Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 2841–2860 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

MedPublished 11 Nov 2024, 07:00 WIB

CVE-2024-11060

Jinher Network Collaborative Management Platform 金和数字化智能办公平台 AcceptShow.aspx sql injection

A vulnerability classified as critical has been found in Jinher Network Collaborative Management Platform 金和数字化智能办公平台 1.0. Affected is an unknown function of the file /C6/JHSoft.Web.AcceptAip/AcceptShow.aspx/. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:15.171Z. Updated 2024-11-12T16:04:17.474Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:04 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-25253

CVE-2024-25253

Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-19T16:57:37.699Z.

Showing 2841 to 2860 of 4054.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2024, 23:57 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-25254

CVE-2024-25254

SuperScan v4.1 was discovered to contain a buffer overflow via the Hostname/IP parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-19T19:13:04.201Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 02:13 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-25255

CVE-2024-25255

Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. NOTE: multiple third parties report that this is intended behavior.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-12-24T06:04:42.820Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Dec 2024, 13:04 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-36061

CVE-2024-36061

EnGenius EWS356-FIT devices through 1.1.30 allow blind OS command injection. This allows an attacker to execute arbitrary OS commands via shell metacharacters to the Ping and Speed Test utilities.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T16:27:15.034Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:27 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-41992

CVE-2024-41992

Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library function is used. For example, on Arcadyan FMIMG51AX000J devices, this leads to wfaTGSendPing remote code execution as root via traffic to TCP port 8000 or 8080 on a LAN interface. On o…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T17:16:19.610Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2024, 00:16 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-44546

CVE-2024-44546

Powerjob >= 3.20 is vulnerable to SQL injection via the version parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-19T19:15:16.967Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 02:15 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-46962

CVE-2024-46962

The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T16:08:00.654Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:08 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-46963

CVE-2024-46963

The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T16:04:13.219Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:04 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-46964

CVE-2024-46964

The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the com.video.downloader.all.StartActivity component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T16:00:21.514Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:00 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-46965

CVE-2024-46965

The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T16:14:38.488Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:14 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-46966

CVE-2024-46966

The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T15:57:43.642Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 22:57 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-48322

CVE-2024-48322

UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T16:33:44.829Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:33 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-48939

CVE-2024-48939

Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-19T19:25:30.198Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 02:25 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-50601

CVE-2024-50601

Persistent and reflected XSS vulnerabilities in the themeMode cookie and _h URL parameter of Axigen Mail Server up to version 10.5.28 allow attackers to execute arbitrary Javascript. Exploitation could lead to session hijacking, data leakage, and further exploitation via a multi-stage attack. Fixed in versions 10.3.3.6…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T15:54:01.976Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 22:54 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-50636

CVE-2024-50636

PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. Attackers can craft a malicious .PYM file containing a Python reverse shell payload and exploit the function to achieve Remote Command Execution (RCE). This vulnerability ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-19T19:07:43.887Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 02:07 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-50667

CVE-2024-50667

The boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/formDnsv6. The reason is that the check of ipv6 address is not sufficient, which allows attackers to construct payloads for attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T16:58:42.668Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Nov 2024, 23:58 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-50989

CVE-2024-50989

A SQL injection vulnerability in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System v1.0 allows an attacker to execute arbitrary SQL commands via the "searchdata " parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T17:11:10.551Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2024, 00:11 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-50990

CVE-2024-50990

A Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.0, which allows remote attackers to execute arbitrary code via the "searchdata" POST request parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T19:12:55.145Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2024, 02:12 WIB

Official record

UnscoredPublished 11 Nov 2024, 07:00 WIB

CVE-2024-50991

CVE-2024-50991

A Cross Site Scripting (XSS) vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which allows remote attackers to execute arbitrary code via the "fname" POST request parameter

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-11T00:00:00.000Z. Updated 2024-11-12T19:11:09.211Z.

CVSS—KEVNot listedEPSSPresentUpdated13 Nov 2024, 02:11 WIB

Official record