Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1601–1620 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8248

Path Traversal in mintplex-labs/anything-llm

A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:32.456Z. Updated 2025-03-20T14:11:09.368Z.

CVSS7.2v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:11 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12866

Local File Inclusion in netease-youdao/qanything

A local file inclusion vulnerability exists in netease-youdao/qanything version v2.0.0. This vulnerability allows an attacker to read arbitrary files on the file system, which can lead to remote code execution by retrieving private SSH keys, reading private files, source code, and configuration files.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:31.785Z. Updated 2025-03-20T14:12:15.592Z.

Showing 1601 to 1620 of 4001.First page Next page

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:12 WIB

Official record

CritPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8017

Cross-site Scripting (XSS) in open-webui/open-webui

An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:31.223Z. Updated 2025-03-20T14:19:30.503Z.

CVSS9v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:19 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2025-0508

MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:30.798Z. Updated 2025-10-15T12:50:48.695Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2025-0454

SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt

A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the `urlparse` function from the `urllib.parse` library and the `requests` library. A malicious user can exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:30.365Z. Updated 2025-03-20T15:22:14.163Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:22 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8101

Stored XSS in aimhubio/aim

A stored cross-site scripting (XSS) vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of `dangerouslySetInnerHTML` without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be exploited by injecti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:29.974Z. Updated 2025-03-20T13:01:37.992Z.

CVSS7.2v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:01 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10650

Denial of Service (DoS) in gaizhenbiao/chuanhuchatgpt

An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807, the issue can still be exploited by sending data in groups with 10 characters in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:29.258Z. Updated 2025-10-15T12:49:24.004Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12779

SSRF in infiniflow/ragflow

A Server-Side Request Forgery (SSRF) vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the `POST /v1/llm/add_llm` and `POST /v1/conversation/tts` endpoints. Attackers can specify an arbitrary URL as the `api_base` when adding an `OPENAITTS` model, and subsequently access the `tt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:28.705Z. Updated 2025-03-20T13:03:06.470Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:03 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12048

IDOR Vulnerability in transformeroptimus/superagi

An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:27.726Z. Updated 2025-03-20T13:04:08.483Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:04 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8487

CORS Vulnerability in modelscope/agentscope

A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized data access, information…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:26.563Z. Updated 2025-03-20T13:04:47.063Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:04 WIB

Official record

CritPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8769

Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim

A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:22.123Z. Updated 2025-10-15T12:50:42.461Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8556

Stored XSS in modelscope/agentscope

A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:21.587Z. Updated 2025-03-20T13:05:54.203Z.

CVSS6.1v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:05 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12387

Improper Input Validation in binary-husky/gpt_academic

A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to impro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:21.371Z. Updated 2025-10-15T12:49:30.933Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12766

SSRF in parisneo/lollms-webui

parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter `{"url":"http://steal.tar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:20.626Z. Updated 2025-03-20T13:08:13.183Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:08 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-7767

Improper Access Control in danswer-ai/danswer

An improper access control vulnerability exists in danswer-ai/danswer version v0.3.94. This vulnerability allows the first user created in the system to view, modify, and delete chats created by an Admin. This can lead to unauthorized access to sensitive information, loss of data integrity, and potential compliance vio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:20.256Z. Updated 2025-10-15T12:49:51.871Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12869

Improper Authentication in infiniflow/ragflow

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:19.807Z. Updated 2025-10-15T12:49:32.208Z.

CVSS4.3v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-11300

Improper Access Control in lunary-ai/lunary

In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized users to view sensitive prompt data by accessing specific URLs, leading to potential …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:19.503Z. Updated 2025-10-15T12:49:29.238Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10830

Path Traversal in eosphoros-ai/db-gpt

A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` parameter is not properly sanitized, enabling an attacker to spec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:19.024Z. Updated 2025-03-20T14:28:18.389Z.

CVSS8.2v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:28 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8524

Directory Traversal in modelscope/agentscope

A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:18.458Z. Updated 2025-10-15T12:50:40.766Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

CritPublished 20 Mar 2025, 17:11 WIB

CVE-2024-5752

Path Traversal in stitionai/devika

A path traversal vulnerability exists in stitionai/devika, specifically in the project creation functionality. In the affected version beacf6edaa205a5a5370525407a6db45137873b3, the project name is not validated, allowing an attacker to create a project with a crafted name that traverses directories. This can lead to ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:17.971Z. Updated 2025-03-20T14:53:54.243Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:53 WIB

Official record