Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 2521–2540 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 14 Jan 2025, 23:31 WIB

CVE-2025-0462

Shanghai Lingdang Information Technology Lingdang CRM index.php sql injection

A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the argument searchcontent…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T16:31:05.486Z. Updated 2025-01-14T16:53:00.271Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:53 WIB

Official record

UnscoredPublished 14 Jan 2025, 23:13 WIB

CVE-2024-45627

Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability

In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2521 to 2540 of 4273.First page Next page

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T16:13:20.135Z. Updated 2025-01-14T17:19:09.863Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Jan 2025, 00:19 WIB

Official record

MedPublished 14 Jan 2025, 23:00 WIB

CVE-2025-0461

Shanghai Lingdang Information Technology Lingdang CRM index.php path traversal

A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The manipulation of…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T16:00:19.736Z. Updated 2025-01-14T16:38:30.241Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:38 WIB

Official record

MedPublished 14 Jan 2025, 23:00 WIB

CVE-2025-0460

Blog Botz for Journal Theme blog_add unrestricted upload

A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The explo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T16:00:17.534Z. Updated 2025-01-14T16:39:20.230Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:39 WIB

Official record

MedPublished 14 Jan 2025, 23:00 WIB

CVE-2024-29980

Unsafe Handling of IHV UEFI Variables

Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T16:00:15.300Z. Updated 2025-07-28T20:54:33.057Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:54 WIB

Official record

MedPublished 14 Jan 2025, 23:00 WIB

CVE-2024-29979

Unsafe Handling of Phoenix UEFI Variables

Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T16:00:15.221Z. Updated 2025-07-28T20:55:13.618Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated29 Jul 2025, 03:55 WIB

Official record

MedPublished 14 Jan 2025, 22:31 WIB

CVE-2025-0459

libretro RetroArch Startup profapi.dll untrusted search path

A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approached locally. The vendo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T15:31:05.312Z. Updated 2025-01-14T16:42:46.314Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:42 WIB

Official record

MedPublished 14 Jan 2025, 22:31 WIB

CVE-2025-0458

Virtual Computer Vysual RH Solution Login Panel index.php cross site scripting

A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Panel. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T15:31:04.096Z. Updated 2025-01-14T16:43:09.687Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:43 WIB

Official record

HighPublished 14 Jan 2025, 22:00 WIB

CVE-2024-42444

TOCTOU Race Condition between DMA and SMM

APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to execution of arbitrary code on the target device.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T15:00:42.112Z. Updated 2025-01-14T15:45:23.217Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 22:45 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-34166

CVE-2024-34166

An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An attacker can send an HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:36.712Z. Updated 2025-01-14T16:03:43.964Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:03 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39363

CVE-2024-39363

A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:36.160Z. Updated 2025-01-14T16:04:05.647Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:04 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39761

CVE-2024-39761

Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:35.624Z. Updated 2025-11-03T21:56:36.722Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39760

CVE-2024-39760

Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:35.515Z. Updated 2025-11-03T21:56:35.267Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39759

CVE-2024-39759

Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger these vulnerabilities.A command injection vulnera…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:35.431Z. Updated 2025-11-03T21:56:33.812Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-36290

CVE-2024-36290

A buffer overflow vulnerability exists in the login.cgi Goto_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:34.838Z. Updated 2025-01-14T16:03:48.410Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 23:03 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39765

CVE-2024-39765

Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:34.206Z. Updated 2025-11-03T21:56:42.683Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39764

CVE-2024-39764

Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:34.112Z. Updated 2025-11-03T21:56:41.244Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39763

CVE-2024-39763

Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:34.018Z. Updated 2025-11-03T21:56:39.776Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39762

CVE-2024-39762

Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:33.911Z. Updated 2025-11-03T21:56:38.261Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39288

CVE-2024-39288

A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:33.397Z. Updated 2025-01-15T21:11:49.152Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated16 Jan 2025, 04:11 WIB

Official record