Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1621–1640 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8736

Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui

A Denial of Service (DoS) vulnerability exists in multiple file upload endpoints of parisneo/lollms-webui version V12 (Strawberry). The vulnerability can be exploited remotely via Cross-Site Request Forgery (CSRF). Despite CSRF protection preventing file uploads, the application still processes multipart boundaries, le…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:17.500Z. Updated 2025-04-04T08:45:37.979Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 15:45 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12070

Denial of Service in haotian-liu/llava

A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6). The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server bec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1621 to 1640 of 4001.First page Next page

Published 2025-03-20T10:11:17.105Z. Updated 2025-03-20T13:12:00.420Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:12 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8958

Unrestricted File Write and Read in composiohq/composio

In composiohq/composio version 0.4.3, there is an unrestricted file write and read vulnerability in the filetools actions. Due to improper validation of file paths, an attacker can read and write files anywhere on the server, potentially leading to privilege escalation or remote code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:16.677Z. Updated 2025-03-20T13:12:51.449Z.

CVSS7.2v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:12 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-11030

SSRF in binary-husky/gpt_academic

GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic's Gradio Web s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:15.720Z. Updated 2025-03-20T13:24:02.898Z.

CVSS7.7v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:24 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12720

Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:15.586Z. Updated 2025-03-20T13:25:27.023Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:25 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12777

Denial of Service in aimhubio/aim

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client cau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:15.212Z. Updated 2025-03-20T13:30:19.041Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:30 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-4990

Unsafe Reflection in base Component class in yiisoft/yii2

In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a valid Behavior class name or configuration. This allows an attacker to instantiate arbitrary classes, passing parameters to their constructors and invoking sett…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:14.988Z. Updated 2025-03-20T13:31:05.950Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:31 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-11043

Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai

A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the board_name field during a PATCH request. By sending a large payload, the UI becomes unresponsive, rendering it…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:14.925Z. Updated 2025-03-20T13:32:48.412Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:32 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8053

Improper Authentication in open-webui/open-webui

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource e…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:13.561Z. Updated 2025-03-27T10:44:22.552Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated27 Mar 2025, 17:44 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8021

Open Redirect in gradio-app/gradio

An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:13.192Z. Updated 2025-03-20T13:11:17.795Z.

CVSS5.4v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:11 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8400

Stored XSS in gaizhenbiao/chuanhuchatgpt

A stored cross-site scripting (XSS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code, which is then executed when the file is accessed. This can lead to the execution of arbitrary JavaScript in the c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:12.193Z. Updated 2025-03-20T15:12:54.032Z.

CVSS5.4v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:12 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10648

Path Traversal in gradio-app/gradio

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:11.154Z. Updated 2025-03-20T14:21:33.649Z.

CVSS8.2v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:21 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8183

CORS Misconfiguration in prefecthq/prefect

A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:10.708Z. Updated 2025-03-20T14:22:16.940Z.

CVSS7.6v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:22 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12074

Denial of Service in automatic1111/stable-diffusion-webui

A Denial of Service (DoS) vulnerability was discovered in the file upload feature of automatic1111/stable-diffusion-webui version 1.10.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server becom…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:10.026Z. Updated 2025-03-20T14:23:03.483Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:23 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8238

Unrestricted Code Execution in aimhubio/aim

In version 3.22.0 of aimhubio/aim, the AimQL query language uses an outdated version of the safer_getattr() function from RestrictedPython. This version does not protect against the str.format_map() method, allowing an attacker to leak server-side secrets or potentially gain unrestricted code execution. The vulnerabili…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:09.622Z. Updated 2025-10-15T12:49:56.303Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12217

Path Traversal in gradio-app/gradio

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:08.996Z. Updated 2025-03-20T15:14:58.726Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:14 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10948

Arbitrary File Read via Upload Function in binary-husky/gpt_academic

A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensitive files such as `config.py`. This issue affects the latest version of the product. An attacker can exploit this vulnerability by intercepting the websocket request during file upl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:08.455Z. Updated 2025-03-20T13:33:45.575Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:33 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-9612

Unauthorized Access in danswer-ai/danswer

In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end does not verify the visibi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:08.077Z. Updated 2025-03-20T13:34:33.986Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:34 WIB

Official record

LowPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10721

Store XSS in phpipam/phpipam

A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which can be executed in the context of other users who view the affected page. The issue occurs in the circuits options page (https:…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:07.493Z. Updated 2025-03-20T13:35:03.620Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:35 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12871

Stored Cross-site Scripting (XSS) in infiniflow/ragflow

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or unauthorized actions performe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:07.129Z. Updated 2025-03-20T13:35:32.904Z.

CVSS5.4v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:35 WIB

Official record