Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 3441–3460 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

LowPublished 06 Nov 2024, 04:09 WIB

CVE-2024-51745

Wasmtime doesn't fully sandbox all the Windows device filenames

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²"…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T21:09:43.943Z. Updated 2024-11-05T21:28:34.001Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated06 Nov 2024, 04:28 WIB

Official record

HighPublished 06 Nov 2024, 03:06 WIB

CVE-2024-7995

Autodesk VRED Design Privilege Escalation Vulnerability

A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to code execution.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3441 to 3460 of 4054.First page Next page

Published 2024-11-05T20:06:43.521Z. Updated 2025-08-26T18:27:06.333Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 01:27 WIB

Official record

LowPublished 06 Nov 2024, 02:16 WIB

CVE-2024-51752

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.13.2 and all users are …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T19:16:41.831Z. Updated 2024-11-05T20:15:07.923Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated06 Nov 2024, 03:15 WIB

Official record

LowPublished 06 Nov 2024, 02:14 WIB

CVE-2024-51753

Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix

The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This issue has been patched in version 0.4.1. All users are advised …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T19:14:47.097Z. Updated 2024-11-05T20:16:29.928Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated06 Nov 2024, 03:16 WIB

Official record

LowPublished 06 Nov 2024, 01:54 WIB

CVE-2024-51746

Use of incorrect Rekor entries during verification in gitsign

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature being verified. The param…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 1.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:54:39.494Z. Updated 2024-11-05T20:30:02.393Z.

CVSS1.8v4.0KEVNot listedEPSSPresentUpdated06 Nov 2024, 03:30 WIB

Official record

HighPublished 06 Nov 2024, 01:49 WIB

CVE-2024-51735

Stored Cross-site Scripting to RCE on Osmedeus Web Server

Osmedeus is a Workflow Engine for Offensive Security. Cross-site Scripting (XSS) occurs on the Osmedues web server when viewing results from the workflow, allowing commands to be executed on the server. When using a workflow that contains the summary module, it generates reports in HTML and Markdown formats. The defaul…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:49:05.950Z. Updated 2024-11-05T21:47:36.314Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated06 Nov 2024, 04:47 WIB

Official record

MedPublished 06 Nov 2024, 01:42 WIB

CVE-2024-50335

Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This can be exploited to steal CSRF tokens an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:42:14.203Z. Updated 2024-11-05T18:56:13.460Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 01:56 WIB

Official record

MedPublished 06 Nov 2024, 01:41 WIB

CVE-2024-50333

RCE in ModuleBuilder in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels() function can be used to write attacker-controlled data into the custom language file that will be included at the runtime. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:41:24.241Z. Updated 2024-11-05T18:57:18.443Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 01:57 WIB

Official record

HighPublished 06 Nov 2024, 01:40 WIB

CVE-2024-50332

Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for thi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:40:14.977Z. Updated 2024-11-05T18:58:13.409Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 01:58 WIB

Official record

MedPublished 06 Nov 2024, 01:37 WIB

CVE-2024-0134

CVE-2024-0134

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this vulnerability might lead to d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:37:31.699Z. Updated 2024-11-05T18:52:00.366Z.

CVSS4.1v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 01:52 WIB

Official record

HighPublished 06 Nov 2024, 01:37 WIB

CVE-2024-49774

ModuleScanner flaws in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses token_get_all to parse PHP scripts and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:37:05.422Z. Updated 2024-11-05T18:59:06.730Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 01:59 WIB

Official record

MedPublished 06 Nov 2024, 01:35 WIB

CVE-2024-49773

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. `current_post` parameter in `export` entry point can be abused to perform blind…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:35:11.102Z. Updated 2024-11-05T18:59:49.367Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 01:59 WIB

Official record

HighPublished 06 Nov 2024, 01:31 WIB

CVE-2024-49772

Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all data in database. This issue has been addressed in releases …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:31:20.615Z. Updated 2024-11-05T19:00:51.220Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 02:00 WIB

Official record

MedPublished 06 Nov 2024, 01:20 WIB

CVE-2024-49377

Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain reflected XSS vulnerabilities in the login dialog and the standalone application key confirmation dialog. An attacker who successfully talked a victim into clicking on a specially crafted l…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:20:27.173Z. Updated 2024-11-05T19:01:22.444Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 02:01 WIB

Official record

MedPublished 06 Nov 2024, 01:17 WIB

CVE-2024-51493

API key access in settings without reauthentication in OctoPrint

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user's or - if the victim h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:17:29.812Z. Updated 2024-11-05T19:01:48.187Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 02:01 WIB

Official record

MedPublished 06 Nov 2024, 01:13 WIB

CVE-2024-51740

SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. This vulnerability can be used to create HTTP requests on behalf of the server, from a low privileged user. The user portal form manager has been fixed to only instantiate classes derived from it. This issue has been addressed in versions 2.7.11, 3.0.5, 3.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:13:05.227Z. Updated 2024-11-05T19:02:20.310Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 02:02 WIB

Official record

HighPublished 06 Nov 2024, 01:11 WIB

CVE-2024-51739

Users enumeration allowed through Rest API in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. Unauthenticated user can perform users enumeration, which can make it easier to bruteforce a valid account. As a fix the sentence displayed after resetting password no longer shows if the user exists or not. This fix is included in versions 2.7.11, 3.0.5, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T18:11:37.244Z. Updated 2024-11-05T18:50:23.340Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated06 Nov 2024, 01:50 WIB

Official record

UnscoredPublished 06 Nov 2024, 00:11 WIB

CVE-2024-50138

bpf: Use raw_spinlock_t in ringbuf

In the Linux kernel, the following vulnerability has been resolved: bpf: Use raw_spinlock_t in ringbuf The function __bpf_ringbuf_reserve is invoked from a tracepoint, which disables preemption. Using spinlock_t in this context can lead to a "sleep in atomic" warning in the RT variant. This issue is illustrated in th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T17:11:01.518Z. Updated 2026-05-11T20:46:10.704Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:46 WIB

Official record

UnscoredPublished 06 Nov 2024, 00:11 WIB

CVE-2024-50137

reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC

In the Linux kernel, the following vulnerability has been resolved: reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver") was added. Add the judgment condition to avoid errors when…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T17:11:00.861Z. Updated 2026-05-11T20:46:09.575Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:46 WIB

Official record

UnscoredPublished 06 Nov 2024, 00:11 WIB

CVE-2024-50136

net/mlx5: Unregister notifier on eswitch init failure

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Unregister notifier on eswitch init failure It otherwise remains registered and a subsequent attempt at eswitch enabling might trigger warnings of the sort: [ 682.589148] ------------[ cut here ]------------ [ 682.590204] notifier callba…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-05T17:11:00.231Z. Updated 2026-05-23T15:54:35.375Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:54 WIB

Official record