Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 2641–2660 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 09 Dec 2024, 10:29 WIB

CVE-2024-53280

CVE-2024-53280

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing non-sensitive i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T03:29:56.369Z. Updated 2025-08-01T05:25:42.229Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated01 Aug 2025, 12:25 WIB

Official record

MedPublished 09 Dec 2024, 08:31 WIB

CVE-2024-12355

SourceCodester Phone Contact Manager System ContactBook.cpp adding input validation

A vulnerability has been found in SourceCodester Phone Contact Manager System 1.0 and classified as problematic. Affected by this vulnerability is the function ContactBook::adding of the file ContactBook.cpp. The manipulation leads to improper input validation. The attack needs to be approached locally. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2641 to 2660 of 3433.First page Next page

Published 2024-12-09T01:31:07.752Z. Updated 2024-12-12T13:45:10.433Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Dec 2024, 20:45 WIB

Official record

MedPublished 09 Dec 2024, 08:31 WIB

CVE-2024-12354

SourceCodester Phone Contact Manager System User Menu MenuDisplayStart buffer overflow

A vulnerability, which was classified as critical, was found in SourceCodester Phone Contact Manager System 1.0. Affected is the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation leads to buffer overflow. It is possible to launch the attack on the local host. The exploit has been dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T01:31:05.768Z. Updated 2024-12-09T20:12:30.989Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 03:12 WIB

Official record

MedPublished 09 Dec 2024, 08:00 WIB

CVE-2024-12353

SourceCodester Phone Contact Manager System User Menu MenuDisplayStart input validation

A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation of the argument name leads to improper input validation. Attacking locally is a requiremen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T01:00:19.368Z. Updated 2024-12-12T13:45:05.477Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated12 Dec 2024, 20:45 WIB

Official record

MedPublished 09 Dec 2024, 08:00 WIB

CVE-2024-12352

TOTOLINK EX1800T cstecgi.cgi sub_40662C stack-based overflow

A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T01:00:16.961Z. Updated 2024-12-09T20:19:48.365Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 03:19 WIB

Official record

MedPublished 09 Dec 2024, 07:31 WIB

CVE-2024-12351

JFinalCMS File Content ContentModel.java findPage sql injection

A vulnerability classified as critical has been found in JFinalCMS 1.0. This affects the function findPage of the file src\main\java\com\cms\entity\ContentModel.java of the component File Content Handler. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:31:06.456Z. Updated 2024-12-10T14:09:20.540Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 21:09 WIB

Official record

MedPublished 09 Dec 2024, 07:31 WIB

CVE-2024-12350

JFinalCMS Template TemplateController.java update command injection

A vulnerability was found in JFinalCMS 1.0. It has been rated as critical. Affected by this issue is the function update of the file \src\main\java\com\cms\controller\admin\TemplateController.java of the component Template Handler. The manipulation of the argument content leads to command injection. The attack may be l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:31:05.003Z. Updated 2024-12-09T15:33:39.069Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated09 Dec 2024, 22:33 WIB

Official record

MedPublished 09 Dec 2024, 07:00 WIB

CVE-2024-12349

JFinalCMS save cross-site request forgery

A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:16.701Z. Updated 2024-12-09T17:57:33.573Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 00:57 WIB

Official record

MedPublished 09 Dec 2024, 07:00 WIB

CVE-2024-12348

Guizhou Xiaoma Technology jpress Attachment Upload upload AttachmentUtils.isUnSafe cross site scripting

A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe of the file /commons/attachment/upload of the component Attachment Upload Handler. The manipulation of the argument files[] leads to cross site scripting. It is p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:12.081Z. Updated 2024-12-09T17:59:35.372Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 00:59 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2022-29974

CVE-2022-29974

AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. This driver is, for example, used in certain ASUS devices.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-12T16:52:06.691Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 23:52 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2022-38946

CVE-2022-38946

Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary code.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-11T15:56:32.684Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Dec 2024, 22:56 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2022-38947

CVE-2022-38947

SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary code.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-11T15:58:03.452Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Dec 2024, 22:58 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2023-43962

CVE-2023-43962

Cross Site Scripting vulnerability in Xunrui CMS Public Edition v.4.6.1 allows a remote attacker to execute arbitrary code via the project name function in the project settings tab.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-11T20:38:34.921Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 03:38 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2024-40582

CVE-2024-40582

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2026-07-05T17:41:23.886Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Jul 2026, 00:41 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2024-40583

CVE-2024-40583

Pentaminds CuroVMS v2.0.1 was discovered to contain exposed credentials.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2026-07-05T17:40:44.870Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Jul 2026, 00:40 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2024-46455

CVE-2024-46455

unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-11T20:29:44.658Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 03:29 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2024-46547

CVE-2024-46547

A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access sensitive information due to improper access control validation via PHP Info Page. This issue can lead to data leaks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-11T15:46:58.242Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Dec 2024, 22:46 WIB

Official record

CritPublished 09 Dec 2024, 07:00 WIB

CVE-2024-48956

CVE-2024-48956

Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a service endpoint resulting in remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2025-08-27T21:33:04.129Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 04:33 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2024-50625

CVE-2024-50625

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-11T20:52:29.818Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 03:52 WIB

Official record

UnscoredPublished 09 Dec 2024, 07:00 WIB

CVE-2024-50626

CVE-2024-50626

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This allows an attacker on the local area network to manipulate URLs to include traversal sequences, potentially leading to unauthorized access to data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-09T00:00:00.000Z. Updated 2024-12-11T20:58:07.627Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 03:58 WIB

Official record