Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 2961–2980 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

CritPublished 11 Jan 2025, 14:21 WIB

CVE-2024-12877

GiveWP – Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2 via deserialization of untrusted input from the donation form like 'firstName'. This makes it possible for unauthenticated attackers to inject a PHP Object. The a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:53.510Z. Updated 2026-04-08T17:16:22.820Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:16 WIB

Official record

MedPublished 11 Jan 2025, 14:21 WIB

CVE-2024-12412

Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin <= 2.2.1 - Reflected Cross-Site Scripting

The Rental and Booking Manager for Bike, Car, Dress, Resort with WooCommerce Integration – WpRently | WordPress plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘active_tab’ parameter in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2961 to 2980 of 4273.First page Next page

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:53.135Z. Updated 2026-04-08T17:16:02.029Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:16 WIB

Official record

MedPublished 11 Jan 2025, 14:21 WIB

CVE-2024-12520

Dominion – Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Dominion – Domain Checker for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dominion_shortcodes_domain_search_6' shortcode in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:52.731Z. Updated 2026-04-08T17:13:31.289Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:13 WIB

Official record

MedPublished 11 Jan 2025, 14:21 WIB

CVE-2024-12116

Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure

The Unlimited Theme Addon For Elementor and WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'uta-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:52.245Z. Updated 2026-04-08T17:11:38.981Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:11 WIB

Official record

MedPublished 11 Jan 2025, 14:21 WIB

CVE-2024-12519

TCBD Auto Refresher <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The TCBD Auto Refresher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tcbd_auto_refresh' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:51.888Z. Updated 2026-04-08T17:04:31.873Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:04 WIB

Official record

MedPublished 11 Jan 2025, 14:21 WIB

CVE-2024-11874

Grid Accordion Lite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Grid Accordion Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'grid_accordion' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:51.502Z. Updated 2026-04-08T17:03:25.486Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:03 WIB

Official record

MedPublished 11 Jan 2025, 14:21 WIB

CVE-2024-11915

RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure

The RRAddons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.0 via the Popup block due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:51.144Z. Updated 2026-04-08T16:48:12.443Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

MedPublished 11 Jan 2025, 14:21 WIB

CVE-2024-11758

WP SPID Italia <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WP SPID Italia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level acc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:21:50.585Z. Updated 2026-04-08T16:35:12.065Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

LowPublished 11 Jan 2025, 14:20 WIB

CVE-2024-42175

HCL MyXalytics is affected by a weak input validation vulnerability

HCL MyXalytics is affected by a weak input validation vulnerability. The application accepts special characters and there is no length validation. This can lead to security vulnerabilities like SQL injection, XSS, and buffer overflow.

Excerpt language: en.

Severity low: primary CNA CVSS 2.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:20:57.617Z. Updated 2025-01-13T17:49:03.171Z.

CVSS2.6v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 00:49 WIB

Official record

LowPublished 11 Jan 2025, 14:04 WIB

CVE-2024-42174

HCL MyXalytics is affected by username enumeration vulnerability

HCL MyXalytics is affected by username enumeration vulnerability. This allows a malicious user to perform enumeration of application users, and therefore compile a list of valid usernames.

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T07:04:24.964Z. Updated 2025-01-13T19:22:10.825Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 02:22 WIB

Official record

MedPublished 11 Jan 2025, 13:54 WIB

CVE-2024-42173

HCL MyXalytics is affected by an improper password policy implementation vulnerability

HCL MyXalytics is affected by an improper password policy implementation vulnerability. Weak passwords and lack of account lockout policies allow attackers to guess or brute-force passwords if the username is known.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T06:54:33.550Z. Updated 2025-01-13T19:25:32.172Z.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 02:25 WIB

Official record

MedPublished 11 Jan 2025, 13:44 WIB

CVE-2024-42172

HCL MyXalytics is affected by broken authentication

HCL MyXalytics is affected by broken authentication. It allows attackers to compromise keys, passwords, and session tokens, potentially leading to identity theft and system control. This vulnerability arises from poor configuration, logic errors, or software bugs and can affect any application with access control, in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T06:44:28.808Z. Updated 2025-01-13T19:25:52.775Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 02:25 WIB

Official record

MedPublished 11 Jan 2025, 13:31 WIB

CVE-2024-42171

HCL MyXalytics is affected by insufficient session expiration

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T06:31:24.165Z. Updated 2025-01-13T19:26:14.052Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 02:26 WIB

Official record

MedPublished 11 Jan 2025, 13:17 WIB

CVE-2024-42170

HCL MyXalytics is affected by a session fixation vulnerability

HCL MyXalytics is affected by a session fixation vulnerability. Cyber-criminals can exploit this by sending crafted URLs with a session token to access the victim's login session.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T06:17:20.606Z. Updated 2025-01-13T19:26:40.043Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 02:26 WIB

Official record

UnscoredPublished 11 Jan 2025, 13:00 WIB

CVE-2024-12587

Contact Form Master <= 1.0.7 - Reflected XSS

The Contact Form Master WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T06:00:02.900Z. Updated 2025-01-13T19:28:24.270Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Jan 2025, 02:28 WIB

Official record

UnscoredPublished 11 Jan 2025, 10:36 WIB

CVE-2025-23109

Address bar spoofing on iOS using long hostnames

Long hostnames in URLs could be leveraged to obscure the actual host of the website or spoof the website address. This vulnerability was fixed in Firefox for iOS 134.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T03:36:55.235Z. Updated 2026-05-20T14:30:16.952Z.

CVSS—KEVNot listedEPSSPresentUpdated20 May 2026, 21:30 WIB

Official record

UnscoredPublished 11 Jan 2025, 10:36 WIB

CVE-2025-23108

Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability was fixed in Firefox for iOS 134.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T03:36:53.989Z. Updated 2026-05-20T14:29:26.729Z.

CVSS—KEVNot listedEPSSPresentUpdated20 May 2026, 21:29 WIB

Official record

MedPublished 11 Jan 2025, 10:21 WIB

CVE-2024-12304

Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Cont…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T03:21:03.438Z. Updated 2026-04-08T17:20:17.731Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:20 WIB

Official record

HighPublished 11 Jan 2025, 10:02 WIB

CVE-2025-0107

Expedition: OS Command Injection Vulnerability

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T03:02:49.517Z. Updated 2025-01-24T04:56:01.054Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated24 Jan 2025, 11:56 WIB

Official record

MedPublished 11 Jan 2025, 10:02 WIB

CVE-2025-0106

Expedition: Wildcard Expansion Vulnerability

A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-11T03:02:24.574Z. Updated 2025-01-13T19:48:42.286Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated14 Jan 2025, 02:48 WIB

Official record