Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 2761–2780 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 06 Dec 2024, 23:35 WIB

CVE-2024-48859

QTS, QuTS hero

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and later …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T16:35:58.818Z. Updated 2024-12-06T19:38:38.778Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated07 Dec 2024, 02:38 WIB

Official record

MedPublished 06 Dec 2024, 23:35 WIB

CVE-2024-50404

Qsync Central

A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: Qsync Central 4.4.0.16_20240819 ( 20…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2761 to 2780 of 3433.First page Next page

Published 2024-12-06T16:35:52.266Z. Updated 2024-12-06T19:28:37.668Z.

CVSS6.8v4.0KEVNot listedEPSSPresentUpdated07 Dec 2024, 02:28 WIB

Official record

CritPublished 06 Dec 2024, 23:35 WIB

CVE-2024-50389

QuRouter

A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later

Excerpt language: en.

Severity critical: primary CNA CVSS 9.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T16:35:45.704Z. Updated 2024-12-06T19:39:20.514Z.

CVSS9.5v4.0KEVNot listedEPSSPresentUpdated07 Dec 2024, 02:39 WIB

Official record

CritPublished 06 Dec 2024, 23:35 WIB

CVE-2024-50387

SMB Service

A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: SMB Service 4.15.002 and later SMB Service h4.15.002 and later

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T16:35:38.061Z. Updated 2024-12-06T19:55:29.687Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated07 Dec 2024, 02:55 WIB

Official record

CritPublished 06 Dec 2024, 23:35 WIB

CVE-2024-50388

HBS 3 Hybrid Backup Sync

An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 25.1.1.673 and later

Excerpt language: en.

Severity critical: primary CNA CVSS 9.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T16:35:07.434Z. Updated 2024-12-06T19:59:55.053Z.

CVSS9.5v4.0KEVNot listedEPSSPresentUpdated07 Dec 2024, 02:59 WIB

Official record

HighPublished 06 Dec 2024, 23:34 WIB

CVE-2024-53691

QTS, QuTS hero

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.1.8.2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T16:34:54.018Z. Updated 2025-01-24T04:55:42.067Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Jan 2025, 11:55 WIB

Official record

CritPublished 06 Dec 2024, 23:14 WIB

CVE-2024-54143

openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection

openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious image can be served in p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T16:14:39.169Z. Updated 2024-12-06T20:54:32.538Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated07 Dec 2024, 03:54 WIB

Official record

HighPublished 06 Dec 2024, 23:00 WIB

CVE-2024-54137

liboqs has a correctness error in HQC decapsulation

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T16:00:58.061Z. Updated 2024-12-10T16:10:59.900Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 23:10 WIB

Official record

MedPublished 06 Dec 2024, 22:57 WIB

CVE-2024-30129

HCL Nomad server on Domino is affected by a host header injection vulnerability

The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T15:57:41.869Z. Updated 2024-12-06T17:01:53.834Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated07 Dec 2024, 00:01 WIB

Official record

HighPublished 06 Dec 2024, 22:19 WIB

CVE-2024-12254

Unbounded memory buffering in SelectorSocketTransport.writelines()

Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer potentially leading t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T15:19:41.576Z. Updated 2026-07-31T14:08:25.397Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated31 Jul 2026, 21:08 WIB

Official record

CritPublished 06 Dec 2024, 22:11 WIB

CVE-2024-54135

Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 2.0 to Version 5.5.1 Revision 199 are vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/photo_upload.php within the decode_key function. User inputs were supplied to this function without sanitization via…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T15:11:04.933Z. Updated 2024-12-06T15:46:40.873Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated06 Dec 2024, 22:46 WIB

Official record

CritPublished 06 Dec 2024, 22:07 WIB

CVE-2024-54136

Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below

ClipBucket V5 provides open source video hosting with PHP. ClipBucket-v5 Version 5.5.1 Revision 199 and below is vulnerable to PHP Deserialization vulnerability. The vulnerability exists in upload/upload.php where the user supplied input via collection get parameter is directly provided to unserialize function. As a re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T15:07:42.039Z. Updated 2024-12-06T17:09:25.335Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated07 Dec 2024, 00:09 WIB

Official record

HighPublished 06 Dec 2024, 22:00 WIB

CVE-2024-54141

phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database (ie postgreSQL) server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T15:00:16.407Z. Updated 2024-12-06T17:12:03.413Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated07 Dec 2024, 00:12 WIB

Official record

MedPublished 06 Dec 2024, 21:54 WIB

CVE-2024-11738

Rustls: rustls network-reachable panic in `acceptor::accept`

A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T14:54:11.310Z. Updated 2025-11-20T18:22:11.892Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated21 Nov 2025, 01:22 WIB

Official record

MedPublished 06 Dec 2024, 21:47 WIB

CVE-2024-42196

HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability

HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T14:47:34.691Z. Updated 2024-12-06T17:46:09.269Z.

CVSS6.2v3.1KEVNot listedEPSSPresentUpdated07 Dec 2024, 00:46 WIB

Official record

MedPublished 06 Dec 2024, 20:45 WIB

CVE-2024-4633

Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting

The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘addExtraMimeType’ function in versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T13:45:20.274Z. Updated 2026-04-08T17:10:13.841Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:10 WIB

Official record

HighPublished 06 Dec 2024, 20:45 WIB

CVE-2024-10516

Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'

The Swift Performance Lite plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 2.3.7.1 via the 'ajaxify' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T13:45:19.633Z. Updated 2026-04-08T16:50:24.682Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:50 WIB

Official record

MedPublished 06 Dec 2024, 20:37 WIB

CVE-2024-11321

Reflected XSS in Hi e-learning's Learning Management System (LMS)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hi e-learning Learning Management System (LMS) allows Reflected XSS. This issue affects Learning Management System (LMS): before 06.12.2024.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T13:37:29.699Z. Updated 2026-06-02T06:35:58.335Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 13:35 WIB

Official record

HighPublished 06 Dec 2024, 20:21 WIB

CVE-2024-21571

CVE-2024-21571

Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. The vulnerability enables an attacker to execute arbitrary code within the Code Agent container. Exploiting this vulnerability would require an attacker to have network access to the Code Agent within the deployment environme…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T13:21:11.671Z. Updated 2024-12-06T17:54:30.794Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated07 Dec 2024, 00:54 WIB

Official record

MedPublished 06 Dec 2024, 20:18 WIB

CVE-2024-53826

WordPress WPCasa plugin <= 1.2.13 - Insecure Direct Object References (IDOR) vulnerability

Missing Authorization vulnerability in WPSight WPCasa wpcasa allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPCasa: from n/a through <= 1.2.13.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T13:18:31.922Z. Updated 2026-04-28T16:10:47.160Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record