Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 1981–2000 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

HighPublished 15 Nov 2024, 17:51 WIB

CVE-2021-3742

Server-Side Request Forgery (SSRF) in chatwoot/chatwoot

A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerability allows an attacker to upload an SVG file containing a malicious SSRF payload. When the SVG file is used as an avatar and opened in a new tab, it can trigger the SSRF, potentia…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:51:25.968Z. Updated 2024-11-18T14:53:23.071Z.

CVSS7.9v3.0KEVNot listedEPSSPresentUpdated18 Nov 2024, 21:53 WIB

Official record

HighPublished 15 Nov 2024, 17:51 WIB

CVE-2021-3741

Stored Cross-site Scripting (XSS) in chatwoot/chatwoot

A stored cross-site scripting (XSS) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.6. The vulnerability occurs when a user uploads an SVG file containing a malicious XSS payload in the profile settings. When the avatar is opened in a new page, the custom JavaScript code is executed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1981 to 2000 of 4054.First page Next page

Published 2024-11-15T10:51:22.667Z. Updated 2024-11-20T22:36:41.760Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 05:36 WIB

Official record

MedKEVPublished 15 Nov 2024, 17:43 WIB

CVE-2024-11182

Stored XSS vulnerability in MDaemon Email Server

An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2024-11-15T10:43:10.960Z. Updated 2025-10-21T22:55:36.394Z.

CVSS5.3v4.0KEVListedEPSSPresentUpdated22 Oct 2025, 05:55 WIB

Official record

CritPublished 15 Nov 2024, 17:23 WIB

CVE-2024-10443

CVE-2024-10443

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attackers to execute arbitrary code via unspecified vectors.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T10:23:51.233Z. Updated 2025-09-16T06:02:16.158Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated16 Sep 2025, 13:02 WIB

Official record

HighPublished 15 Nov 2024, 16:29 WIB

CVE-2024-10311

External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass

The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T09:29:40.406Z. Updated 2026-04-08T17:25:44.852Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:25 WIB

Official record

MedPublished 15 Nov 2024, 16:29 WIB

CVE-2024-8978

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Contributor+) Sensitive Information Exposure

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_register_user_email_controls' function. This makes it possible for authenticat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T09:29:39.946Z. Updated 2026-04-08T17:18:18.411Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:18 WIB

Official record

HighPublished 15 Nov 2024, 16:29 WIB

CVE-2024-8979

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.9 - Authenticated (Author+) Sensitive Information Exposure to Privilege Escalation

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.9 via the 'init_content_lostpassword_user_email_controls' function. This makes it possible for authent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T09:29:39.230Z. Updated 2026-04-08T16:45:50.471Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:45 WIB

Official record

UnscoredPublished 15 Nov 2024, 15:20 WIB

CVE-2024-45784

Apache Airflow: Sensitive configuration values are not masked in the logs by default

Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T08:20:05.581Z. Updated 2024-11-15T19:42:27.561Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 02:42 WIB

Official record

MedPublished 15 Nov 2024, 13:48 WIB

CVE-2024-10825

Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL

The Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL in all versions up to, and including, 5.3.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T06:48:04.243Z. Updated 2026-04-08T17:20:39.604Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

MedPublished 15 Nov 2024, 13:48 WIB

CVE-2024-8961

Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders <= 6.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Essential Addons for Elementor – Best Elementor Addon, Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nomore_items_text’ parameter in all versions up to, and including, 6.0.7 due to insufficient input sanitization and output escaping. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T06:48:03.358Z. Updated 2026-04-08T16:49:42.760Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:49 WIB

Official record

UnscoredPublished 15 Nov 2024, 13:00 WIB

CVE-2024-9529

Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution

The Secure Custom Fields WordPress plugin before 6.3.9, Secure Custom Fields WordPress plugin before 6.3.6.3, Advanced Custom Fields Pro WordPress plugin before 6.3.9 does not prevent users from running arbitrary functions through its setting import functionalities, which could allow high privilege users such as admin …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T06:00:08.369Z. Updated 2024-11-15T18:38:37.432Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:38 WIB

Official record

UnscoredPublished 15 Nov 2024, 13:00 WIB

CVE-2024-10104

Jobs for WordPress < 2.7.8 - Contributor+ Stored XSS

The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T06:00:02.677Z. Updated 2024-11-15T18:44:55.432Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:44 WIB

Official record

HighPublished 15 Nov 2024, 12:30 WIB

CVE-2024-10793

WP Activity Log <= 5.2.1 - Unauthenticated Stored Cross-Site Scripting via User_id Parameter

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T05:30:56.843Z. Updated 2026-04-08T16:49:29.220Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:49 WIB

Official record

HighPublished 15 Nov 2024, 12:30 WIB

CVE-2024-10260

Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload

The Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File uploads in all versions up to, and including, 8.0.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wheneve…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T05:30:56.350Z. Updated 2026-04-08T16:46:17.085Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:46 WIB

Official record

MedPublished 15 Nov 2024, 12:30 WIB

CVE-2024-9356

Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site Scripting

The Yotpo: Product & Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'yotpo_user_email' and 'yotpo_user_name' parameters in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T05:30:55.822Z. Updated 2026-04-08T16:44:40.699Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:44 WIB

Official record

MedPublished 15 Nov 2024, 12:30 WIB

CVE-2024-10582

Music Player for Elementor – Audio Player & Podcast Player <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_mpfe_template() function in all versions up to, and including, 2.4.1. This makes it possible for authenticated attackers, with Subscriber…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T05:30:55.318Z. Updated 2026-04-08T16:40:59.742Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:40 WIB

Official record

MedPublished 15 Nov 2024, 12:30 WIB

CVE-2024-10113

WP AdCenter – Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode

The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpadcenter_ad shortcode in all versions up to, and including, 2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T05:30:54.671Z. Updated 2026-04-08T16:33:25.461Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:33 WIB

Official record

MedPublished 15 Nov 2024, 12:26 WIB

CVE-2024-39610

CVE-2024-39610

Cross-site scripting vulnerability exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T05:26:37.148Z. Updated 2024-11-15T17:54:38.148Z.

CVSS6.1v3.0KEVNot listedEPSSPresentUpdated16 Nov 2024, 00:54 WIB

Official record

MedPublished 15 Nov 2024, 12:26 WIB

CVE-2024-42499

CVE-2024-42499

Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T05:26:23.645Z. Updated 2024-11-18T15:17:46.230Z.

CVSS5.3v3.0KEVNot listedEPSSPresentUpdated18 Nov 2024, 22:17 WIB

Official record

MedPublished 15 Nov 2024, 11:29 WIB

CVE-2024-9609

LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting

The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T04:29:05.635Z. Updated 2026-04-08T17:21:22.628Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:21 WIB

Official record