Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 1521–1540 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24423

CVE-2024-24423

The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_esm_message_container function at /nas/ies/EsmMessageContainer.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-03-18T18:13:47.681Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 01:13 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24424

CVE-2024-24424

A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-03-14T15:48:44.169Z.

Showing 1521 to 1540 of 4273.First page Next page

CVSS—

KEVNot listed

EPSSPresent

Updated14 Mar 2025, 22:48 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24427

CVE-2024-24427

A reachable assertion in the amf_ue_set_suci function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-23T18:55:21.657Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jan 2025, 01:55 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24428

CVE-2024-24428

A reachable assertion in the oai_nas_5gmm_decode function of Open5GS <= 2.6.4 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-23T18:56:12.846Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Jan 2025, 01:56 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24442

CVE-2024-24442

A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted NGAP message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2026-07-05T00:53:37.574Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 07:53 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24443

CVE-2024-24443

An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDU Session Resource Setup Response.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2026-07-05T00:53:41.366Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 07:53 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24444

CVE-2024-24444

Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) by repeatedly establishing SCTP connections with the N2 interface.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2026-07-05T00:53:45.296Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 07:53 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24445

CVE-2024-24445

OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is unsupported, OAI indexes int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2026-07-07T16:39:46.707Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Jul 2026, 23:39 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-24451

CVE-2024-24451

A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause a Denial of Service (DoS) by repeatedly establishing SCTP connections with the N2 interface.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2026-07-05T00:53:54.357Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 07:53 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-42936

CVE-2024-42936

The mqlink.elf is service component in Ruijie RG-EW300N with firmware ReyeeOS 1.300.1422 is vulnerable to Remote Code Execution via a modified MQTT broker message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-03-20T14:00:32.907Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:00 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-48392

CVE-2024-48392

OrangeScrum v2.0.11 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into user email due to lack of input validation, which could lead to account takeover.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-22T21:53:34.918Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Jan 2025, 04:53 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-51417

CVE-2024-51417

An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-02-04T15:26:35.255Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 22:26 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-54792

CVE-2024-54792

A Cross-Site Request Forgery (CSRF) vulnerability has been found in SpagoBI v3.5.1 in the user administration panel. An authenticated user can lead another user into executing unwanted actions inside the application they are logged in, like adding, editing or deleting users.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-10-17T15:18:49.209Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Oct 2025, 22:18 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-54794

CVE-2024-54794

The script input feature of SpagoBI 3.5.1 allows arbitrary code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-10-17T15:15:56.401Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Oct 2025, 22:15 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-54795

CVE-2024-54795

SpagoBI v3.5.1 contains multiple Stored Cross-Site Scripting (XSS) vulnerabilities in the create/edit forms of the worksheet designer function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-10-17T15:12:33.608Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Oct 2025, 22:12 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-55504

CVE-2024-55504

An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote control and unauthorized access to sensitive user data via the exploit_combined.dylib component on MacOS.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-02-04T15:32:13.959Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 22:32 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-55958

CVE-2024-55958

Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-22T21:56:59.416Z.

CVSS—KEVNot listedEPSSPresentUpdated23 Jan 2025, 04:56 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-55959

CVE-2024-55959

Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-03-18T14:16:08.922Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:16 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-56990

CVE-2024-56990

PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /view-medhistory.php and /admin/view-patient.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-02-04T15:21:16.480Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 22:21 WIB

Official record

UnscoredPublished 21 Jan 2025, 07:00 WIB

CVE-2024-56997

CVE-2024-56997

PHPGurukul Hospital Management System 4.0 is vulnerable to Cross Site Scripting (XSS) in /doctor/index.php via the 'Email' parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-21T00:00:00.000Z. Updated 2025-01-21T19:51:55.805Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Jan 2025, 02:51 WIB

Official record