Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 2861–2880 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 06 Dec 2024, 15:24 WIB

CVE-2024-12003

WP System <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generate_wp_system_page_content() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T08:24:48.974Z. Updated 2026-04-08T16:33:28.379Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:33 WIB

Official record

HighPublished 06 Dec 2024, 13:48 WIB

CVE-2024-11178

Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP

The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating too weak OTP, and there’s no attempt or time limit. This makes it possible for unauthenticated attackers to generate and brute force the 6-digit numeric OTP that m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2861 to 2880 of 3433.First page Next page

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T06:48:22.861Z. Updated 2026-04-08T17:25:37.006Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:25 WIB

Official record

UnscoredPublished 06 Dec 2024, 13:00 WIB

CVE-2024-10551

Sticky Social Icons <= 1.2.1 - Admin+ Stored XSS

The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T06:00:08.221Z. Updated 2024-12-06T15:59:27.835Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 22:59 WIB

Official record

UnscoredPublished 06 Dec 2024, 13:00 WIB

CVE-2024-10480

3DPrint Lite < 2.1 - Settings Update via CSRF

The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T06:00:07.090Z. Updated 2024-12-06T16:03:29.448Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 23:03 WIB

Official record

HighPublished 06 Dec 2024, 12:26 WIB

CVE-2024-10578

Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation

The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnews_importer_plugin_action_for_notice() function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and abov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T05:26:15.514Z. Updated 2026-04-08T17:03:12.458Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:03 WIB

Official record

HighPublished 06 Dec 2024, 12:26 WIB

CVE-2024-11585

WP Hide & Security Enhancer <= 2.5.1 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletion

The WP Hide & Security Enhancer plugin for WordPress is vulnerable to arbitrary file contents deletion due to a missing authorization and insufficient file path validation in the file-process.php in all versions up to, and including, 2.5.1. This makes it possible for unauthenticated attackers to delete the contents of …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T05:26:15.076Z. Updated 2026-04-08T16:49:12.101Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:49 WIB

Official record

MedPublished 06 Dec 2024, 12:26 WIB

CVE-2024-11201

myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode

The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_send shortcode in all versions up to, and including…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T05:26:14.441Z. Updated 2026-04-08T16:44:05.234Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:44 WIB

Official record

MedPublished 06 Dec 2024, 11:24 WIB

CVE-2024-11379

Broadcast <= 51.01 - Reflected Cross-Site Scripting

The Broadcast plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'do_check' parameter in all versions up to, and including, 51.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T04:24:03.839Z. Updated 2026-04-08T17:30:51.456Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:30 WIB

Official record

HighPublished 06 Dec 2024, 10:25 WIB

CVE-2024-10247

YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection

The Video Gallery – Best WordPress YouTube Gallery Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T03:25:39.169Z. Updated 2026-04-08T17:33:19.368Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:33 WIB

Official record

MedPublished 06 Dec 2024, 10:25 WIB

CVE-2024-9769

Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting

The Video Gallery – Best WordPress YouTube Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level per…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T03:25:38.678Z. Updated 2026-04-08T17:17:11.801Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:17 WIB

Official record

MedPublished 06 Dec 2024, 10:25 WIB

CVE-2024-10836

Flixita <= 1.0.82 - Reflected Cross-Site Scripting via id Parameter

The Flixita theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.82 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T03:25:37.857Z. Updated 2026-04-08T16:36:35.499Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:36 WIB

Official record

MedPublished 06 Dec 2024, 08:56 WIB

CVE-2024-11149

OpenBSD vmm GDTR limits

In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T01:56:12.697Z. Updated 2024-12-06T16:41:55.500Z.

CVSS6.2v4.0KEVNot listedEPSSPresentUpdated06 Dec 2024, 23:41 WIB

Official record

MedPublished 06 Dec 2024, 08:09 WIB

CVE-2024-49041

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T01:09:11.856Z. Updated 2026-06-09T18:30:58.832Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Jun 2026, 01:30 WIB

Official record

UnscoredPublished 06 Dec 2024, 07:00 WIB

CVE-2024-38921

CVE-2024-38921

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_rand ` .

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T00:00:00.000Z. Updated 2024-12-11T17:11:39.627Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 00:11 WIB

Official record

UnscoredPublished 06 Dec 2024, 07:00 WIB

CVE-2024-38922

CVE-2024-38922

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process. This vulnerability is triggered via sending a crafted message to the component /initialpose.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T00:00:00.000Z. Updated 2024-12-11T18:55:37.518Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 01:55 WIB

Official record

UnscoredPublished 06 Dec 2024, 07:00 WIB

CVE-2024-38923

CVE-2024-38923

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl odom_frame_id` .

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T00:00:00.000Z. Updated 2024-12-11T17:18:55.593Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 00:18 WIB

Official record

UnscoredPublished 06 Dec 2024, 07:00 WIB

CVE-2024-38924

CVE-2024-38924

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter`/amcl laser_model_type` .

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T00:00:00.000Z. Updated 2024-12-11T17:17:13.084Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 00:17 WIB

Official record

UnscoredPublished 06 Dec 2024, 07:00 WIB

CVE-2024-38925

CVE-2024-38925

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter`/amcl z_max` .

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T00:00:00.000Z. Updated 2024-12-11T19:42:24.658Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 02:42 WIB

Official record

UnscoredPublished 06 Dec 2024, 07:00 WIB

CVE-2024-38926

CVE-2024-38926

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request for change the value of dynamic-parameter `/amcl z_short`.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T00:00:00.000Z. Updated 2024-12-11T19:43:18.055Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 02:43 WIB

Official record

UnscoredPublished 06 Dec 2024, 07:00 WIB

CVE-2024-38927

CVE-2024-38927

Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. This vulnerability is triggered via remotely sending a request to change the value of dynamic-parameter `/amcl do_beamskip`.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-06T00:00:00.000Z. Updated 2024-12-11T19:44:54.545Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 02:44 WIB

Official record