Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 1761–1780 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 13 Dec 2024, 10:24 WIB

CVE-2019-25221

Responsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection

The Responsive Filterable Portfolio plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-13T03:24:35.481Z. Updated 2026-04-08T17:10:26.773Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:10 WIB

Official record

LowPublished 13 Dec 2024, 10:24 WIB

CVE-2024-12300

AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload

The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the set_ar_featured_image() function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging a double extension…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1761 to 1780 of 3433.First page Next page

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-13T03:24:35.103Z. Updated 2026-04-08T17:05:49.430Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:05 WIB

Official record

MedPublished 13 Dec 2024, 10:24 WIB

CVE-2024-12572

Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forg…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-13T03:24:34.553Z. Updated 2026-04-08T17:04:34.003Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

UnscoredPublished 13 Dec 2024, 09:54 WIB

CVE-2024-12603

CVE-2024-12603

A logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing the application password.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-13T02:54:44.277Z. Updated 2025-09-05T06:31:04.528Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Sep 2025, 13:31 WIB

Official record

HighPublished 13 Dec 2024, 07:50 WIB

CVE-2024-12212

Horner Automation Cscape Out-of-bounds Read

The vulnerability occurs in the parsing of CSP files. The issues result from the lack of proper validation of user-supplied data, which could allow reading past the end of allocated data structures, resulting in execution of arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-13T00:50:45.290Z. Updated 2024-12-13T21:14:45.265Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated14 Dec 2024, 04:14 WIB

Official record

HighPublished 13 Dec 2024, 07:49 WIB

CVE-2024-9508

Horner Automation Cscape Out-of-bounds Read

Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-13T00:49:03.188Z. Updated 2024-12-13T21:14:18.861Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated14 Dec 2024, 04:14 WIB

Official record

UnscoredPublished 13 Dec 2024, 07:00 WIB

CVE-2024-55918

CVE-2024-55918

An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. There is an ambiguity between modules and filenames that can lead to HTML injection by an attacker who can create a file in the current working directory.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-13T00:00:00.000Z. Updated 2024-12-17T19:34:50.379Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Dec 2024, 02:34 WIB

Official record

UnscoredKEVPublished 13 Dec 2024, 07:00 WIB

CVE-2024-55956

CVE-2024-55956

In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.

Excerpt language: en.

Unscored under this view's policy KEV listed. Forecast present in this snapshot.

Published 2024-12-13T00:00:00.000Z. Updated 2026-08-05T03:55:58.257Z.

CVSS—KEVListedEPSSPresentUpdated05 Aug 2026, 10:55 WIB

Official record

MedPublished 13 Dec 2024, 05:42 WIB

CVE-2024-12289

Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service

Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on ave…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T22:42:01.595Z. Updated 2024-12-13T19:35:10.676Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated14 Dec 2024, 02:35 WIB

Official record

HighPublished 13 Dec 2024, 02:28 WIB

CVE-2024-55888

Content Security Policy appears to be missing in software and production setup

Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scripting filters. Version 0.3.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:28:15.795Z. Updated 2024-12-13T15:40:32.295Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 Dec 2024, 22:40 WIB

Official record

MedPublished 13 Dec 2024, 02:25 WIB

CVE-2024-55886

OpenTelemetry Logs source may lack authentication with some custom plugins

OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom authentication plugins will not perform a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:25:43.988Z. Updated 2024-12-13T15:45:10.895Z.

CVSS6.9v3.1KEVNot listedEPSSPresentUpdated13 Dec 2024, 22:45 WIB

Official record

MedPublished 13 Dec 2024, 02:23 WIB

CVE-2024-55885

Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames

beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:23:14.239Z. Updated 2024-12-13T15:46:22.821Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated13 Dec 2024, 22:46 WIB

Official record

MedPublished 13 Dec 2024, 02:20 WIB

CVE-2024-55878

Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:20:02.061Z. Updated 2024-12-13T15:57:54.961Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated13 Dec 2024, 22:57 WIB

Official record

CritPublished 13 Dec 2024, 02:17 WIB

CVE-2024-55879

XWiki allows RCE from script right in configurable sections

XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality, integrity and availability of the whole XW…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:17:38.138Z. Updated 2024-12-13T14:54:21.161Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated13 Dec 2024, 21:54 WIB

Official record

CritPublished 13 Dec 2024, 02:13 WIB

CVE-2024-55877

XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList

XWiki Platform is a generic wiki platform. Starting in version 9.7-rc-1 and prior to versions 15.10.11, 16.4.1, and 16.5.0, any user with an account can perform arbitrary remote code execution by adding instances of `XWiki.WikiMacroClass` to any page. This compromises the confidentiality, integrity and availability of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:13:43.128Z. Updated 2024-12-13T14:54:49.185Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated13 Dec 2024, 21:54 WIB

Official record

MedPublished 13 Dec 2024, 02:07 WIB

CVE-2024-49071

Windows Defender Information Disclosure Vulnerability

Improper authorization of an index that contains sensitive information from a Global Files search in Windows Defender allows an authorized attacker to disclose information over a network.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:07:50.753Z. Updated 2026-06-09T18:30:59.554Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated10 Jun 2026, 01:30 WIB

Official record

CritPublished 13 Dec 2024, 02:07 WIB

CVE-2024-49147

Microsoft Update Catalog Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T19:07:35.528Z. Updated 2026-06-09T18:30:43.652Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated10 Jun 2026, 01:30 WIB

Official record

MedPublished 13 Dec 2024, 01:59 WIB

CVE-2024-55876

XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document `Scheduler.WebHome` in a s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T18:59:49.733Z. Updated 2024-12-13T14:55:19.672Z.

CVSS5.4v3.0KEVNot listedEPSSPresentUpdated13 Dec 2024, 21:55 WIB

Official record

CritPublished 13 Dec 2024, 01:56 WIB

CVE-2024-55875

http4k has a potential XXE (XML External Entity Injection) vulnerability

http4k is a functional toolkit for Kotlin HTTP applications. Prior to version 6.50.0.0, there is a potential XXE (XML External Entity Injection) vulnerability when http4k handling malicious XML contents within requests, which might allow attackers to read local sensitive information on server, trigger Server-side Reque…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T18:56:59.499Z. Updated 2026-06-09T10:42:10.658Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Jun 2026, 17:42 WIB

Official record

HighPublished 13 Dec 2024, 01:53 WIB

CVE-2024-55663

XWiki Platform has an SQL injection in getdocuments.vm with sort parameter

XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 13.10.5 and 14.3-rc-1, in `getdocument.vm`; the ordering of the returned documents is defined from an unsanitized request parameter (request.sort) and can allow any user to inject HQL. Depending on the used database bac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-12T18:53:49.491Z. Updated 2024-12-16T18:08:43.496Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated17 Dec 2024, 01:08 WIB

Official record