Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 2241–2260 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 15 Jan 2025, 11:41 WIB

CVE-2025-22394

CVE-2025-22394

Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code execution and possibly privilege escalation.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T04:41:21.868Z. Updated 2025-01-15T15:06:01.782Z.

CVSS6.7v3.1KEVNot listedEPSSPresentUpdated15 Jan 2025, 22:06 WIB

Official record

MedPublished 15 Jan 2025, 11:36 WIB

CVE-2025-21101

CVE-2025-21101

Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit this vulnerability during installation, leading to arbitrary folder or file deletion.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T04:36:38.793Z. Updated 2025-01-15T15:06:23.823Z.

Showing 2241 to 2260 of 4273.First page Next page

CVSS6.6v3.1

KEVNot listed

EPSSPresent

Updated15 Jan 2025, 22:06 WIB

Official record

MedPublished 15 Jan 2025, 10:22 WIB

CVE-2024-13334

Car Demon <= 1.8.1 - Reflected Cross-Site Scripting

The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T03:22:29.099Z. Updated 2026-04-08T16:59:25.375Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:59 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:48 WIB

CVE-2025-0343

CVE-2025-0343

Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects can only be provided in either constructed or primitive forms, and will trigger a preconditionFailure if that constraint isn't met. Important…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:48:07.959Z. Updated 2025-03-24T16:07:03.833Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 23:07 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-36751

CVE-2024-36751

An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-02-03T14:49:11.947Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Feb 2025, 21:49 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-39967

CVE-2024-39967

Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-02-03T14:52:05.443Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Feb 2025, 21:52 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-41453

CVE-2024-41453

A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-01-16T17:18:03.443Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Jan 2025, 00:18 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-41454

CVE-2024-41454

An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary code via uploading a crafted PHP or HTML file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-02-03T18:34:54.765Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 01:34 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-48121

CVE-2024-48121

The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain access to sensitive information via a man-in-the-middle attack.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-02-03T17:17:55.196Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 00:17 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-48122

CVE-2024-48122

Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-02-03T17:18:29.545Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 00:18 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-48123

CVE-2024-48123

An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-02-03T17:35:38.045Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 00:35 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-48125

CVE-2024-48125

An issue in the AsDB service of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to enumerate user credentials via crafted GIOP protocol requests.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-03-18T14:17:40.445Z.

CVSS—KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:17 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-48126

CVE-2024-48126

HI-SCAN 6040i Hitrax HX-03-19-I was discovered to contain hardcoded credentials for access to vendor support and service access.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-03-18T20:38:07.525Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 03:38 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-50953

CVE-2024-50953

An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-03-24T16:36:21.773Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 23:36 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-50954

CVE-2024-50954

The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is established with the above series of controllers within a local area network (LAN), sending a specific Modbus message to the controller can cause the PLC to crash, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-03-20T13:39:02.562Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Mar 2025, 20:39 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-52783

CVE-2024-52783

Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via modification of the configuration file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-02-03T17:05:22.173Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Feb 2025, 00:05 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-53407

CVE-2024-53407

In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-01-31T20:23:07.435Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Feb 2025, 03:23 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-55503

CVE-2024-55503

An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-01-31T20:24:34.908Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Feb 2025, 03:24 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-57011

CVE-2024-57011

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-03-17T16:36:55.357Z.

CVSS—KEVNot listedEPSSPresentUpdated17 Mar 2025, 23:36 WIB

Official record

UnscoredPublished 15 Jan 2025, 07:00 WIB

CVE-2024-57012

CVE-2024-57012

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-15T00:00:00.000Z. Updated 2025-03-14T15:34:24.788Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Mar 2025, 22:34 WIB

Official record