Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 1121–1140 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

UnscoredPublished 18 Dec 2024, 07:00 WIB

CVE-2024-56317

CVE-2024-56317

In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0, the WriteAcl function deletes all existing ACL entries first, and then attempts to recreate them based on user input. If input validation fails during decoding, the process stops, and no entries are restored by access-control-server.cpp, i.e., a denial of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-18T00:00:00.000Z. Updated 2025-01-02T19:14:41.253Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Jan 2025, 02:14 WIB

Official record

UnscoredPublished 18 Dec 2024, 07:00 WIB

CVE-2024-56318

CVE-2024-56318

In raw\TCP.cpp in Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before 27ca6ec, there is a NULL pointer dereference in TCPBase::ProcessSingleMessage via TCP packets with zero messageSize, leading to denial of service.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-18T00:00:00.000Z. Updated 2025-01-02T19:16:54.125Z.

Showing 1121 to 1140 of 3433.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated03 Jan 2025, 02:16 WIB

Official record

UnscoredPublished 18 Dec 2024, 07:00 WIB

CVE-2024-56319

CVE-2024-56319

In Matter (aka connectedhomeip or Project CHIP) through 1.4.0.0 before e3277eb, unlimited user label appends in a userlabel cluster can lead to a denial of service (resource exhaustion).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-18T00:00:00.000Z. Updated 2024-12-31T19:18:02.634Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Jan 2025, 02:18 WIB

Official record

MedPublished 18 Dec 2024, 05:59 WIB

CVE-2024-10973

Keycloak: cli option for encrypted jgroups ignored

A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T22:59:38.518Z. Updated 2026-08-08T17:14:40.206Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated09 Aug 2026, 00:14 WIB

Official record

HighPublished 18 Dec 2024, 05:59 WIB

CVE-2024-9779

Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens

A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which include…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T22:59:07.511Z. Updated 2026-02-25T20:19:36.555Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated26 Feb 2026, 03:19 WIB

Official record

MedPublished 18 Dec 2024, 04:46 WIB

CVE-2024-52792

Arbitrary config values override in lam

LDAP Account Manager (LAM) is a php webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In affected versions LAM does not properly sanitize configuration values, that are set via `mainmanage.php` and `confmain.php`. This allows setting arbitrary config values and thus effec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T21:46:27.319Z. Updated 2024-12-18T15:37:01.733Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 22:37 WIB

Official record

MedPublished 18 Dec 2024, 04:41 WIB

CVE-2024-56142

Path Traversal in pghoard

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. A vulnerability has been discovered that could allow an attacker to acquire disk access with privileges equivalent to those of pghoard, allowing for unintended path traversal. Depending on the permissions/privilege…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T21:41:13.309Z. Updated 2024-12-18T15:40:33.245Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated18 Dec 2024, 22:40 WIB

Official record

MedPublished 18 Dec 2024, 04:30 WIB

CVE-2023-37940

CVE-2023-37940

Cross-site scripting (XSS) vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T21:30:39.730Z. Updated 2024-12-17T21:41:38.543Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 04:41 WIB

Official record

MedPublished 18 Dec 2024, 03:50 WIB

CVE-2024-12539

Elasticsearch Incorrect Authorization

An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T20:50:04.968Z. Updated 2024-12-17T21:23:57.366Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated18 Dec 2024, 04:23 WIB

Official record

MedPublished 18 Dec 2024, 03:24 WIB

CVE-2024-11993

CVE-2024-11993

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T20:24:42.600Z. Updated 2025-03-28T20:04:56.591Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated29 Mar 2025, 03:04 WIB

Official record

MedPublished 18 Dec 2024, 01:32 WIB

CVE-2024-56139

A stack overflow Segmentation Fault (SEGV) and Memory Leak in pdftools

pdftools is a high level tools to convert PDF files to ePUB formats. In versions up to and including 0.5.0 maliciously crafted epub files can cause a stack overflow leading to a crash. This issue has not yet been addressed and users are advised to avoid untrusted input to their systems.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T18:32:18.011Z. Updated 2024-12-20T20:58:09.933Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated21 Dec 2024, 03:58 WIB

Official record

HighPublished 18 Dec 2024, 01:13 WIB

CVE-2024-51479

Authorization bypass in Next.js

Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected]…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T18:13:02.806Z. Updated 2024-12-17T20:36:28.402Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 03:36 WIB

Official record

MedPublished 18 Dec 2024, 00:42 WIB

CVE-2024-49816

IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T17:42:55.387Z. Updated 2024-12-17T20:37:28.513Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 03:37 WIB

Official record

LowPublished 18 Dec 2024, 00:42 WIB

CVE-2024-49820

IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T17:42:14.257Z. Updated 2024-12-17T20:37:34.046Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 03:37 WIB

Official record

MedPublished 18 Dec 2024, 00:41 WIB

CVE-2024-49819

IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T17:41:27.693Z. Updated 2024-12-17T20:37:40.846Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 03:37 WIB

Official record

MedPublished 18 Dec 2024, 00:35 WIB

CVE-2024-49818

IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T17:35:47.807Z. Updated 2024-12-17T20:37:49.263Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 03:37 WIB

Official record

MedPublished 18 Dec 2024, 00:34 WIB

CVE-2024-49817

IBM Security Guardium Key Lifecycle Manager information disclosure

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged user.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T17:34:11.065Z. Updated 2024-12-17T20:37:54.298Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 03:37 WIB

Official record

LowPublished 18 Dec 2024, 00:28 WIB

CVE-2024-42194

HCL BigFix Inventory is affected by an access control vulnerability

An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T17:28:24.872Z. Updated 2024-12-17T20:37:59.293Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated18 Dec 2024, 03:37 WIB

Official record

HighPublished 17 Dec 2024, 22:55 WIB

CVE-2024-53144

Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 ("Bluetooth: Always request for user confirmation for Just Works") always request user confirmation with confirm_hint …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T15:55:03.394Z. Updated 2026-10-15T21:41:46.651Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

HighPublished 17 Dec 2024, 22:28 WIB

CVE-2024-12671

DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software

A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-17T15:28:48.438Z. Updated 2025-08-26T17:17:18.928Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 00:17 WIB

Official record