Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 101–120 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

UnscoredPublished 31 Dec 2024, 13:00 WIB

CVE-2024-11972

Hunk Companion < 1.9.0 - Unauthenticated Plugin Installation

The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk Companion WordPress plugin before 1.9.0 that have…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-31T06:00:01.751Z. Updated 2024-12-31T18:14:10.608Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Jan 2025, 01:14 WIB

Official record

HighPublished 31 Dec 2024, 09:19 WIB

CVE-2024-45497

Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials

A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories. The mount is not read-o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 101 to 120 of 3433.First page Next page

Published 2024-12-31T02:19:22.553Z. Updated 2026-09-21T17:11:18.064Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated22 Sep 2026, 00:11 WIB

Official record

HighPublished 31 Dec 2024, 08:35 WIB

CVE-2024-13040

Quanta Computer QOCA aim - Authorization Bypass

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to privilege escalation.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-31T01:35:20.576Z. Updated 2024-12-31T15:54:48.243Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated31 Dec 2024, 22:54 WIB

Official record

HighPublished 31 Dec 2024, 08:32 WIB

CVE-2024-12839

Changing Information Technology CGFIDO - Authentication Bypass

The login mechanism via device authentication of CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability. If a user visits a forged website, the agent program deployed on their device will send an authentication signature to the website. An unauthenticated remote attacker who obtains this…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-31T01:32:11.422Z. Updated 2024-12-31T15:56:18.203Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated31 Dec 2024, 22:56 WIB

Official record

HighPublished 31 Dec 2024, 08:24 WIB

CVE-2024-12838

Changing Information Technology CGFIDO - Authentication Bypass

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request to switch to the identity of any user, including administrators.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-31T01:24:48.680Z. Updated 2024-12-31T15:56:46.585Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated31 Dec 2024, 22:56 WIB

Official record

MedPublished 31 Dec 2024, 05:08 WIB

CVE-2024-13058

Authenticated, non-admin users can create storage pools via the sifi API

An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) softw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T22:08:31.690Z. Updated 2025-08-29T18:46:07.069Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated30 Aug 2025, 01:46 WIB

Official record

MedPublished 31 Dec 2024, 04:00 WIB

CVE-2024-13042

Tsinghua Unigroup Electronic Archives Management System download.html download information disclosure

A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file /Searchnew/Subject/download.html. The manipulation of the argument path leads to information disclosure. It is possible to launch t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T21:00:15.420Z. Updated 2025-01-04T12:25:07.682Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Jan 2025, 19:25 WIB

Official record

HighPublished 31 Dec 2024, 03:16 WIB

CVE-2024-13051

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a mal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:16:19.818Z. Updated 2024-12-30T23:01:24.150Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:01 WIB

Official record

HighPublished 31 Dec 2024, 03:16 WIB

CVE-2024-13050

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a mal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:16:14.569Z. Updated 2024-12-30T23:01:36.394Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:01 WIB

Official record

HighPublished 31 Dec 2024, 03:16 WIB

CVE-2024-13049

Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:16:09.642Z. Updated 2024-12-30T23:01:51.565Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:01 WIB

Official record

HighPublished 31 Dec 2024, 03:16 WIB

CVE-2024-13048

Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:16:05.399Z. Updated 2024-12-30T23:04:26.755Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:04 WIB

Official record

HighPublished 31 Dec 2024, 03:16 WIB

CVE-2024-13047

Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or op…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:16:00.886Z. Updated 2024-12-30T23:04:50.456Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:04 WIB

Official record

HighPublished 31 Dec 2024, 03:15 WIB

CVE-2024-13046

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:15:57.048Z. Updated 2024-12-30T23:05:10.576Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:05 WIB

Official record

HighPublished 31 Dec 2024, 03:15 WIB

CVE-2024-13045

Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:15:52.759Z. Updated 2024-12-30T23:05:24.920Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:05 WIB

Official record

HighPublished 31 Dec 2024, 03:15 WIB

CVE-2024-13044

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:15:47.208Z. Updated 2024-12-30T23:05:38.421Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:05 WIB

Official record

MedPublished 31 Dec 2024, 03:14 WIB

CVE-2024-12753

Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability

Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:14:13.391Z. Updated 2025-01-09T19:26:22.102Z.

CVSS6.7v3.0KEVNot listedEPSSPresentUpdated10 Jan 2025, 02:26 WIB

Official record

HighPublished 31 Dec 2024, 03:13 WIB

CVE-2024-12752

Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability

Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:13:55.716Z. Updated 2025-01-01T04:56:26.938Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated01 Jan 2025, 11:56 WIB

Official record

HighPublished 31 Dec 2024, 03:13 WIB

CVE-2024-12751

Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability

Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malici…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:13:40.610Z. Updated 2025-01-01T04:56:28.195Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated01 Jan 2025, 11:56 WIB

Official record

HighPublished 31 Dec 2024, 03:12 WIB

CVE-2024-13043

Panda Security Dome Link Following Local Privilege Escalation Vulnerability

Panda Security Dome Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerabi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:12:46.300Z. Updated 2024-12-30T23:05:54.331Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:05 WIB

Official record

LowPublished 31 Dec 2024, 03:12 WIB

CVE-2024-11946

iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability

iXsystems TrueNAS CORE fetch_plugin_packagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerabili…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:12:23.839Z. Updated 2024-12-30T22:59:36.554Z.

CVSS3.1v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 05:59 WIB

Official record