Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 281–300 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

MedPublished 27 Nov 2024, 02:22 WIB

CVE-2024-10240

Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstan…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T19:22:52.689Z. Updated 2024-11-26T20:26:23.503Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 03:26 WIB

Official record

CritPublished 27 Nov 2024, 02:17 WIB

CVE-2024-11145

Easy Folder Listing Pro deserialization vulnerability

Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla! application. Fixed in versions 3.8 and 4.5.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 281 to 300 of 4054.First page Next page

Published 2024-11-26T19:17:44.520Z. Updated 2024-11-26T19:39:10.277Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Nov 2024, 02:39 WIB

Official record

HighPublished 27 Nov 2024, 02:15 WIB

CVE-2024-8676

Cri-o: checkpoint restore can be triggered from different namespaces

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T19:15:48.475Z. Updated 2026-10-13T03:02:38.269Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated13 Oct 2026, 10:02 WIB

Official record

LowPublished 27 Nov 2024, 01:52 WIB

CVE-2024-52008

Password Policy Bypass Vulnerability in Fides Webserver

Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:52:40.102Z. Updated 2024-11-26T19:16:54.451Z.

CVSS2v4.0KEVNot listedEPSSPresentUpdated27 Nov 2024, 02:16 WIB

Official record

MedPublished 27 Nov 2024, 01:41 WIB

CVE-2024-53267

Vulnerability with bundle verification in sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation of KeylessVerifier.ver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:41:29.240Z. Updated 2024-11-26T19:46:41.263Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 02:46 WIB

Official record

MedPublished 27 Nov 2024, 01:41 WIB

CVE-2024-11828

Inefficient Algorithmic Complexity in GitLab

A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:41:19.280Z. Updated 2024-11-26T19:53:40.674Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 02:53 WIB

Official record

MedPublished 27 Nov 2024, 01:41 WIB

CVE-2024-11669

Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:41:09.488Z. Updated 2024-11-30T04:55:54.926Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 11:55 WIB

Official record

MedPublished 27 Nov 2024, 01:37 WIB

CVE-2024-53844

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in labsai/eddi

E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. A path traversal vulnerability exists in the backup export functionality of EDDI, as implemented in `RestExportService.java`. This vulnerability allows an attacker to access sensitive files on the server by manipulating the `…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:37:51.909Z. Updated 2024-11-26T21:03:48.160Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 04:03 WIB

Official record

HighPublished 27 Nov 2024, 01:31 WIB

CVE-2024-8114

Missing Authorization in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:31:10.674Z. Updated 2024-11-30T04:55:53.512Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 11:55 WIB

Official record

MedPublished 27 Nov 2024, 01:31 WIB

CVE-2024-8177

Inefficient Algorithmic Complexity in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:31:05.665Z. Updated 2024-11-26T18:41:50.602Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 01:41 WIB

Official record

MedPublished 27 Nov 2024, 01:31 WIB

CVE-2024-8237

Inefficient Algorithmic Complexity in GitLab

A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:31:00.676Z. Updated 2024-11-26T18:42:11.715Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 01:42 WIB

Official record

MedPublished 27 Nov 2024, 01:30 WIB

CVE-2024-11668

Insufficient Session Expiration in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:30:45.846Z. Updated 2024-11-26T18:42:38.028Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 01:42 WIB

Official record

HighPublished 27 Nov 2024, 01:25 WIB

CVE-2024-32965

ssrf vulnerability in lobe-chat

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy add…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T18:25:56.215Z. Updated 2024-11-26T18:48:27.413Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Nov 2024, 01:48 WIB

Official record

MedPublished 27 Nov 2024, 00:32 WIB

CVE-2024-10878

Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This makes it possible for unauthenticated attackers to inject arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T17:32:11.007Z. Updated 2026-04-08T17:15:54.384Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:15 WIB

Official record

MedPublished 26 Nov 2024, 23:59 WIB

CVE-2024-11407

Denial of Service through Data corruption in gRPC-C++

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network thus leading the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T16:59:49.718Z. Updated 2024-11-26T21:04:58.031Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Nov 2024, 04:04 WIB

Official record

MedPublished 26 Nov 2024, 22:21 WIB

CVE-2024-52337

Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The q…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T15:21:17.538Z. Updated 2026-06-26T01:03:11.731Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated26 Jun 2026, 08:03 WIB

Official record

HighPublished 26 Nov 2024, 22:21 WIB

CVE-2024-52336

Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T15:21:13.518Z. Updated 2026-06-26T00:51:25.852Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated26 Jun 2026, 07:51 WIB

Official record

MedPublished 26 Nov 2024, 22:06 WIB

CVE-2024-36463

CVE-2024-36463

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal properties of objects.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T15:06:14.217Z. Updated 2024-11-26T16:21:54.142Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Nov 2024, 23:21 WIB

Official record

LowPublished 26 Nov 2024, 21:11 WIB

CVE-2024-22117

Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This ac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T14:11:57.195Z. Updated 2024-11-26T15:06:22.759Z.

CVSS2.2v3.1KEVNot listedEPSSPresentUpdated26 Nov 2024, 22:06 WIB

Official record

MedPublished 26 Nov 2024, 20:56 WIB

CVE-2024-8236

Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated att…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-26T13:56:54.955Z. Updated 2026-04-08T17:16:10.133Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:16 WIB

Official record