Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1801–1820 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10366

IDOR in delete attachments in danny-avila/librechat

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:37.556Z. Updated 2025-07-15T10:48:56.156Z.

CVSS7.6v3.0KEVNot listedEPSSPresentUpdated15 Jul 2025, 17:48 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8764

Improper Authorization in lunary-ai/lunary

A vulnerability in lunary-ai/lunary, as of commit be54057, allows users to upload and execute arbitrary regular expressions on the server side. This can lead to a Denial of Service (DoS) condition, as certain regular expressions can cause excessive resource consumption, blocking the server from processing other request…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1801 to 1820 of 4001.First page Next page

Published 2025-03-20T10:09:36.827Z. Updated 2025-10-15T12:49:57.655Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-6483

Arbitrary File/Directory Deletion in aimhubio/aim

A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploite…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:36.384Z. Updated 2025-03-20T18:37:01.937Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10047

Directory Listing Vulnerability in parisneo/lollms-webui

parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows system by sending a specially crafted HTTP request to the /open_file endpoint.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:35.799Z. Updated 2025-03-20T18:37:08.644Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10762

Missing Authorization in lunary-ai/lunary

In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can delete evaluator data. This vulnerability allows low-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:35.139Z. Updated 2025-03-20T18:37:15.812Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2025-0330

Exposure of Sensitive Information in berriai/litellm

In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This vulnerability exposes sensitive information, including langfuse_secret and langfuse_public_key, which can provide full access to the Langfuse project storing all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:34.164Z. Updated 2025-03-20T18:37:28.101Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

CritPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9053

Remote Code Execution in vllm-project/vllm

vllm-project vllm version 0.6.0 contains a vulnerability in the AsyncEngineRPCServer() RPC server entrypoints. The core functionality run_server_loop() calls the function _make_handler_coro(), which directly uses cloudpickle.loads() on received messages without any sanitization. This can result in remote code execution…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:33.924Z. Updated 2025-10-15T12:50:44.722Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-12039

Improper Restriction of Excessive Authentication Attempts in langgenius/dify

langgenius/dify version v0.10.1 contains a vulnerability where there are no limits applied to the number of code guess attempts for password reset. This allows an unauthenticated attacker to reset owner, admin, or other user passwords within a few hours by guessing the six-digit code, resulting in a complete compromise…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:33.467Z. Updated 2025-03-20T18:37:39.974Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9597

Path Traversal in parisneo/lollms

A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the `key` parameter, which is used to construct file paths. An attacker can exploit this by sending a sp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:32.788Z. Updated 2025-03-20T18:37:46.276Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

CritPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10835

Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt

In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:31.809Z. Updated 2025-03-20T18:37:53.483Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-11044

Open Redirect in automatic1111/stable-diffusion-webui

An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user credentials.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:31.708Z. Updated 2025-03-20T18:37:59.803Z.

CVSS6.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:37 WIB

Official record

LowPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10724

Stored XSS in IPV6 Section in phpipam/phpipam

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the Destination address. This vulnerability allows an attacker to execute malicious code. The issue is fixed in version 1.7.0.

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:30.561Z. Updated 2025-03-20T18:38:13.642Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:38 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-12216

Arbitrary File Write via TarSlip in dmlc/gluon-cv

A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:30.436Z. Updated 2025-10-15T12:50:16.527Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10572

Denial of Service and Arbitrary File Write in h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:28.736Z. Updated 2025-10-15T12:49:23.181Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8955

SSRF in composiohq/composio

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:27.940Z. Updated 2025-10-15T12:50:43.991Z.

CVSS6.8v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10109

Incorrect Authorization in mintplex-labs/anything-llm

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:27.423Z. Updated 2025-03-20T18:38:52.636Z.

CVSS8.3v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:38 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8020

Denial of Service in lightning-ai/pytorch-lightning

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the `/api/v1/state` endpoint of `LightningApp`. This issue occurs due to improper handling of unexpected state values, which results in the server shutting down.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:26.822Z. Updated 2025-10-15T12:49:53.948Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8489

CSRF due to overly permissive CORS headers in modelscope/agentscope

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerability permits an attacker to access all backend endpoints, in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:26.333Z. Updated 2025-03-20T18:54:47.412Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:54 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9000

Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary

In lunary-ai/lunary before version 1.4.26, the checklists.post() endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks. Additionally, the endpoint …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:25.798Z. Updated 2025-10-15T12:49:59.801Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

CritPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8581

Path Traversal in parisneo/lollms-webui

A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the `filename` value, causing a Path Traversal error.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:25.147Z. Updated 2025-10-15T12:50:41.584Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record