Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 121–140 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

HighPublished 31 Dec 2024, 03:12 WIB

CVE-2024-11944

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability

iXsystems TrueNAS CORE tarfile.extractall Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of iXsystems TrueNAS devices. Authentication is not required to exploit this vulnerability. The specific flaw exist…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T20:12:12.970Z. Updated 2024-12-30T23:06:10.269Z.

CVSS7.5v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:06 WIB

Official record

HighPublished 31 Dec 2024, 01:23 WIB

CVE-2024-56800

Firecrawl has SSRF Vulnerability via malicious scrape target

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery (SSRF) vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address. This allowed exfiltra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 121 to 140 of 3433.First page Next page

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T18:23:42.286Z. Updated 2024-12-30T23:13:14.193Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:13 WIB

Official record

CritPublished 31 Dec 2024, 01:20 WIB

CVE-2024-56799

Simofa Allows Unauthenticated Access to API Routes

Simofa is a tool to help automate static website building and deployment. Prior to version 0.2.7, due to a design mistake in the RouteLoader class, some API routes may be publicly accessible when they should require authentication. This vulnerability has been patched in v0.2.7.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T18:20:00.532Z. Updated 2024-12-30T23:14:04.231Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:14 WIB

Official record

MedPublished 31 Dec 2024, 01:10 WIB

CVE-2024-56801

Tasklists has Blind SQL Injection in /ajax/reorder.php

Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 have a blind SQL injection vulnerability. Version 2.0.4 contains a patch for the vulnerability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T18:10:39.172Z. Updated 2024-12-30T23:38:25.303Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 06:38 WIB

Official record

MedPublished 30 Dec 2024, 23:51 WIB

CVE-2024-12754

AnyDesk Link Following Information Disclosure Vulnerability

AnyDesk Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specif…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:51:19.468Z. Updated 2024-12-31T19:09:11.684Z.

CVSS5.5v3.0KEVNot listedEPSSPresentUpdated01 Jan 2025, 02:09 WIB

Official record

HighPublished 30 Dec 2024, 23:50 WIB

CVE-2024-12836

Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability

Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit this vulnerability in that the target must visit a mal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:50:06.133Z. Updated 2024-12-31T21:25:33.771Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated01 Jan 2025, 04:25 WIB

Official record

HighPublished 30 Dec 2024, 23:49 WIB

CVE-2024-12835

Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit this vulnerability in that the target must visit …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:49:19.241Z. Updated 2024-12-31T21:26:56.145Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated01 Jan 2025, 04:26 WIB

Official record

HighPublished 30 Dec 2024, 23:49 WIB

CVE-2024-12834

Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability

Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics DRASimuCAD. User interaction is required to exploit this vulnerability in that the target must visit a mal…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:49:00.911Z. Updated 2024-12-31T21:30:07.548Z.

CVSS7.8v3.0KEVNot listedEPSSPresentUpdated01 Jan 2025, 04:30 WIB

Official record

HighPublished 30 Dec 2024, 23:48 WIB

CVE-2024-56734

Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint

Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Better Auth prior to v1.1.6, potentially allowing attackers to redirect users to malicious websites. This issue affects users relying on email verification links ge…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:48:58.184Z. Updated 2024-12-30T17:36:51.332Z.

CVSS7.9v4.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 00:36 WIB

Official record

CritPublished 30 Dec 2024, 23:48 WIB

CVE-2024-12828

Webmin CGI Command Injection Remote Code Execution Vulnerability

Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:48:13.347Z. Updated 2024-12-30T17:35:11.375Z.

CVSS9.9v3.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 00:35 WIB

Official record

MedPublished 30 Dec 2024, 23:46 WIB

CVE-2024-56733

Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token is replaced and invalid…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:46:37.661Z. Updated 2024-12-30T17:33:25.498Z.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated31 Dec 2024, 00:33 WIB

Official record

MedPublished 30 Dec 2024, 23:36 WIB

CVE-2024-56517

LGSL has a reflected XSS at /lgsl_files/lgsl_list.php

LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the `Referer` HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the HTML response withou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:36:08.785Z. Updated 2024-12-30T17:22:50.748Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Dec 2024, 00:22 WIB

Official record

MedPublished 30 Dec 2024, 23:19 WIB

CVE-2024-56516

free-one-api uses md5 for password storage

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:19:47.571Z. Updated 2024-12-30T16:48:21.594Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated30 Dec 2024, 23:48 WIB

Official record

MedPublished 30 Dec 2024, 23:14 WIB

CVE-2024-52294

khoj has an IDOR in subscription management that allows unauthorized subscription modifications

Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in the update_subscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. The vulnerabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T16:14:35.767Z. Updated 2024-12-30T16:52:29.814Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated30 Dec 2024, 23:52 WIB

Official record

HighPublished 30 Dec 2024, 20:41 WIB

CVE-2024-54181

IBM WebSphere Automation command injection

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T13:41:57.834Z. Updated 2024-12-30T14:12:56.069Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:12 WIB

Official record

CritPublished 30 Dec 2024, 18:47 WIB

CVE-2024-10044

SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unau…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T11:47:46.995Z. Updated 2024-12-30T14:13:58.433Z.

CVSS9.3v3.0KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:13 WIB

Official record

MedPublished 30 Dec 2024, 18:01 WIB

CVE-2024-12993

Location information exposure in Infinix Weather app

Infinix devices contain a pre-loaded "com.rlk.weathers" application, that exposes an unsecured content provider. An attacker can communicate with the provider and reveal the user’s location without any privileges. After multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affect…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T11:01:17.600Z. Updated 2024-12-30T14:14:56.228Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:14 WIB

Official record

CritPublished 30 Dec 2024, 17:06 WIB

CVE-2024-47926

Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T10:06:57.531Z. Updated 2024-12-30T14:15:40.179Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:15 WIB

Official record

HighPublished 30 Dec 2024, 17:05 WIB

CVE-2024-47925

Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T10:05:37.933Z. Updated 2024-12-30T14:19:05.295Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:19 WIB

Official record

HighPublished 30 Dec 2024, 17:04 WIB

CVE-2024-47924

Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-30T10:04:03.164Z. Updated 2024-12-30T14:19:47.386Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated30 Dec 2024, 21:19 WIB

Official record