Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1821–1840 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10812

Open Redirect in binary-husky/gpt_academic

An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-controlled input in the 'file' parameter without proper validation or sanitization. This can be exploited by attackers to conduct phishing attacks, distribute ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:24.562Z. Updated 2025-03-20T18:55:20.454Z.

CVSS6.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:55 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9606

Improper Output Neutralization for Logs in berriai/litellm

In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount of the secret key.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1821 to 1840 of 4001.First page Next page

Published 2025-03-20T10:09:24.180Z. Updated 2025-03-20T18:55:27.073Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:55 WIB

Official record

LowPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10723

Stored XSS in phpipam/phpipam

A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact of this vulnerability includes t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:23.803Z. Updated 2025-03-20T18:55:33.336Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:55 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-12775

SSRF in langgenius/dify

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `url` in the `servers` dictionary in OpenAI's schema with arbit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:23.407Z. Updated 2025-03-20T18:55:41.104Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:55 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10110

Denial of Service in aimhubio/aim

In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the tracking server becomes unable to respond to other requests.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:22.842Z. Updated 2025-03-20T18:55:48.687Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:55 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8029

Stored XSS in imartinez/privategpt

An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0. Attackers can upload malicious SVG files, which execute JavaScript when victims click on the file link. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:21.980Z. Updated 2025-03-20T18:55:55.477Z.

CVSS4.7v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:55 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9418

Insufficiently Protected Credentials in transformeroptimus/superagi

In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an attacker to retrieve the password of another user, leading to potential account takeover.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:21.583Z. Updated 2025-10-15T12:50:46.781Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

CritPublished 20 Mar 2025, 17:09 WIB

CVE-2024-12909

SQL Injection to RCE in run-llama/llama_index

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) throug…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:20.928Z. Updated 2025-03-20T18:56:10.642Z.

CVSS10v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:56 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9363

Unauthorized File Deletion in polyaxon/polyaxon

An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical containers. An attacker can delete important files within the containers, such as `polyaxon.sock`, causing the API container to exit unexpectedly. This disrupts …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:20.436Z. Updated 2025-03-20T18:56:16.931Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:56 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9847

Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress

FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress CMS server to perfor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:19.509Z. Updated 2025-03-20T18:56:24.410Z.

CVSS8v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:56 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8984

Denial of Service (DoS) in berriai/litellm

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rende…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:19.131Z. Updated 2025-10-15T12:49:58.738Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

CritPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10902

Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt

In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to upload arbitrary files to the victim's file system at any location. The impact of this vulnerability includes the potential …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:18.262Z. Updated 2025-10-15T12:50:12.310Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10821

Denial of Service (DoS) in invoke-ai/invokeai

A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an inf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:17.805Z. Updated 2025-10-15T12:50:10.809Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-12580

Logs Debug Injection in danny-avila/librechat

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:16.971Z. Updated 2025-03-20T18:56:54.526Z.

CVSS4.3v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:56 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-11031

SSRF in binary-husky/gpt_academic

In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API. This vulnerability is exploited through the HotReload(Markdown翻译中) plugin function, which allows downloading arbitrary web hosts by only checking if the link…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:16.417Z. Updated 2025-07-15T10:48:56.680Z.

CVSS7.7v3.0KEVNot listedEPSSPresentUpdated15 Jul 2025, 17:48 WIB

Official record

LowPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10725

Stored Cross-site Scripting (XSS) in phpipam/phpipam

A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which are then executed in the context of other users who view the affected pages. The issue occurs when editing the NAT destination address,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:15.972Z. Updated 2025-03-20T18:57:09.070Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:57 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10275

Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manage billing, effectively …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:15.334Z. Updated 2025-10-15T12:49:25.441Z.

CVSS7.3v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-11822

Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal servers and potentially …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:14.815Z. Updated 2025-03-20T13:48:41.654Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:48 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9900

Cross-Site Scripting (XSS) in mudler/localai

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:14.108Z. Updated 2025-04-04T08:45:38.623Z.

CVSS5.4v3.0KEVNot listedEPSSPresentUpdated04 Apr 2025, 15:45 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-8156

Command Injection in significant-gravitas/autogpt

A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:12.930Z. Updated 2025-10-15T12:50:39.556Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record