Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 1961–1980 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

HighPublished 15 Nov 2024, 19:00 WIB

CVE-2024-11237

TP-Link VN020 F3v(T) DHCP DISCOVER Packet Parser TP-Thumper stack-based overflow

A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. The attack may be launched remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T12:00:15.886Z. Updated 2024-11-15T20:42:20.206Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 03:42 WIB

Official record

HighPublished 15 Nov 2024, 18:02 WIB

CVE-2024-10534

Improper Access Control in Dataprom Informatics' PACS-ACSS

Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traffic Injection. This issue affects Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS): before 2024.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1961 to 1980 of 4054.First page Next page

Published 2024-11-15T11:02:50.683Z. Updated 2026-06-02T06:51:26.646Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated02 Jun 2026, 13:51 WIB

Official record

HighPublished 15 Nov 2024, 17:57 WIB

CVE-2024-0875

Stored XSS in openemr/openemr

A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is executed, potentially com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:25.334Z. Updated 2024-11-15T20:54:38.603Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 03:54 WIB

Official record

CritPublished 15 Nov 2024, 17:57 WIB

CVE-2023-0109

Stored XSS in usememos/memos

A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to upload a JavaScript file containing a malicious script and reference it in an HTML file. When the HTML file is accessed, the malicious script is executed. This can lead to the theft…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:21.900Z. Updated 2024-11-15T20:56:59.319Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 03:56 WIB

Official record

LowPublished 15 Nov 2024, 17:57 WIB

CVE-2022-1226

Cross-site Scripting (XSS) in phpipam/phpipam

A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-sub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:20.597Z. Updated 2024-11-15T20:59:32.661Z.

CVSS3.5v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 03:59 WIB

Official record

MedPublished 15 Nov 2024, 17:57 WIB

CVE-2023-2332

Stored Cross-site Scripting (XSS) in pimcore/pimcore

A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:19.795Z. Updated 2024-11-15T21:00:49.061Z.

CVSS4v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:00 WIB

Official record

HighPublished 15 Nov 2024, 17:57 WIB

CVE-2024-1097

Stored XSS in craigk5n/webcalendar

A stored cross-site scripting (XSS) vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report, potentially leading …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:11.234Z. Updated 2024-11-15T21:04:04.691Z.

CVSS7.6v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:04 WIB

Official record

MedPublished 15 Nov 2024, 17:57 WIB

CVE-2021-3740

Session Fixation in chatwoot/chatwoot

A Session Fixation vulnerability exists in chatwoot/chatwoot versions prior to 2.4.0. The application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This can lead to unauthorized access if an attacker has obtained a session token.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:09.236Z. Updated 2024-11-15T19:03:09.228Z.

CVSS6.8v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 02:03 WIB

Official record

MedPublished 15 Nov 2024, 17:57 WIB

CVE-2024-1240

Open Redirection in pyload/pyload

An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The is…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:07.797Z. Updated 2024-11-15T19:07:26.471Z.

CVSS4.6v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 02:07 WIB

Official record

MedPublished 15 Nov 2024, 17:57 WIB

CVE-2024-0787

Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam

phpIPAM version 1.5.1 contains a vulnerability where an attacker can bypass the IP block mechanism to brute force passwords for users by using the 'X-Forwarded-For' header. The issue lies in the 'get_user_ip()' function in 'class.Common.php' at lines 1044 and 1045, where the presence of the 'X-Forwarded-For' header is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:57:05.410Z. Updated 2024-11-15T19:09:48.262Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 02:09 WIB

Official record

MedPublished 15 Nov 2024, 17:53 WIB

CVE-2023-4679

Use After Free in gpac/gpac

A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38. This vulnerability can lead to a double-free condition, which may cause the application to crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:53:32.070Z. Updated 2024-11-15T19:12:15.195Z.

CVSS5.9v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 02:12 WIB

Official record

MedPublished 15 Nov 2024, 17:53 WIB

CVE-2023-0737

CSRF in wallabag/wallabag

wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint. This issue is fixed in version 2.5.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:53:21.745Z. Updated 2024-11-20T22:30:58.342Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 05:30 WIB

Official record

CritPublished 15 Nov 2024, 17:53 WIB

CVE-2022-1884

Remote Command Execution in gogs/gogs

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:53:00.844Z. Updated 2024-11-15T19:15:02.353Z.

CVSS10v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 02:15 WIB

Official record

MedPublished 15 Nov 2024, 17:52 WIB

CVE-2021-3991

Improper Authorization in dolibarr/dolibarr

An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:52:49.304Z. Updated 2024-11-15T18:26:07.636Z.

CVSS4.3v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:26 WIB

Official record

MedPublished 15 Nov 2024, 17:52 WIB

CVE-2021-3988

Cross-site Scripting (XSS) in janeczku/calibre-web

A Cross-site Scripting (XSS) vulnerability exists in janeczku/calibre-web, specifically in the file `edit_books.js`. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization, allowing attackers to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:52:39.637Z. Updated 2024-11-20T22:35:15.693Z.

CVSS5.7v3.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 05:35 WIB

Official record

MedPublished 15 Nov 2024, 17:52 WIB

CVE-2021-3987

Improper Access Control in janeczku/calibre-web

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the `create_shelf` method in `shelf.py` not verifying if the user has the necessary permissions to create a public shelf. This…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:52:29.478Z. Updated 2024-11-15T18:28:12.925Z.

CVSS5.4v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:28 WIB

Official record

MedPublished 15 Nov 2024, 17:52 WIB

CVE-2021-3986

Information Disclosure in janeczku/calibre-web

A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they do not own. This vulnera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:52:21.551Z. Updated 2024-11-15T18:31:36.752Z.

CVSS4.3v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:31 WIB

Official record

CritPublished 15 Nov 2024, 17:52 WIB

CVE-2021-3902

Improper Restriction of XML External Entity Reference in dompdf/dompdf

An improper restriction of external entities (XXE) vulnerability in dompdf/dompdf's SVG parser allows for Server-Side Request Forgery (SSRF) and deserialization attacks. This issue affects all versions prior to 2.0.0. The vulnerability can be exploited even if the isRemoteEnabled option is set to false. It allows attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:52:10.986Z. Updated 2024-11-18T14:35:29.986Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated18 Nov 2024, 21:35 WIB

Official record

MedPublished 15 Nov 2024, 17:52 WIB

CVE-2021-3841

Stored Cross-site Scripting (XSS) in sylius/sylius

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:52:01.371Z. Updated 2024-11-20T22:36:05.302Z.

CVSS4.1v3.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 05:36 WIB

Official record

CritPublished 15 Nov 2024, 17:51 WIB

CVE-2021-3838

PHAR Deserialization in dompdf/dompdf

DomPDF before version 2.0.0 is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_get_contents() function. An attacker who can upload files of any type to the server can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:51:36.766Z. Updated 2024-11-18T14:41:07.247Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated18 Nov 2024, 21:41 WIB

Official record