Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 2361–2380 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 10 Dec 2024, 16:24 WIB

CVE-2024-11973

Quran multilanguage Text & Audio <= 2.3.21 - Reflected Cross-Site Scripting via sourate and lang Parameters

The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' parameter in all versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T09:24:25.651Z. Updated 2026-04-08T16:34:31.883Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:34 WIB

Official record

MedPublished 10 Dec 2024, 15:56 WIB

CVE-2024-8256

Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches

In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API.

Excerpt language: en.

Showing 2361 to 2380 of 3433.First page Next page

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T08:56:55.195Z. Updated 2024-12-10T15:35:59.297Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated10 Dec 2024, 22:35 WIB

Official record

MedPublished 10 Dec 2024, 15:23 WIB

CVE-2024-11940

Property Hive Mortgage Calculator <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via price Parameter

The Property Hive Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘price’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T08:23:39.768Z. Updated 2026-04-08T16:35:36.991Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

MedPublished 10 Dec 2024, 15:20 WIB

CVE-2024-45709

SolarWinds Web Help Desk Local File Read Vulnerability

SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to use non-default development/test mode making exposure to the vulnerability very limited.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T08:20:06.921Z. Updated 2024-12-10T19:53:27.023Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated11 Dec 2024, 02:53 WIB

Official record

UnscoredPublished 10 Dec 2024, 14:48 WIB

CVE-2024-47946

OS Command Execution through Arbitrary File Upload

If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T07:48:42.166Z. Updated 2025-11-03T22:21:57.517Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 05:21 WIB

Official record

UnscoredPublished 10 Dec 2024, 14:35 WIB

CVE-2024-28138

OS Command Injection

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T07:35:06.842Z. Updated 2025-11-03T21:54:20.568Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 04:54 WIB

Official record

UnscoredPublished 10 Dec 2024, 13:00 WIB

CVE-2024-11107

System Dashboard < 2.8.15 - Unauthenticated Stored XSS

The System Dashboard WordPress plugin before 2.8.15 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T06:00:02.187Z. Updated 2024-12-10T15:15:07.287Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Dec 2024, 22:15 WIB

Official record

UnscoredPublished 10 Dec 2024, 13:00 WIB

CVE-2024-10708

System Dashboard < 2.8.15 - Admin+ Path Traversal

The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T06:00:01.931Z. Updated 2024-12-10T15:27:29.260Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Dec 2024, 22:27 WIB

Official record

HighPublished 10 Dec 2024, 12:24 WIB

CVE-2023-6947

Best WordPress Gallery Plugin – FooGallery <= 2.4.16 - Authenticated (Contributor+) Directory Traversal

The Best WordPress Gallery Plugin – FooGallery plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.26. This makes it possible for authenticated attackers, with contributor level or higher to read the contents of arbitrary folders on the server, which can contain sensitive…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T05:24:41.940Z. Updated 2026-04-08T16:58:25.396Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:58 WIB

Official record

HighPublished 10 Dec 2024, 12:00 WIB

CVE-2024-21542

CVE-2024-21542

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T05:00:01.546Z. Updated 2026-08-03T15:25:49.786Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated03 Aug 2026, 22:25 WIB

Official record

HighPublished 10 Dec 2024, 11:23 WIB

CVE-2024-11205

WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refu…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T04:23:41.091Z. Updated 2024-12-10T21:09:53.252Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated11 Dec 2024, 04:09 WIB

Official record

CritPublished 10 Dec 2024, 09:25 WIB

CVE-2024-37143

CVE-2024-37143

Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T02:25:33.225Z. Updated 2024-12-11T17:16:29.723Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated12 Dec 2024, 00:16 WIB

Official record

HighPublished 10 Dec 2024, 09:11 WIB

CVE-2024-37144

CVE-2024-37144

Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to RCM 3.7.6.0 (for RCM 3.7.x train), Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior to 5.1.1, and Dell…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T02:11:13.298Z. Updated 2024-12-10T21:27:23.301Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated11 Dec 2024, 04:27 WIB

Official record

HighPublished 10 Dec 2024, 07:12 WIB

CVE-2024-54198

Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely compromise the remote servic…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T00:12:47.729Z. Updated 2024-12-10T21:28:02.565Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated11 Dec 2024, 04:28 WIB

Official record

HighPublished 10 Dec 2024, 07:12 WIB

CVE-2024-54197

Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)

SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in Server-Side Request Forgery (SSRF) which could have a low impact on integrity and confidentialit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T00:12:42.296Z. Updated 2024-12-10T21:28:24.296Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated11 Dec 2024, 04:28 WIB

Official record

MedPublished 10 Dec 2024, 07:12 WIB

CVE-2024-47585

Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to gain higher access levels than they should have by exploiting improper authorization checks, resulting in privilege escalation. While authorizations for import and export are distinguished, a single authorization is applied …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T00:12:29.987Z. Updated 2024-12-10T21:28:59.358Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated11 Dec 2024, 04:28 WIB

Official record

MedPublished 10 Dec 2024, 07:12 WIB

CVE-2024-47582

XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA

Due to missing validation of XML input, an unauthenticated attacker could send malicious input to an endpoint which leads to XML Entity Expansion attack. This causes limited impact on availability of the application.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T00:12:24.270Z. Updated 2024-12-10T20:38:26.239Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated11 Dec 2024, 03:38 WIB

Official record

MedPublished 10 Dec 2024, 07:12 WIB

CVE-2024-47581

Missing Authorization check in SAP HCM (Approve Timesheets version 4)

SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.There is low impact on integrity of the application. Confidentiality and availibility are not impacted.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T00:12:17.567Z. Updated 2024-12-10T15:37:24.770Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 22:37 WIB

Official record

MedPublished 10 Dec 2024, 07:12 WIB

CVE-2024-47580

Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)

An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an internal server file and subsequently downloading the generated PDF, the attacker can read any file on the server with no effect on integrity or availability.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T00:12:11.655Z. Updated 2024-12-16T19:16:09.928Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated17 Dec 2024, 02:16 WIB

Official record

MedPublished 10 Dec 2024, 07:12 WIB

CVE-2024-47579

Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)

An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the upload functionality to copy an internal file into a font file and subsequently using the download functionality to retrieve that file allows the attacker to read any…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-10T00:12:05.039Z. Updated 2024-12-16T19:16:35.048Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated17 Dec 2024, 02:16 WIB

Official record