Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 2301–2320 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

UnscoredPublished 14 Nov 2024, 00:13 WIB

CVE-2024-34747

CVE-2024-34747

In DevmemXIntMapPages of devicemem_server.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T17:13:19.800Z. Updated 2024-11-15T21:15:39.442Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:15 WIB

Official record

UnscoredPublished 14 Nov 2024, 00:13 WIB

CVE-2024-34729

CVE-2024-34729

In multiple locations, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T17:13:19.713Z. Updated 2024-11-15T21:17:09.762Z.

Showing 2301 to 2320 of 4054.First page Next page

CVSS

—

KEVNot listed

EPSSPresent

Updated16 Nov 2024, 04:17 WIB

Official record

UnscoredPublished 14 Nov 2024, 00:13 WIB

CVE-2024-34719

CVE-2024-34719

In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T17:13:19.624Z. Updated 2024-12-04T04:55:39.167Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Dec 2024, 11:55 WIB

Official record

UnscoredPublished 14 Nov 2024, 00:13 WIB

CVE-2024-31337

CVE-2024-31337

In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T17:13:19.522Z. Updated 2024-11-15T21:18:18.327Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Nov 2024, 04:18 WIB

Official record

UnscoredPublished 14 Nov 2024, 00:13 WIB

CVE-2024-23715

CVE-2024-23715

In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T17:13:19.354Z. Updated 2024-11-20T16:17:14.833Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 23:17 WIB

Official record

UnscoredPublished 14 Nov 2024, 00:13 WIB

CVE-2023-35686

CVE-2023-35686

In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T17:13:19.238Z. Updated 2024-11-20T16:18:26.402Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 23:18 WIB

Official record

UnscoredPublished 14 Nov 2024, 00:13 WIB

CVE-2023-35659

CVE-2023-35659

In DevmemIntChangeSparse of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T17:13:19.072Z. Updated 2024-11-20T16:20:05.777Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Nov 2024, 23:20 WIB

Official record

MedPublished 13 Nov 2024, 23:30 WIB

CVE-2024-9476

Privilege escalation vulnerability for Organizations in Grafana

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T16:30:54.581Z. Updated 2025-11-23T15:33:38.284Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated23 Nov 2025, 22:33 WIB

Official record

HighPublished 13 Nov 2024, 23:21 WIB

CVE-2024-45594

Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds

Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T16:21:37.850Z. Updated 2024-11-13T18:43:57.042Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 01:43 WIB

Official record

HighPublished 13 Nov 2024, 23:18 WIB

CVE-2024-51996

Symphony has an Authentication Bypass via RememberMe

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T16:18:49.473Z. Updated 2024-11-13T18:49:31.776Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 01:49 WIB

Official record

HighPublished 13 Nov 2024, 23:12 WIB

CVE-2024-52291

Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malici…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T16:12:14.803Z. Updated 2024-11-13T18:52:15.774Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 01:52 WIB

Official record

UnscoredPublished 13 Nov 2024, 23:09 WIB

CVE-2024-9413

CVE-2024-9413

The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application Processor (AP) to cause a buffer overflow in System Control Processor (SCP) firmware.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T16:09:26.331Z. Updated 2024-11-27T15:35:14.153Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Nov 2024, 22:35 WIB

Official record

HighPublished 13 Nov 2024, 23:08 WIB

CVE-2024-52292

Craft Allows Attackers to Read Arbitrary System Files

Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notific…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T16:08:32.698Z. Updated 2024-11-13T18:53:58.779Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 01:53 WIB

Official record

HighPublished 13 Nov 2024, 23:04 WIB

CVE-2024-52293

Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI

Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T16:04:52.005Z. Updated 2024-11-13T18:56:00.590Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 01:56 WIB

Official record

CritPublished 13 Nov 2024, 22:49 WIB

CVE-2024-52295

DataEase has a forged JWT token vulnerability

DataEase is an open source data visualization analysis tool. Prior to 2.10.2, DataEase allows attackers to forge jwt and take over services. The JWT secret is hardcoded in the code, and the UID and OID are hardcoded. The vulnerability has been fixed in v2.10.2.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T15:49:20.363Z. Updated 2024-11-21T15:03:25.532Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 22:03 WIB

Official record

HighPublished 13 Nov 2024, 22:42 WIB

CVE-2024-52298

macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs to provide the referen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T15:42:42.501Z. Updated 2024-11-13T19:06:04.381Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 02:06 WIB

Official record

MedPublished 13 Nov 2024, 22:31 WIB

CVE-2024-11175

Public CMS Voting Management save cross site scripting

A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T15:31:26.613Z. Updated 2024-11-13T18:27:34.447Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated14 Nov 2024, 01:27 WIB

Official record

HighPublished 13 Nov 2024, 22:29 WIB

CVE-2024-52299

The PDF viewer macro allows accessing any attachment without access right checks

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. Any user with view right on XWiki.PDFViewerService can access any attachment stored in the wiki as the "key" that is passed to prevent this is computed incorrectly, calling skip on the digest stream doesn't update the digest. This is fixed in 2.5.6.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T15:29:07.107Z. Updated 2024-11-14T13:58:59.615Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 20:58 WIB

Official record

CritPublished 13 Nov 2024, 22:24 WIB

CVE-2024-52300

macro-pdfviewer has a XSS through the width parameter

macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The width parameter of the PDF viewer macro isn't properly escaped, allowing XSS for any user who can edit a page. XSS can impact the confidentiality, integrity and availability of the whole XWiki installation when an admin visits the page with the m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T15:24:59.125Z. Updated 2024-11-13T19:10:59.349Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 02:10 WIB

Official record

HighPublished 13 Nov 2024, 22:22 WIB

CVE-2024-7295

Hard-coded credentials used for temporary and cache data encryption

In Progress® Telerik® Report Server versions prior to 2024 Q4 (10.3.24.1112), the encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-13T15:22:28.781Z. Updated 2024-11-13T19:13:33.110Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 02:13 WIB

Official record