Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 1661–1680 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

MedPublished 18 Nov 2024, 22:30 WIB

CVE-2021-1462

Cisco SD-WAN vManage Software Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to elevate privileges on an affected system. To exploit this vulnerability, an attacker would need to have a valid Administrator account on an affected system. The vulnerability is due to incorrect privilege a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T15:30:12.049Z. Updated 2024-11-18T15:51:45.679Z.

CVSS4.4v3.0KEVNot listedEPSSPresentUpdated18 Nov 2024, 22:51 WIB

Official record

MedPublished 18 Nov 2024, 22:30 WIB

CVE-2024-52425

WordPress Drozd – Addons for Elementor plugin <= 1.1.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladislav Urchenko Drozd – Addons for Elementor drozd-addons-for-elementor allows Stored XSS.This issue affects Drozd – Addons for Elementor: from n/a through <= 1.1.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1661 to 1680 of 4054.First page Next page

Published 2024-11-18T15:30:01.184Z. Updated 2026-04-28T16:10:41.684Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 18 Nov 2024, 22:29 WIB

CVE-2024-52426

WordPress Linear plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue affects Linear: from n/a through <= 2.8.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T15:29:12.392Z. Updated 2026-04-28T16:10:42.032Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 18 Nov 2024, 22:26 WIB

CVE-2021-1465

CVE-2021-1465

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a directory traversal attack and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T15:26:13.298Z. Updated 2024-11-18T15:52:42.063Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated18 Nov 2024, 22:52 WIB

Official record

MedPublished 18 Nov 2024, 22:06 WIB

CVE-2024-37155

OpenCTI May Bypass Introspection Restriction

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed characters from the query. Gr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T15:06:32.886Z. Updated 2024-11-18T21:38:54.470Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated19 Nov 2024, 04:38 WIB

Official record

CritPublished 18 Nov 2024, 21:37 WIB

CVE-2024-52431

WordPress WP Video Robot plugin <= 1.20.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressaholic WordPress Video Robot - The Ultimate Video Importer allows SQL Injection.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:37:54.275Z. Updated 2026-04-28T16:10:42.055Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 18 Nov 2024, 21:36 WIB

CVE-2024-52435

WordPress Premium Packages – Sell Digital Products Securely plugin <= 6.0.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.5.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:36:00.957Z. Updated 2026-04-28T16:10:42.069Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 18 Nov 2024, 21:30 WIB

CVE-2024-52436

WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal Post SMTP post-smtp allows Blind SQL Injection.This issue affects Post SMTP: from n/a through <= 2.9.9.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:30:20.672Z. Updated 2026-04-28T16:10:42.030Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 18 Nov 2024, 21:29 WIB

CVE-2024-52428

WordPress Ads Booster by Ads Pro plugin <= 1.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Peter Ads Booster by Ads Pro free-wp-booster-by-ads-pro allows PHP Local File Inclusion.This issue affects Ads Booster by Ads Pro: from n/a through <= 1.12.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:29:02.638Z. Updated 2026-04-28T16:10:41.980Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 18 Nov 2024, 21:27 WIB

CVE-2024-52430

WordPress Lis Video Gallery plugin <= 0.2.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in bublick Lis Video Gallery lis-video-gallery allows Object Injection.This issue affects Lis Video Gallery: from n/a through <= 0.2.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:27:03.371Z. Updated 2026-04-28T16:10:41.951Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 18 Nov 2024, 21:26 WIB

CVE-2024-11304

Multiple Stored Cross-Site Scripting

Missing input validation in the SEH Computertechnik utnserver Pro, SEH Computertechnik utnserver ProMAX, SEH Computertechnik INU-100 web-interface allows stored Cross-Site Scripting (XSS). This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:26:08.676Z. Updated 2024-11-21T22:02:47.577Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated22 Nov 2024, 05:02 WIB

Official record

CritPublished 18 Nov 2024, 21:24 WIB

CVE-2024-52432

WordPress NIX Anti-Spam Light plugin <= 0.0.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Object Injection.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:24:50.375Z. Updated 2026-04-28T16:10:42.080Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 18 Nov 2024, 21:23 WIB

CVE-2024-52433

WordPress My Geo Posts Free plugin <= 1.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Mindstien Technologies My Geo Posts Free my-geo-posts-free allows Object Injection.This issue affects My Geo Posts Free: from n/a through <= 1.2.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:23:47.577Z. Updated 2026-04-28T16:10:42.171Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 18 Nov 2024, 21:22 WIB

CVE-2024-52427

WordPress Event Tickets with Ticket Scanner plugin <= 2.3.11 - Remote Code Execution (RCE) vulnerability

Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:22:15.137Z. Updated 2026-05-11T22:00:47.973Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 05:00 WIB

Official record

CritPublished 18 Nov 2024, 21:19 WIB

CVE-2024-52429

WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in AntonHoelstad WP Quick Setup wp-quick-setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through <= 2.0.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:19:18.847Z. Updated 2026-04-28T16:10:42.060Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 18 Nov 2024, 21:18 WIB

CVE-2024-52434

WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code Execution (RCE) vulnerability

Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:18:13.457Z. Updated 2026-04-28T16:10:42.243Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

HighPublished 18 Nov 2024, 21:00 WIB

CVE-2024-8781

Container Escape Vulnerability in TR7's Application Security Platform (ASP)

Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escalation, -Privilege Abuse. This issue affects Application Security Platform (ASP): v1.4.25.188.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T14:00:49.131Z. Updated 2026-06-02T07:54:31.659Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 14:54 WIB

Official record

HighPublished 18 Nov 2024, 20:47 WIB

CVE-2024-11318

IDOR vulnerability in AbsysNet

An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifier on the "/cgi-bin/ocap/" endpoint.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T13:47:19.215Z. Updated 2024-11-18T14:08:35.909Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Nov 2024, 21:08 WIB

Official record

HighPublished 18 Nov 2024, 20:30 WIB

CVE-2024-9526

Stored XSS in Kubeflow Pipeline View

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T13:30:21.818Z. Updated 2024-11-21T10:24:31.751Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 17:24 WIB

Official record

HighPublished 18 Nov 2024, 20:24 WIB

CVE-2024-11303

Path Traversal

The pathname of the root directory to a Restricted Directory ('Path Traversal') vulnerability in Korenix JetPort 5601 allows Path Traversal.This issue affects JetPort 5601: through 1.2.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T13:24:37.376Z. Updated 2024-11-21T22:02:46.052Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated22 Nov 2024, 05:02 WIB

Official record