Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates
3,433 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.
CVE-2024-44300
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access protected user data.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:38.423Z. Updated 2026-04-02T18:13:05.112Z.
CVE-2024-44245
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, visionOS 2.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:37.431Z. Updated 2026-04-02T18:13:01.199Z.
CVE-2024-54479
The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:33.957Z. Updated 2026-04-02T18:12:53.903Z.
CVE-2024-44212
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Cookies belonging to one origin may be sent to another origin.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:27.473Z. Updated 2026-04-02T18:12:49.690Z.
CVE-2024-54491
The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. A malicious application may be able to determine a user's current location.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:26.436Z. Updated 2026-04-02T18:10:38.923Z.
CVE-2024-44242
The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:24.128Z. Updated 2026-04-02T18:10:30.665Z.
CVE-2024-54501
The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted file may lead to a denial of service.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:23.127Z. Updated 2026-04-02T18:09:54.539Z.
CVE-2024-54500
The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted image may result in disclosure of process memory.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:16.525Z. Updated 2026-04-02T18:09:16.567Z.
CVE-2024-44243
A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.3. An app may be able to modify protected parts of the file system.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:57:08.325Z. Updated 2026-04-02T18:08:47.737Z.
CVE-2024-54490
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Sequoia 15.2. A local attacker may gain access to user's Keychain items.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:56:58.627Z. Updated 2026-04-02T18:08:44.545Z.
CVE-2024-54486
The issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing a maliciously crafted font may result in the disclosure of process memory.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:56:57.968Z. Updated 2026-04-02T18:08:21.515Z.
CVE-2024-54465
A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:56:56.616Z. Updated 2026-04-02T18:07:15.632Z.
SiYuan has an SSTI via /api/template/renderSprig
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's `/api/template/renderSprig` endpoint is vulnerable to Server-Side Template Injection (SSTI) through the Sprig template engine. Although the engine has limitations, it allows attackers to access environment variables. Version 3.1.16 cont…
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:54:52.564Z. Updated 2024-12-12T16:29:14.433Z.
SiYuan has an arbitrary file write in the host via /api/asset/upload
SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:53:45.983Z. Updated 2024-12-12T16:29:46.007Z.
SiYuan has an arbitrary file read and path traversal via /api/export/exportResources
SiYuan is a personal knowledge management system. Prior to version 3.1.16, SiYuan's /api/export/exportResources endpoint is vulnerable to arbitary file read via path traversal. It is possible to manipulate the paths parameter to access and download arbitrary files from the host system by traversing the workspace direct…
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:47:21.809Z. Updated 2024-12-12T16:30:20.341Z.
SiYuan has an arbitrary file read via /api/template/render
SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/render` endpoint. The absence of proper validation on the path parameter allows attackers to access sensitive files on the host system. Version 3.1.16 contains a patch for th…
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:44:17.868Z. Updated 2024-12-12T16:30:52.826Z.
PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters
PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template doc…
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:41:16.664Z. Updated 2024-12-12T16:32:39.666Z.
AES/CBC Constant IV Vulnerability in ESPTouch v2
ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's l…
Severity medium: primary CNA CVSS 6.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:35:48.528Z. Updated 2024-12-12T16:35:00.685Z.
code-projects Online Class and Exam Scheduling System teacher_save.php sql injection
A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /pages/teacher_save.php. The manipulation of the argument salut leads to sql injection. The attack can be initiated remotely. The exploit has been…
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:31:05.614Z. Updated 2024-12-12T16:31:44.865Z.
GHSL-2024-111: Reflected XSS in /home in habitica
Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the v…
Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-11T22:16:31.855Z. Updated 2024-12-12T15:54:17.865Z.