Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 2001–2020 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

MedPublished 15 Nov 2024, 11:29 WIB

CVE-2024-10897

Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and abov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T04:29:04.948Z. Updated 2026-04-08T17:10:59.526Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:10 WIB

Official record

CritPublished 15 Nov 2024, 10:18 WIB

CVE-2024-10924

Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthentica…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2001 to 2020 of 4054.First page Next page

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T03:18:45.746Z. Updated 2026-01-23T15:19:28.477Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated23 Jan 2026, 22:19 WIB

Official record

CritKEVPublished 15 Nov 2024, 09:00 WIB

CVE-2024-11120

GeoVision EOL devices - OS Command Injection

Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) KEV listed. Forecast present in this snapshot.

Published 2024-11-15T02:00:27.361Z. Updated 2025-10-21T22:55:36.559Z.

CVSS9.8v3.1KEVListedEPSSPresentUpdated22 Oct 2025, 05:55 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-23169

CVE-2024-23169

The web interface in RSA NetWitness 11.7.2.0 allows Cross-Site Scripting (XSS) via the Where textbox on the Reports screen during new rule creation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-15T18:54:35.164Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 01:54 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24425

CVE-2024-24425

Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-19T16:34:30.607Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2024, 23:34 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24426

CVE-2024-24426

Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-12-03T16:11:22.877Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Dec 2024, 23:11 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24431

CVE-2024-24431

A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet with a zero-length EMM message length.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-12-03T16:04:26.231Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Dec 2024, 23:04 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24446

CVE-2024-24446

An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted InitialContextSetupResponse message sent to the AMF.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-19T16:38:13.569Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Nov 2024, 23:38 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24447

CVE-2024-24447

A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a PDU Session Resource Setup Response with an empty Response Item list.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-15T21:08:56.861Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:08 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24449

CVE-2024-24449

An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a crafted InitialUEMessage message sent to the AMF.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-26T19:01:19.135Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Nov 2024, 02:01 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24450

CVE-2024-24450

Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allows a remote attacker with access to the N2 interface to carry out denial of service against the AMF and potentially execute code by sending a PDU Session Resource Setup Response wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-15T21:08:56.725Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:08 WIB

Official record

MedPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24452

CVE-2024-24452

An invalid memory access when handling the ProtocolIE_ID field of E-RAB Release Indication messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2025-03-31T20:27:14.430Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated01 Apr 2025, 03:27 WIB

Official record

MedPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24453

CVE-2024-24453

An invalid memory access when handling the ProtocolIE_ID field of E-RAB NotToBeModifiedBearerModInd information element in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2025-08-26T21:07:00.137Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:07 WIB

Official record

MedPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24454

CVE-2024-24454

An invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2025-08-26T21:08:36.197Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:08 WIB

Official record

MedPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24455

CVE-2024-24455

An invalid memory access when handling a UE Context Release message containing an invalid UE identifier in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2025-08-26T21:10:12.027Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:10 WIB

Official record

MedPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24457

CVE-2024-24457

An invalid memory access when handling the ProtocolIE_ID field of E-RAB Setup List Context SURes messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2025-08-26T21:10:55.385Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:10 WIB

Official record

MedPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24458

CVE-2024-24458

An invalid memory access when handling the ENB Configuration Transfer messages containing invalid PLMN Identities in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2025-08-26T21:11:30.537Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:11 WIB

Official record

MedPublished 15 Nov 2024, 07:00 WIB

CVE-2024-24459

CVE-2024-24459

An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2025-08-26T21:11:48.846Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 04:11 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-44625

CVE-2024-44625

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-20T20:20:11.482Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Nov 2024, 03:20 WIB

Official record

UnscoredPublished 15 Nov 2024, 07:00 WIB

CVE-2024-44758

CVE-2024-44758

An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary code via uploading crafted files.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-15T00:00:00.000Z. Updated 2024-11-27T17:16:05.222Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Nov 2024, 00:16 WIB

Official record