Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates
3,433 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.
CVE-2024-53481
A Cross Site Scripting (XSS) vulnerability in the profile.php of PHPGurukul Beauty Parlour Management System v1.1 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "Firstname" and "Last name" parameters.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-10T00:00:00.000Z. Updated 2026-07-05T00:51:43.564Z.
CVE-2024-53552
CrushFTP 10 before 10.8.3 and 11 before 11.2.3 mishandles password reset, leading to account takeover.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-10T00:00:00.000Z. Updated 2024-12-11T15:26:27.063Z.
CVE-2024-53919
An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, allows physically proximate attackers or local admins to the webUI to trigger OS-level command execution as root.
Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-10T00:00:00.000Z. Updated 2024-12-10T15:43:52.695Z.
CVE-2024-54751
COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-10T00:00:00.000Z. Updated 2024-12-11T15:21:39.183Z.
CVE-2024-55500
Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-10T00:00:00.000Z. Updated 2024-12-11T15:44:09.693Z.
CVE-2024-55550
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to access resources that are constrained to the admin access level, and the disclosur…
Unscored under this view's policy KEV listed. Forecast present in this snapshot.
Published 2024-12-10T00:00:00.000Z. Updated 2026-08-04T03:55:38.112Z.
CVE-2024-55586
Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method. NOTE: the vendor's position is that this is intended behavior.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-10T00:00:00.000Z. Updated 2025-01-06T17:32:57.801Z.
Reflected XSS in PaperCut MF
A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur.
Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T23:49:55.535Z. Updated 2024-12-10T16:08:48.582Z.
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on the si…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T23:26:30.780Z. Updated 2024-12-16T17:11:20.896Z.
Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on th…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T23:25:32.356Z. Updated 2024-12-16T17:10:40.749Z.
Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8. Drupal core contains a chain of methods that is exploitable when an insecure deserialization vulnerability exists on th…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T23:24:27.729Z. Updated 2024-12-16T17:09:36.830Z.
Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 7.0 before 7.102.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T23:23:38.742Z. Updated 2024-12-10T21:18:04.893Z.
Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T23:21:15.943Z. Updated 2024-12-11T16:39:12.440Z.
Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2024-003
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core allows Cross-Site Scripting (XSS).This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T23:20:31.719Z. Updated 2024-12-11T16:37:08.457Z.
CVE-2024-12174
An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged attacker could intercept email messages sent from Security Center via a rogue SMTP server.
Severity low: primary CNA CVSS 2.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T21:38:47.542Z. Updated 2024-12-10T17:14:03.468Z.
Hugo does not escape some attributes in internal templates
Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are using one or more of these …
Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T21:11:10.463Z. Updated 2024-12-10T17:13:48.519Z.
Directus allows unauthenticated access to WebSocket events and operations
Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting `WEBSOCKETS_GRAPHQL_AUTH` or `WEBSOCKETS_REST_AUTH` to "public", an unauthenticated user is able to do any of the supported operations (CRUD, subscriptions) with full adm…
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T20:57:28.365Z. Updated 2024-12-10T17:09:06.417Z.
Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisati…
Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T20:54:41.797Z. Updated 2024-12-10T17:13:11.005Z.
Elytron-oidc-client: oidc authorization code injection
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim…
Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T20:53:09.260Z. Updated 2026-08-04T13:38:06.291Z.
User credentials recorded in log files
User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful explo…
Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-12-09T19:08:15.527Z. Updated 2025-03-21T15:55:47.995Z.