Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,001 published records · 26 KEV · 4,001 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,001 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2085.2%
High1,19230%
Med1,60140%
Low1203.0%
None00.00%
Legacy00.00%
Unscored88022%

Matching records by UTC month

Mar 254,001

Signal coverage

KEV-listed: 26
With a forecast: 4,001
Unknown date: 0
Unscored severity: 880

Share of cohort: KEV 0.65% · forecast 100% · unscored 22%.

Showing 1841–1860 of 4,001By severity band: Critical · 9.0–10.0 208, High · 7.0–8.9 1,192, Medium · 4.0–6.9 1,601, Low · 0.1–3.9 120, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 880

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-12910

Denial of Service in run-llama/llama_index

A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to contain the root URL. This leads to infinite recursive calls to the `get_article_urls` method, exhausting system resources…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:12.416Z. Updated 2025-10-15T12:50:19.185Z.

CVSS4.2v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2025-0185

Pandas Query Injection in langgenius/dify

A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability occurs in the function `vn.get_training_plan_generic(df_information_schema)`, which does not properly sanitize user inputs before executing queries using the Pan…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1841 to 1860 of 4001.First page Next page

Published 2025-03-20T10:09:11.882Z. Updated 2025-03-20T14:24:59.572Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:24 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-6838

Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:11.431Z. Updated 2025-03-20T14:25:56.917Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated20 Mar 2025, 21:25 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10361

Arbitrary File Deletion via Path Traversal in danny-avila/librechat

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security me…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:09.995Z. Updated 2025-10-15T12:50:08.542Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2025-0188

SSRF in gaizhenbiao/chuanhuchatgpt

A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the response directly, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:09.391Z. Updated 2025-10-15T12:50:48.138Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-11824

Stored XSS in langgenius/dify

A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like <input> and <form> are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an admin vie…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:08.878Z. Updated 2025-03-20T18:57:34.961Z.

CVSS5.8v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:57 WIB

Official record

CritPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10831

Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt

In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the `file_key` and `doc_file.filename` parameters are user-controllable, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:08.548Z. Updated 2025-03-20T18:57:41.633Z.

CVSS9.1v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:57 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-2292

Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data

Due to a lack of access control, unauthorized users are able to view and modify information pertaining to other users.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:07.851Z. Updated 2025-10-15T12:49:36.667Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-12704

Denial of Service (DoS) in run-llama/llama_index

A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method of the StreamingGeneratorCallbackHandler class. If the thre…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:06.689Z. Updated 2025-10-15T12:50:18.666Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-9415

Path Traversal in transformeroptimus/superagi

A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. This vulnerability allows an attacker to upload an arbitrary file to the server, potentially leading to remote code execution or overwriting any file on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:06.219Z. Updated 2025-03-20T18:58:16.596Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:58 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10274

Improper Authorization in lunary-ai/lunary

An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing unauthorized users to access sensitive information about all team members in the current organization. This vulnerability can lead to the disclosure of sensitiv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:05.537Z. Updated 2025-10-15T12:49:24.935Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:49 WIB

Official record

CritPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10553

Jdbc Deserialization in h2oai/h2o-3

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManage…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:04.913Z. Updated 2025-03-20T18:58:32.945Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:58 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-7760

CSRF in aimhubio/aim

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:04.131Z. Updated 2025-03-20T18:58:57.731Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:58 WIB

Official record

MedPublished 20 Mar 2025, 17:09 WIB

CVE-2024-10481

Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as uploading arbitrary fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:02.407Z. Updated 2025-10-15T12:50:08.883Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-7819

CORS Misconfiguration in danswer-ai/danswer

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:02.046Z. Updated 2025-03-20T18:59:15.771Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:59 WIB

Official record

HighPublished 20 Mar 2025, 17:09 WIB

CVE-2024-11137

IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0. This vulnerability allows an attacker to update the score data of any run by manipulating the id parameter in the request URL, which corresponds to the `runId_score` in the datab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:09:01.212Z. Updated 2025-10-15T12:50:16.087Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 19:50 WIB

Official record

HighPublished 20 Mar 2025, 17:08 WIB

CVE-2024-11170

Path Traversal in danny-avila/librechat

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:59.584Z. Updated 2025-03-20T18:59:47.731Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:59 WIB

Official record

MedPublished 20 Mar 2025, 17:08 WIB

CVE-2024-11821

Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint /console/api/apps/{chatbot-i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:59.022Z. Updated 2025-03-20T18:59:58.023Z.

CVSS4.3v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 01:59 WIB

Official record

HighPublished 20 Mar 2025, 17:08 WIB

CVE-2024-12068

Server-Side Request Forgery in haotian-liu/llava

A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata cred…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:58.246Z. Updated 2025-03-20T19:00:08.678Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:00 WIB

Official record

MedPublished 20 Mar 2025, 17:08 WIB

CVE-2024-11037

Path Traversal in binary-husky/gpt_academic

A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a spe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-03-20T10:08:57.513Z. Updated 2025-03-20T19:00:18.387Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated21 Mar 2025, 02:00 WIB

Official record