Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 1761–1780 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

MedPublished 18 Nov 2024, 07:00 WIB

CVE-2024-52941

CVE-2024-52941

An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T00:00:00.000Z. Updated 2024-11-18T15:53:55.041Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated18 Nov 2024, 22:53 WIB

Official record

MedPublished 18 Nov 2024, 07:00 WIB

CVE-2024-52942

CVE-2024-52942

An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1761 to 1780 of 4054.First page Next page

Published 2024-11-18T00:00:00.000Z. Updated 2024-11-18T15:51:21.931Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated18 Nov 2024, 22:51 WIB

Official record

MedPublished 18 Nov 2024, 07:00 WIB

CVE-2024-52943

CVE-2024-52943

An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T00:00:00.000Z. Updated 2025-03-18T19:29:30.756Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated19 Mar 2025, 02:29 WIB

Official record

MedPublished 18 Nov 2024, 07:00 WIB

CVE-2024-52944

CVE-2024-52944

An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting while viewing archived content. This could reflect back to an authenticated user without sanitization if exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T00:00:00.000Z. Updated 2024-11-19T15:49:04.266Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated19 Nov 2024, 22:49 WIB

Official record

HighPublished 18 Nov 2024, 07:00 WIB

CVE-2024-52945

CVE-2024-52945

An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a malicious DLL could be loaded, resultin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T00:00:00.000Z. Updated 2024-11-19T15:43:05.461Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated19 Nov 2024, 22:43 WIB

Official record

UnscoredPublished 18 Nov 2024, 07:00 WIB

CVE-2024-52946

CVE-2024-52946

An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication level if the admin configured an "Adaptative authentication rule" with an increment instead of an absolute value.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T00:00:00.000Z. Updated 2025-11-03T22:28:41.701Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 05:28 WIB

Official record

UnscoredPublished 18 Nov 2024, 07:00 WIB

CVE-2024-52947

CVE-2024-52947

A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter of the upgrade session confirmation page (upgradeSession / forceUpgrade) if the "Upgrade session" plugin has been enabled by an admin

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-18T00:00:00.000Z. Updated 2025-11-03T22:28:43.138Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 05:28 WIB

Official record

CritPublished 17 Nov 2024, 19:25 WIB

CVE-2023-43091

Gnome-maps: gnome maps is vulnerable to a code injection attack (similar to xss) via its service.json

A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T12:25:49.293Z. Updated 2024-11-18T16:39:41.368Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Nov 2024, 23:39 WIB

Official record

HighPublished 17 Nov 2024, 17:45 WIB

CVE-2024-0793

Kube-controller-manager: malformed hpa v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T10:45:50.457Z. Updated 2024-11-17T16:16:49.847Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated17 Nov 2024, 23:16 WIB

Official record

MedPublished 17 Nov 2024, 17:22 WIB

CVE-2023-6110

Openstack: deleting a non existing access rule deletes another existing access rule in it's scope

A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T10:22:34.776Z. Updated 2024-12-05T20:30:27.043Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated06 Dec 2024, 03:30 WIB

Official record

HighPublished 17 Nov 2024, 17:21 WIB

CVE-2023-4639

Undertow: cookie smuggling/spoofing

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modificati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T10:21:44.539Z. Updated 2025-02-07T17:02:40.205Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated08 Feb 2025, 00:02 WIB

Official record

MedPublished 17 Nov 2024, 17:20 WIB

CVE-2023-1419

Debezium: script injection via connector parameter

A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T10:20:36.408Z. Updated 2024-11-18T18:56:00.727Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated19 Nov 2024, 01:56 WIB

Official record

LowPublished 17 Nov 2024, 17:19 WIB

CVE-2023-0657

Keycloak: impersonation via logout token exchange

A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

Excerpt language: en.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T10:19:03.717Z. Updated 2024-11-17T16:18:51.475Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated17 Nov 2024, 23:18 WIB

Official record

HighPublished 17 Nov 2024, 17:17 WIB

CVE-2020-25720

Samba: check attribute access rights for ldap adds of computers

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T10:17:07.511Z. Updated 2026-10-21T16:09:14.698Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 23:09 WIB

Official record

HighPublished 17 Nov 2024, 07:00 WIB

CVE-2024-52867

CVE-2024-52867

guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for setuid and setgid programs) are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, and restart actions. B…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T00:00:00.000Z. Updated 2024-11-20T00:10:40.441Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated20 Nov 2024, 07:10 WIB

Official record

UnscoredPublished 17 Nov 2024, 07:00 WIB

CVE-2024-52871

CVE-2024-52871

In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T00:00:00.000Z. Updated 2024-11-18T17:51:56.789Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2024, 00:51 WIB

Official record

UnscoredPublished 17 Nov 2024, 07:00 WIB

CVE-2024-52872

CVE-2024-52872

In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T00:00:00.000Z. Updated 2024-11-18T17:51:12.838Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2024, 00:51 WIB

Official record

UnscoredPublished 17 Nov 2024, 07:00 WIB

CVE-2024-52876

CVE-2024-52876

Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-17T00:00:00.000Z. Updated 2024-11-18T16:47:10.822Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Nov 2024, 23:47 WIB

Official record

CritPublished 17 Nov 2024, 05:10 WIB

CVE-2024-52397

WordPress Convert Docx2post plugin <= 1.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post convert-docx2post allows Upload a Web Shell to a Web Server.This issue affects Convert Docx2post: from n/a through <= 1.4.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-16T22:10:13.513Z. Updated 2026-04-28T16:10:40.913Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 17 Nov 2024, 05:08 WIB

CVE-2024-52398

WordPress CDI plugin <= 5.5.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Halyra CDI collect-and-deliver-interface-for-woocommerce.This issue affects CDI: from n/a through <= 5.5.3.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-16T22:08:33.605Z. Updated 2026-04-28T16:10:40.905Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record