Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 3761–3780 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45164

CVE-2024-45164

Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-06T16:18:38.490Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Nov 2024, 23:18 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45185

CVE-2024-45185

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, Modem 5123, Modem 5300. There is an out-of-bounds write due to a heap overflow in the GPRS protocol.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-06T18:54:26.362Z.

Showing 3761 to 3780 of 4054.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated07 Nov 2024, 01:54 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45882

CVE-2024-45882

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_profile.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T16:57:45.107Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2024, 23:57 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45884

CVE-2024-45884

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMGroup.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T16:57:11.329Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2024, 23:57 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45885

CVE-2024-45885

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `autodiscovery_clear.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T16:54:21.528Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2024, 23:54 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45887

CVE-2024-45887

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `doOpenVPN.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T17:01:25.323Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2024, 00:01 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45888

CVE-2024-45888

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.'

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T16:53:54.301Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2024, 23:53 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45889

CVE-2024-45889

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T17:01:17.248Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2024, 00:01 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45890

CVE-2024-45890

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T17:00:03.821Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2024, 00:00 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45891

CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T16:54:11.546Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2024, 23:54 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-45893

CVE-2024-45893

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T16:53:44.085Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2024, 23:53 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48050

CVE-2024-48050

In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-06T21:02:15.321Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Nov 2024, 04:02 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48052

CVE-2024-48052

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-06T19:21:09.673Z.

CVSS—KEVNot listedEPSSPresentUpdated07 Nov 2024, 02:21 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48057

CVE-2024-48057

localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-05T17:28:51.570Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Nov 2024, 00:28 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48059

CVE-2024-48059

gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission. An attacker can inject malicious content into a WebSocket message. When a victim accesses this session, the malicious JavaScript is executed in the victim's browser.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-05T21:24:41.074Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Nov 2024, 04:24 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48061

CVE-2024-48061

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2026-03-27T15:51:35.444Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Mar 2026, 22:51 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48336

CVE-2024-48336

The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a crafted package, aka Bug #…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-04T20:06:56.981Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2024, 03:06 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48463

CVE-2024-48463

Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within the Markdown docs viewer.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2025-01-16T06:03:24.086Z.

CVSS—KEVNot listedEPSSPresentUpdated16 Jan 2025, 13:03 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-48809

CVE-2024-48809

An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service via the onos-a1t component of the sdran-in-a-box, specifically the DeleteWatcher function.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2024-11-05T21:18:03.960Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Nov 2024, 04:18 WIB

Official record

UnscoredPublished 04 Nov 2024, 07:00 WIB

CVE-2024-51127

CVE-2024-51127

An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-04T00:00:00.000Z. Updated 2026-07-05T00:50:34.568Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Jul 2026, 07:50 WIB

Official record