01-21T11:04:06.547Z. Updated 2025-01-21T16:25:27.782Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated21 Jan 2025, 23:25 WIB

Official record

MedPublished 21 Jan 2025, 18:00 WIB

CVE-2024-43709

Elasticsearch allocation of resources without limits or throttling leads to crash

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T11:00:11.403Z. Updated 2025-02-21T18:03:29.257Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated22 Feb 2025, 01:03 WIB

Official record

MedPublished 21 Jan 2025, 17:56 WIB

CVE-2024-37284

Elastic Defend Improper Handling of Alternate Encoding Leads to Crash

Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This leads to an uncaught exception causing Elastic Defend to crash which in turn will prevent it from quarantining the file and/or killing the process.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T10:56:14.762Z. Updated 2025-01-21T16:32:03.006Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated21 Jan 2025, 23:32 WIB

Official record

UnscoredPublished 21 Jan 2025, 17:03 WIB

CVE-2024-6466

CVE-2024-6466

NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products via network with X-FRAME-OPTIONS is not specified.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T10:03:24.544Z. Updated 2025-01-21T19:43:54.175Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jan 2025, 02:43 WIB

Official record

MedPublished 21 Jan 2025, 16:35 WIB

CVE-2025-23184

Apache CXF: Denial of Service vulnerability with temporary files

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T09:35:37.468Z. Updated 2025-12-15T15:58:16.867Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated15 Dec 2025, 22:58 WIB

Official record

MedPublished 21 Jan 2025, 16:21 WIB

CVE-2024-13404

Link Library <= 7.7.2 - Reflected Cross-Site Scripting

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T09:21:10.545Z. Updated 2026-04-08T17:32:10.734Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:32 WIB

Official record

MedPublished 21 Jan 2025, 16:21 WIB

CVE-2024-12104

Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attacker…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T09:21:10.182Z. Updated 2026-04-08T17:02:52.796Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:02 WIB

Official record

MedPublished 21 Jan 2025, 16:21 WIB

CVE-2024-12005

WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting

The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the wp_bibtex_option_page() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged requ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T09:21:09.602Z. Updated 2026-04-08T16:33:58.711Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:33 WIB

Official record

MedPublished 21 Jan 2025, 15:21 WIB

CVE-2025-0371

Jet Elements <= 2.7.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T08:21:51.697Z. Updated 2026-04-08T17:28:25.374Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:28 WIB

Official record

HighPublished 21 Jan 2025, 15:21 WIB

CVE-2024-10936

String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

The String locator plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T08:21:51.041Z. Updated 2026-04-08T16:36:44.352Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:36 WIB

Official record

UnscoredPublished 21 Jan 2025, 11:26 WIB

CVE-2025-23086

CVE-2025-23086

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site prompts the user to upload or download a file. However the origin was not correctly inferred in some cases. When combined with an open redirector vulnerability o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T04:26:10.943Z. Updated 2025-03-22T14:00:42.023Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Mar 2025, 21:00 WIB

Official record

MedPublished 21 Jan 2025, 11:20 WIB

CVE-2024-13536

1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure

The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.87. This is due the /inc/class/fnm/export.php file being publicly accessible with error logging enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T04:20:57.518Z. Updated 2026-04-08T17:24:42.546Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:24 WIB

Official record

MedPublished 21 Jan 2025, 07:41 WIB

CVE-2024-45091

IBM UrbanCode Deploy information disclosure

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:41:45.398Z. Updated 2025-01-21T16:41:10.360Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated21 Jan 2025, 23:41 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2023-27112

CVE-2023-27112

pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the projectCode parameter at project.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-03-13T20:33:00.682Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Mar 2025, 03:33 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2023-27113

CVE-2023-27113

pearProjectApi v2.8.10 was discovered to contain a SQL injection vulnerability via the organizationCode parameter at project.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-03-18T18:09:11.933Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 01:09 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2023-37024

CVE-2023-37024

A reachable assertion in the Mobile Management Entity (MME) of Magma versions <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows remote attackers to crash the MME with an unauthenticated cellphone by sending a NAS packet containing an `Emergency Number List` Information Element.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-23T19:07:21.253Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jan 2025, 02:07 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2023-37025

CVE-2023-37025

A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `Reset` packet missing an expected `ResetType` field.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-23T17:33:19.678Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jan 2025, 00:33 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2023-37026

CVE-2023-37026

A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `E-RAB Release Response` packet missing an expected `MME_UE_S1AP_ID` field.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-23T17:31:30.563Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jan 2025, 00:31 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2023-37027

CVE-2023-37027

Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `E-RAB Modification Indication` packet missing an expected `eNB_UE_S1AP_ID` field.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-03-18T20:06:56.493Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 03:06 WIB

Official record