Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 2421–2440 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 10 Dec 2024, 01:55 WIB

CVE-2024-54147

Altair GraphQL Client's desktop app does not validate HTTPS certificates

Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not validate HTTPS certificates allowing a man-in-the-middle to intercept all requests. Any Altair users on untrusted networks (eg. public wifi, malicious DNS servers) may have all GraphQL request and response…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T18:55:58.277Z. Updated 2024-12-10T16:10:09.765Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 23:10 WIB

Official record

MedPublished 10 Dec 2024, 01:49 WIB

CVE-2024-53847

Trix vulnerable to Cross-site Scripting on copy & paste

The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2421 to 2440 of 3433.First page Next page

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T18:49:37.339Z. Updated 2024-12-10T16:15:40.972Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 23:15 WIB

Official record

MedPublished 10 Dec 2024, 01:41 WIB

CVE-2024-52599

Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T18:41:35.060Z. Updated 2024-12-10T16:17:35.774Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 23:17 WIB

Official record

MedPublished 10 Dec 2024, 01:38 WIB

CVE-2024-52586

eLabFTW MFA bypass

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to version 5.1.0 that allows an attacker to bypass eLabFTW's built-in multifactor authentication mechanism. An attacker who can authenticate locally (by knowing or guessing the passwor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T18:38:42.856Z. Updated 2024-12-10T16:20:39.487Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 23:20 WIB

Official record

HighPublished 10 Dec 2024, 00:53 WIB

CVE-2024-11608

CVE-2024-11608

A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T17:53:18.804Z. Updated 2025-08-28T14:38:16.647Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 21:38 WIB

Official record

HighPublished 10 Dec 2024, 00:48 WIB

CVE-2024-11454

Untrusted Search Path vulnerability in Autodesk Revit

A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T17:48:30.983Z. Updated 2025-08-28T14:35:08.803Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 21:35 WIB

Official record

MedPublished 10 Dec 2024, 00:42 WIB

CVE-2024-11268

PDF File Parsing Vulnerability in Autodesk Revit

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read. A malicious actor can leverage this vulnerability to cause a crash or could lead to an arbitrary memory leak.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T17:42:15.362Z. Updated 2025-08-26T16:51:06.761Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated26 Aug 2025, 23:51 WIB

Official record

MedPublished 09 Dec 2024, 23:17 WIB

CVE-2024-45760

CVE-2024-45760

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. A remote low privileged user could potentially exploit this vulnerability via the HTTP GET method leading to unauthorized action with elevated privileges.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T16:17:41.785Z. Updated 2024-12-09T17:55:44.493Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 00:55 WIB

Official record

MedPublished 09 Dec 2024, 23:12 WIB

CVE-2024-45761

CVE-2024-45761

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of certain apps/OS or Deni…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T16:12:46.569Z. Updated 2024-12-09T17:56:08.151Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 00:56 WIB

Official record

MedPublished 09 Dec 2024, 22:09 WIB

CVE-2023-7298

Out-of-Bounds Write Vulnerability in in Autodesk Desktop Software

A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T15:09:34.167Z. Updated 2025-08-18T20:14:57.902Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated19 Aug 2025, 03:14 WIB

Official record

HighPublished 09 Dec 2024, 21:56 WIB

CVE-2024-49600

CVE-2024-49600

Dell Power Manager (DPM), versions prior to 3.17, contain an improper access control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T14:56:34.237Z. Updated 2024-12-10T16:47:12.869Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 23:47 WIB

Official record

MedPublished 09 Dec 2024, 21:46 WIB

CVE-2024-38485

CVE-2024-38485

Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerability to trigger redirections that leads to sensitive information leakage.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T14:46:33.460Z. Updated 2024-12-09T15:04:10.451Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Dec 2024, 22:04 WIB

Official record

MedPublished 09 Dec 2024, 21:38 WIB

CVE-2024-42426

CVE-2024-42426

Dell PowerScale OneFS Versions 9.5.0.x through 9.8.0.x contain an uncontrolled resource consumption vulnerability. A low privilege remote attacker could potentially exploit this vulnerability, leading to denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T14:38:33.650Z. Updated 2024-12-09T15:05:07.664Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Dec 2024, 22:05 WIB

Official record

MedPublished 09 Dec 2024, 21:38 WIB

CVE-2024-11991

Uninitialized memory access in Motoko incremental garbage collector

Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few locations. This vulnerability could potentially allow unauthorized read or write access to a Canister's memory. However, exploiting this bug requires the Canister to enable the in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T14:38:07.288Z. Updated 2024-12-09T15:07:37.640Z.

CVSS5.6v3.1KEVNot listedEPSSPresentUpdated09 Dec 2024, 22:07 WIB

Official record

MedPublished 09 Dec 2024, 21:29 WIB

CVE-2024-49603

CVE-2024-49603

Dell PowerScale OneFS Versions 8.2.2.x through 9.9.0.x contain an incorrect specified argument vulnerability. A remote low privileged legitimate user could potentially exploit this vulnerability, leading to information disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T14:29:49.906Z. Updated 2024-12-09T15:08:22.547Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Dec 2024, 22:08 WIB

Official record

MedPublished 09 Dec 2024, 21:22 WIB

CVE-2024-49602

CVE-2024-49602

Dell PowerScale OneFS Versions 8.2.2.x through 9.8.0.x contain an improper resource unlocking vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T14:22:58.153Z. Updated 2024-12-09T14:56:32.732Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Dec 2024, 21:56 WIB

Official record

HighPublished 09 Dec 2024, 20:35 WIB

CVE-2024-53949

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T13:35:41.530Z. Updated 2025-02-12T09:34:57.804Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated12 Feb 2025, 16:34 WIB

Official record

MedPublished 09 Dec 2024, 20:35 WIB

CVE-2024-53948

Apache Superset: Error verbosity exposes metadata in analytics databases

Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T13:35:30.932Z. Updated 2024-12-09T18:03:42.140Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 01:03 WIB

Official record

LowPublished 09 Dec 2024, 20:35 WIB

CVE-2024-53947

Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disall…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T13:35:09.910Z. Updated 2024-12-09T15:05:21.361Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated09 Dec 2024, 22:05 WIB

Official record

CritPublished 09 Dec 2024, 20:23 WIB

CVE-2024-8259

Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was contacted and it was…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T13:23:06.505Z. Updated 2026-06-02T08:22:47.232Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 15:22 WIB

Official record