Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 1881–1900 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

LowPublished 15 Nov 2024, 23:38 WIB

CVE-2024-52521

Nextcloud Server has a potential hash collision for background jobs could skip queuing them

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 the probability was heav…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:38:49.174Z. Updated 2024-11-15T17:04:24.129Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:04 WIB

Official record

MedPublished 15 Nov 2024, 23:37 WIB

CVE-2021-1481

Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. This vulnerability is due to insufficient input validation by the web-based management interface. An attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1881 to 1900 of 4054.First page Next page

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:37:23.188Z. Updated 2024-11-15T17:49:36.250Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:49 WIB

Official record

MedPublished 15 Nov 2024, 23:36 WIB

CVE-2021-1482

Cisco SD-WAN vManage Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain access to sensitive information on an affected system. This vulnerability is due to insufficient authorization checks. An attacker could ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:36:11.822Z. Updated 2024-11-15T17:51:26.242Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:51 WIB

Official record

MedPublished 15 Nov 2024, 23:35 WIB

CVE-2024-52523

Nextcloud Server Custom defined credentials of external storages are sent back to the frontend

Nextcloud Server is a self hosted personal cloud system. After setting up a user or administrator defined external storage with fixed credentials, the API returns them and adds them into the frontend again, allowing to read them in plain text when an attacker already has access to an active session of a user. It is rec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:35:39.424Z. Updated 2024-11-15T17:06:22.449Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:06 WIB

Official record

MedPublished 15 Nov 2024, 23:32 WIB

CVE-2021-1464

Cisco SD-WAN vManage Authorization Bypass Vulnerability

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to bypass authorization checking and gain restricted access to the configuration information of an affected system. This vulnerability exists because the affected software has insufficient input validation for certain c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:32:20.193Z. Updated 2024-11-15T17:52:30.162Z.

CVSS5v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:52 WIB

Official record

MedPublished 15 Nov 2024, 23:31 WIB

CVE-2024-11247

SourceCodester Online Eyewear Shop Inventory Page Master.php cross site scripting

A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=save_product of the component Inventory Page. The manipulation of the argument brand leads to cross site scripting. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:31:05.234Z. Updated 2024-11-15T17:08:49.087Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:08 WIB

Official record

LowPublished 15 Nov 2024, 23:30 WIB

CVE-2024-52525

Nextcloud Server User password is available in memory of the PHP process

Nextcloud Server is a self hosted personal cloud system. Under certain conditions the password of a user was stored unencrypted in the session data. The session data is encrypted before being saved in the session storage (Redis or disk), but it would allow a malicious process that gains access to the memory of the PHP …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:30:28.401Z. Updated 2024-11-15T17:10:50.412Z.

CVSS1.8v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:10 WIB

Official record

MedPublished 15 Nov 2024, 23:27 WIB

CVE-2021-1483

Cisco SD-WAN vManage Software XML External Entity Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. This vulnerability is due to improper handling of XML External Entity (XXE) entries when the affected software parses cert…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:27:43.715Z. Updated 2024-11-15T17:57:44.233Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:57 WIB

Official record

MedPublished 15 Nov 2024, 23:26 WIB

CVE-2021-1484

Cisco SD-WAN vManage Command Injection Vulnerability

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service (DoS) condition. This vulnerability is due to improper input validation of user-supplied input to the device template config…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:26:12.341Z. Updated 2024-11-15T17:59:14.156Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:59 WIB

Official record

MedPublished 15 Nov 2024, 23:25 WIB

CVE-2021-1491

Cisco SD-WAN vManage Software Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:25:02.254Z. Updated 2024-11-15T16:28:58.834Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated15 Nov 2024, 23:28 WIB

Official record

CritPublished 15 Nov 2024, 23:21 WIB

CVE-2024-52528

Auth Token can be passed dummy or wrong the middleware response is 200 OK

Budget Control Gateway acts as an entry point for incoming requests and routes them to the appropriate microservices for Budget Control. Budget Control Gateway does not properly validate auth tokens, which allows attackers to bypass intended restrictions. This vulnerability is fixed in 1.5.2.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:21:56.073Z. Updated 2024-11-15T17:14:10.451Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:14 WIB

Official record

MedPublished 15 Nov 2024, 23:21 WIB

CVE-2021-1494

CVE-2021-1494

Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this vulnerability by sen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:21:36.666Z. Updated 2024-11-15T21:23:12.943Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:23 WIB

Official record

MedPublished 15 Nov 2024, 23:15 WIB

CVE-2022-20633

Cisco Enterprise Chat and Email Username Enumeration Vulnerability

A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device. This vulnerability is due to differences in authentication responses that are sent back from the application as part of an authe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:15:01.284Z. Updated 2024-11-15T21:35:35.232Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:35 WIB

Official record

MedPublished 15 Nov 2024, 23:14 WIB

CVE-2022-20632

Cisco Enterprise Chat and Email Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:14:53.322Z. Updated 2024-11-15T18:00:56.895Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:00 WIB

Official record

MedPublished 15 Nov 2024, 23:14 WIB

CVE-2021-34753

Cisco Firepower Threat Defense Ethernet Industrial Protocol Policy Bypass Vulnerabilities

A vulnerability in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This vulnerability is due to incomplete processing during deep packet inspection for…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:14:45.327Z. Updated 2024-11-15T18:06:40.214Z.

CVSS5.8v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:06 WIB

Official record

MedPublished 15 Nov 2024, 23:14 WIB

CVE-2021-34752

Cisco Firepower Threat Defense Command Injection Vulnerabilities

A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying operating system of an affected device.  This vulnerability is due to insufficient validation of user-supplied co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:14:36.385Z. Updated 2024-11-15T18:09:38.213Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:09 WIB

Official record

MedPublished 15 Nov 2024, 23:14 WIB

CVE-2021-34751

Cisco Firepower Management Center Software Configuration Information Disclosure Vulnerability

A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to access sensitive configuration information. The attacker would require low privilege credentials on an affected device. This vulnerability exist…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:14:27.746Z. Updated 2024-11-15T18:10:23.392Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:10 WIB

Official record

MedPublished 15 Nov 2024, 23:14 WIB

CVE-2021-34750

Cisco Firepower Management Center Software Configuration Information Disclosure Vulnerability

A vulnerability in the administrative web-based GUI configuration manager of Cisco Firepower Management Center Software could allow an authenticated, remote attacker to access sensitive configuration information. The attacker would require low privilege credentials on an affected device. This vulnerability is due to l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:14:19.255Z. Updated 2024-11-15T18:11:03.734Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:11 WIB

Official record

HighPublished 15 Nov 2024, 23:13 WIB

CVE-2024-39726

IBM Engineering Insights XML external entity injection

IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:13:12.535Z. Updated 2024-11-15T17:15:35.473Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:15 WIB

Official record

MedPublished 15 Nov 2024, 23:04 WIB

CVE-2022-20626

Cisco Prime Access Registrar Appliance Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Prime Access Registrar Appliance could allow an authenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. The attacker would require valid credentials for the device. This vulnerability is due to insuffic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T16:04:04.233Z. Updated 2024-11-15T16:25:17.676Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated15 Nov 2024, 23:25 WIB

Official record