Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 2581–2600 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

CritPublished 14 Jan 2025, 21:21 WIB

CVE-2024-39794

CVE-2024-39794

Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:21:00.375Z. Updated 2025-11-03T21:57:05.248Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39793

CVE-2024-39793

Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2581 to 2600 of 4273.First page Next page

Published 2025-01-14T14:20:59.943Z. Updated 2025-11-03T21:57:03.783Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39360

CVE-2024-39360

An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:59.377Z. Updated 2025-01-14T20:52:33.707Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated15 Jan 2025, 03:52 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39280

CVE-2024-39280

An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:58.776Z. Updated 2025-01-14T20:52:48.000Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated15 Jan 2025, 03:52 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39790

CVE-2024-39790

Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:58.093Z. Updated 2025-11-03T21:57:02.234Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39789

CVE-2024-39789

Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:57.939Z. Updated 2025-11-03T21:57:00.467Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:57 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39788

CVE-2024-39788

Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration injection vulnerabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:57.843Z. Updated 2025-11-03T21:56:58.760Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39787

CVE-2024-39787

Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vulnerability exists w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:57.258Z. Updated 2025-11-03T21:56:57.245Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39786

CVE-2024-39786

Multiple directory traversal vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A directory traversal vulnerability exists w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:57.169Z. Updated 2025-11-03T21:56:55.789Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39785

CVE-2024-39785

Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:56.511Z. Updated 2025-11-03T21:56:54.329Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

CritPublished 14 Jan 2025, 21:20 WIB

CVE-2024-39784

CVE-2024-39784

Multiple command execution vulnerabilities exist in the nas.cgi add_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A command injection vulnerability ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:20:56.336Z. Updated 2025-11-03T21:56:52.883Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:56 WIB

Official record

MedPublished 14 Jan 2025, 21:10 WIB

CVE-2024-32115

CVE-2024-32115

A relative path traversal vulnerability [CWE-23] in Fortinet FortiManager version 7.4.0 through 7.4.2 and before 7.2.5 allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPs requests.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:10:01.318Z. Updated 2025-02-18T21:33:30.403Z.

CVSS5.2v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:33 WIB

Official record

HighPublished 14 Jan 2025, 21:10 WIB

CVE-2024-23106

CVE-2024-23106

An improper restriction of excessive authentication attempts [CWE-307] in FortiClientEMS version 7.2.0 through 7.2.4 and before 7.0.10 allows an unauthenticated attacker to try a brute force attack against the FortiClientEMS console via crafted HTTP or HTTPS requests.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:10:00.950Z. Updated 2025-02-18T21:34:28.472Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:34 WIB

Official record

HighPublished 14 Jan 2025, 21:10 WIB

CVE-2023-37931

CVE-2023-37931

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-88] in FortiVoice Entreprise version 7.0.0 through 7.0.1 and before 6.4.8 allows an authenticated attacker to perform a blind sql injection attack via sending crafted HTTP or HTTPS requests

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:10:00.867Z. Updated 2025-02-18T21:35:20.264Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:35 WIB

Official record

HighPublished 14 Jan 2025, 21:10 WIB

CVE-2024-47571

CVE-2024-47571

An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials.

Excerpt language: en.

Severity high: primary CNA CVSS 7.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:10:00.156Z. Updated 2025-02-18T21:36:03.768Z.

CVSS7.9v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:36 WIB

Official record

HighPublished 14 Jan 2025, 21:09 WIB

CVE-2024-47572

CVE-2024-47572

An improper neutralization of formula elements in a csv file in Fortinet FortiSOAR 7.2.1 through 7.4.1 allows attacker to execute unauthorized code or commands via manipulating csv file

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:09:59.359Z. Updated 2025-02-18T21:36:45.163Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:36 WIB

Official record

MedPublished 14 Jan 2025, 21:09 WIB

CVE-2024-46667

CVE-2024-46667

A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0 through 7.1.5 may allow an attacker to deny valid TLS traffic via consuming all allotted connections.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:09:58.844Z. Updated 2025-02-18T21:37:18.364Z.

CVSS6.9v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:37 WIB

Official record

MedPublished 14 Jan 2025, 21:09 WIB

CVE-2024-36504

CVE-2024-36504

An out-of-bounds read vulnerability [CWE-125] in FortiOS SSLVPN web portal versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, 7.0 all verisons, and 6.4 all versions may allow an authenticated attacker to perform a denial of service on the SSLVPN web portal via a specially crafted URL.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:09:58.824Z. Updated 2025-02-18T21:38:19.515Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:38 WIB

Official record

MedPublished 14 Jan 2025, 21:09 WIB

CVE-2024-21758

CVE-2024-21758

A stack-based buffer overflow in Fortinet FortiWeb versions 7.2.0 through 7.2.7, and 7.4.0 through 7.4.1 may allow a privileged user to execute arbitrary code via specially crafted CLI commands, provided the user is able to evade FortiWeb stack protections.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:09:56.939Z. Updated 2025-02-18T21:38:54.103Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:38 WIB

Official record

MedPublished 14 Jan 2025, 21:09 WIB

CVE-2024-46666

CVE-2024-46666

An allocation of resources without limits or throttling [CWE-770] vulnerability in FortiOS versions 7.6.0, versions 7.4.4 through 7.4.0, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests directed at specific endpo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-14T14:09:56.935Z. Updated 2025-02-18T21:39:30.528Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:39 WIB

Official record