Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1641–1660 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10272

Broken Access Control in lunary-ai/lunary

lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:06.828Z. Updated 2025-10-15T12:49:23.325Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2025-1040

Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability arises from the improper handling of user-supplied format strings in the `AgentOutputBlock` implementation, where malicious input is passed to the Jinja2 templat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1641 to 1660 of 4001.First page Next page

Published 2025-03-20T10:11:05.749Z. Updated 2025-10-15T12:50:50.369Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-12450

RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionall…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:05.133Z. Updated 2025-04-04T08:45:39.429Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 15:45 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8062

Denial of Service in h2oai/h2o-3

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:04.864Z. Updated 2025-03-20T15:23:28.917Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:23 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8998

Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary

A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. The server uses the regex /{.*?}/ to match user-controlled strings. In the default JavaScript regex engine, this regex can take polynomial time to match certain crafted user inputs. As a result, an attacker can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:04.121Z. Updated 2025-04-04T08:45:38.448Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 15:45 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8026

CSRF due to overly permissive CORS headers in netease-youdao/qanything

A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:03.731Z. Updated 2025-03-20T15:49:53.923Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:49 WIB

Official record

HighPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8966

Denial of Service in gradio-app/gradio

A vulnerability in the file upload process of gradio-app/gradio version @gradio/video@0.10.2 allows for a Denial of Service (DoS) attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue warnings. This can render …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:03.188Z. Updated 2025-10-15T12:49:58.234Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2025-0453

Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to respond to other reques…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:02.779Z. Updated 2025-10-15T12:50:04.768Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

CritPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10834

Arbitrary File Write in eosphoros-ai/db-gpt

eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the ability to pass an absolute path to a call to `os.path.join`, enabling an attacker to write files to arbitrary locations on the target server. This vulnerability can b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:01.550Z. Updated 2025-03-20T18:14:08.060Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:14 WIB

Official record

MedPublished 20 Mar 2025, 17:11 WIB

CVE-2024-10955

ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgpt

A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<[^>]+>'` to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An attacker can exploit th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:01.287Z. Updated 2025-10-15T12:50:14.963Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

CritPublished 20 Mar 2025, 17:11 WIB

CVE-2024-8537

Path Traversal in modelscope/agentscope

A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipula…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:11:00.318Z. Updated 2025-03-20T18:14:22.708Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:14 WIB

Official record

HighPublished 20 Mar 2025, 17:10 WIB

CVE-2024-10912

Denial of Service in lm-sys/fastchat

A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this by sending a payload with an excessively large filename, causing the serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:59.830Z. Updated 2025-03-20T18:14:28.739Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:14 WIB

Official record

MedPublished 20 Mar 2025, 17:10 WIB

CVE-2024-6866

Case-Insensitive Path Matching in corydolphin/flask-cors

corydolphin/flask-cors version 4.01 contains a vulnerability where the request path matching is case-insensitive due to the use of the `try_match` function, which is originally intended for matching hosts. This results in a mismatch because paths in URLs are case-sensitive, but the regex matching treats them as case-in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:59.521Z. Updated 2025-11-03T19:34:42.290Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:34 WIB

Official record

MedPublished 20 Mar 2025, 17:10 WIB

CVE-2024-8952

SSRF in composiohq/composio

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:59.130Z. Updated 2025-03-20T15:52:34.147Z.

CVSS6.8v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:52 WIB

Official record

HighPublished 20 Mar 2025, 17:10 WIB

CVE-2024-7776

Arbitrary File Overwrite in onnx/onnx

A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability can be exploited by an attacker to overwrite files in the user's directo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:58.740Z. Updated 2025-03-20T15:52:00.491Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:52 WIB

Official record

LowPublished 20 Mar 2025, 17:10 WIB

CVE-2024-10727

Cross-Site Scripting (XSS) in phpipam/phpipam

A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0. The vulnerability arises when the application receives data in an HTTP request and includes that data within the immediate response in an unsafe manner. This allows an attacker to execute arbitrary JavaScript in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:58.253Z. Updated 2025-03-20T15:53:17.600Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 22:53 WIB

Official record

MedPublished 20 Mar 2025, 17:10 WIB

CVE-2024-8898

Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This vulnerability allows attackers to create or delete directories with arbitrary paths on the system. The issue arises due to insufficient sanitization of user-supplied input, which …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:58.125Z. Updated 2025-03-20T16:20:06.356Z.

CVSS6.7v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 23:20 WIB

Official record

HighPublished 20 Mar 2025, 17:10 WIB

CVE-2024-10569

Zip Bomb Vulnerability in gradio-app/gradio

A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciously crafted zip bomb, leading to a server crash and causing a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:57.236Z. Updated 2025-03-20T17:53:15.263Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 00:53 WIB

Official record

HighPublished 20 Mar 2025, 17:10 WIB

CVE-2024-8953

Unsafe eval usage in composiohq/composio

In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to arbitrary code execution if untrusted input is passed to the eval() function.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:56.507Z. Updated 2025-03-20T18:10:22.095Z.

CVSS7.2v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:10 WIB

Official record

HighPublished 20 Mar 2025, 17:10 WIB

CVE-2024-8063

Divide by Zero in ollama/ollama

A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted type for `block_count` in the Modelfile. This can lead to a denial of service (DoS) condition when the server processes the model, causing it to crash.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:10:56.139Z. Updated 2025-03-20T18:14:42.676Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:14 WIB

Official record