Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 2921–2940 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 05 Dec 2024, 23:31 WIB

CVE-2024-12233

code-projects Online Notice Board Profile Picture registration.php unrestricted upload

A vulnerability was found in code-projects Online Notice Board up to 1.0 and classified as critical. This issue affects some unknown processing of the file /registration.php of the component Profile Picture Handler. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T16:31:04.741Z. Updated 2024-12-09T18:53:59.612Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 01:53 WIB

Official record

MedPublished 05 Dec 2024, 23:00 WIB

CVE-2024-12232

code-projects Simple CRUD Functionality index.php cross site scripting

A vulnerability has been found in code-projects Simple CRUD Functionality 1.0 and classified as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument newtitle/newdescr leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2921 to 2940 of 3433.First page Next page

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T16:00:19.365Z. Updated 2024-12-09T18:56:22.151Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 01:56 WIB

Official record

MedPublished 05 Dec 2024, 23:00 WIB

CVE-2024-12231

CodeZips Project Management System index.php sql injection

A vulnerability, which was classified as critical, was found in CodeZips Project Management System 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T16:00:17.593Z. Updated 2024-12-09T18:59:14.120Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 01:59 WIB

Official record

MedPublished 05 Dec 2024, 22:28 WIB

CVE-2024-10716

CVE-2024-10716

Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an XSS issue with search.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T15:28:29.644Z. Updated 2024-12-05T16:30:58.223Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:30 WIB

Official record

HighPublished 05 Dec 2024, 22:24 WIB

CVE-2024-53856

rPGP Panics on Malformed Untrusted Input

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T15:24:36.049Z. Updated 2024-12-09T20:23:09.592Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 03:23 WIB

Official record

HighPublished 05 Dec 2024, 22:22 WIB

CVE-2024-53857

rPGP Potential Resource Exhaustion when handling Untrusted Messages

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T15:22:09.049Z. Updated 2024-12-05T16:34:13.917Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:34 WIB

Official record

MedPublished 05 Dec 2024, 22:20 WIB

CVE-2024-12247

Improper propagation of permission scheme updates across cluster nodes

Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T15:20:49.383Z. Updated 2024-12-05T16:58:59.768Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:58 WIB

Official record

MedPublished 05 Dec 2024, 22:17 WIB

CVE-2024-54001

Kanboard allows a persistent HTML injection site scripting in settings page date format

Kanboard is project management software that focuses on the Kanban methodology. HTML can be injected and stored into the application settings section. The fields application_language, application_date_format,application_timezone and application_time_format allow arbirary user input which is reflected. The vulnerability…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T15:17:47.891Z. Updated 2024-12-05T16:41:45.720Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:41 WIB

Official record

CritPublished 05 Dec 2024, 22:13 WIB

CVE-2024-54129

Improper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7

The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A vulnerability exists in the version ION-DTN BPv7 implementation version 4.1.3 when receiving a bundle with an improper reference to the imc scheme with valid Service-Specific Part (SSP) in their Previou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T15:13:53.901Z. Updated 2024-12-09T20:30:23.752Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 03:30 WIB

Official record

CritPublished 05 Dec 2024, 22:10 WIB

CVE-2024-54130

Segmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public)

The NASA’s Interplanetary Overlay Network (ION) is an implementation of Delay/Disruption Tolerant Networking (DTN). A segmentation fault occurs with ION-DTN BPv7 software version 4.1.3 when a bundle with a Destination Endpoint ID (EID) set to dtn:none is received. This causes the node to become unresponsive to incoming…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T15:10:37.229Z. Updated 2024-12-05T17:24:37.371Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated06 Dec 2024, 00:24 WIB

Official record

UnscoredPublished 05 Dec 2024, 21:42 WIB

CVE-2024-11942

Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T14:42:07.812Z. Updated 2024-12-05T15:41:56.600Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 22:41 WIB

Official record

UnscoredPublished 05 Dec 2024, 21:39 WIB

CVE-2024-11941

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

A vulnerability in Drupal Core allows Excessive Allocation.This issue affects Drupal Core: from 10.2.0 before 10.2.2, from 10.1.0 before 10.1.8.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T14:39:37.975Z. Updated 2024-12-05T15:45:37.085Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 22:45 WIB

Official record

MedPublished 05 Dec 2024, 21:31 WIB

CVE-2024-12230

PHPGurukul Complaint Management System subcategory.php sql injection

A vulnerability, which was classified as critical, has been found in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/subcategory.php. The manipulation of the argument category leads to sql injection. The attack may be launched remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T14:31:09.399Z. Updated 2024-12-05T14:39:33.179Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 21:39 WIB

Official record

MedPublished 05 Dec 2024, 21:31 WIB

CVE-2024-12229

PHPGurukul Complaint Management System complaint-search.php sql injection

A vulnerability classified as critical was found in PHPGurukul Complaint Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/complaint-search.php. The manipulation of the argument search leads to sql injection. The attack can be launched remotely. The exploit has been di…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T14:31:06.449Z. Updated 2024-12-05T14:42:11.309Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 21:42 WIB

Official record

UnscoredPublished 05 Dec 2024, 20:59 WIB

CVE-2024-53703

CVE-2024-53703

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T13:59:35.490Z. Updated 2024-12-07T04:55:30.933Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Dec 2024, 11:55 WIB

Official record

HighPublished 05 Dec 2024, 20:56 WIB

CVE-2024-52271

PDF Document Spoofing in Documenso

User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T13:56:08.185Z. Updated 2024-12-05T16:53:23.959Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:53 WIB

Official record

UnscoredPublished 05 Dec 2024, 20:53 WIB

CVE-2024-53702

CVE-2024-53702

Use of cryptographically weak pseudo-random number generator (PRNG) vulnerability in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T13:53:37.282Z. Updated 2024-12-05T15:10:12.280Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 22:10 WIB

Official record

UnscoredPublished 05 Dec 2024, 20:50 WIB

CVE-2024-45319

CVE-2024-45319

A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions allows a remote authenticated attacker can circumvent the certificate requirement during authentication.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T13:50:28.768Z. Updated 2024-12-05T16:56:09.484Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:56 WIB

Official record

UnscoredPublished 05 Dec 2024, 20:43 WIB

CVE-2024-45318

CVE-2024-45318

A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T13:43:31.716Z. Updated 2024-12-09T14:21:22.642Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Dec 2024, 21:21 WIB

Official record

UnscoredPublished 05 Dec 2024, 20:39 WIB

CVE-2024-40763

CVE-2024-40763

Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-05T13:39:19.644Z. Updated 2024-12-07T04:55:28.515Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Dec 2024, 11:55 WIB

Official record