Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 3821–3840 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

UnscoredPublished 02 Nov 2024, 03:41 WIB

CVE-2024-44233

CVE-2024-44233

The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a maliciously crafted video file may lead to unexpected system termination.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T20:41:58.745Z. Updated 2026-04-02T18:15:27.216Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:15 WIB

Official record

UnscoredPublished 02 Nov 2024, 03:41 WIB

CVE-2024-44232

CVE-2024-44232

The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a maliciously crafted video file may lead to unexpected system termination.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T20:41:57.990Z. Updated 2026-04-02T18:14:34.454Z.

Showing 3821 to 3840 of 4054.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:14 WIB

Official record

UnscoredPublished 02 Nov 2024, 03:41 WIB

CVE-2024-44234

CVE-2024-44234

The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Parsing a maliciously crafted video file may lead to unexpected system termination.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T20:41:55.504Z. Updated 2026-04-02T18:07:46.558Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:07 WIB

Official record

MedPublished 01 Nov 2024, 23:53 WIB

CVE-2024-41744

IBM CICS TX Standard cross-site request forgery

IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:53:32.755Z. Updated 2024-11-01T17:22:23.878Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated02 Nov 2024, 00:22 WIB

Official record

MedPublished 01 Nov 2024, 23:48 WIB

CVE-2024-41745

IBM CICS TX Standard cross-site scripting

IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:48:49.374Z. Updated 2024-11-01T17:23:58.422Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated02 Nov 2024, 00:23 WIB

Official record

MedPublished 01 Nov 2024, 23:40 WIB

CVE-2024-41741

IBM TXSeries for Multiplatforms information disclosure

IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:40:49.569Z. Updated 2024-11-01T17:24:30.450Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated02 Nov 2024, 00:24 WIB

Official record

MedPublished 01 Nov 2024, 23:36 WIB

CVE-2024-41738

IBM TXSeries for Multiplatforms information disclosure

IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:36:39.955Z. Updated 2024-11-01T17:25:09.421Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated02 Nov 2024, 00:25 WIB

Official record

HighPublished 01 Nov 2024, 23:22 WIB

CVE-2024-51492

Zusam vulnerable to stored XSS, allowing token theft via crafted SVG

Zusam is a free and open-source way to self-host private forums. Prior to version 0.5.6, specially crafted SVG files uploaded to the service as images allow for unrestricted script execution on (raw) image load. With certain payloads, theft of the target user’s long-lived session token is possible. Note that Zusam, at …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:22:46.645Z. Updated 2024-11-01T20:18:15.274Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated02 Nov 2024, 03:18 WIB

Official record

MedPublished 01 Nov 2024, 23:19 WIB

CVE-2024-51483

changedetection.io Path Traversal vulnerability

changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch files, `source:file:///etc/passwd` can be used to retrieve local system files, where the more traditional `file:///etc/passwd` gets blocked. Version 0.47.5 fixes the issue.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:19:49.670Z. Updated 2024-11-01T17:30:47.107Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Nov 2024, 00:30 WIB

Official record

HighPublished 01 Nov 2024, 23:16 WIB

CVE-2024-49770

oak's path traversal allows transfer of hidden files within the served root directory

`oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow transferring of hidden files with `Context.send` API. However, prior to version 17.1.3, this can be bypassed by encoding `/` as its URL encoded form `%2F`. For …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:16:29.482Z. Updated 2024-11-01T17:35:10.386Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated02 Nov 2024, 00:35 WIB

Official record

HighPublished 01 Nov 2024, 23:00 WIB

CVE-2024-10662

Tenda AC15 SetOnlineDevName formSetDeviceName stack-based overflow

A vulnerability was found in Tenda AC15 15.03.05.19 and classified as critical. This issue affects the function formSetDeviceName of the file /goform/SetOnlineDevName. The manipulation of the argument devName leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:00:16.399Z. Updated 2024-11-05T15:25:38.625Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Nov 2024, 22:25 WIB

Official record

HighPublished 01 Nov 2024, 23:00 WIB

CVE-2024-10661

Tenda AC15 SetDlnaCfg stack-based overflow

A vulnerability has been found in Tenda AC15 15.03.05.19 and classified as critical. This vulnerability affects the function SetDlnaCfg of the file /goform/SetDlnaCfg. The manipulation of the argument scanList leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T16:00:13.148Z. Updated 2024-11-05T15:26:23.637Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated05 Nov 2024, 22:26 WIB

Official record

MedPublished 01 Nov 2024, 22:31 WIB

CVE-2024-10660

ESAFENET CDG HookService.java deleteHook sql injection

A vulnerability, which was classified as critical, was found in ESAFENET CDG 5. This affects the function deleteHook of the file /com/esafenet/servlet/policy/HookService.java. The manipulation of the argument hookId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T15:31:15.299Z. Updated 2024-11-05T15:27:13.864Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Nov 2024, 22:27 WIB

Official record

MedPublished 01 Nov 2024, 22:31 WIB

CVE-2024-10659

ESAFENET CDG CDGAuthoriseTempletService.java delSystemEncryptPolicy sql injection

A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. Affected by this issue is the function delSystemEncryptPolicy of the file /com/esafenet/servlet/document/CDGAuthoriseTempletService.java. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T15:31:12.101Z. Updated 2024-11-05T15:27:49.769Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Nov 2024, 22:27 WIB

Official record

MedPublished 01 Nov 2024, 22:00 WIB

CVE-2024-10658

Tongda OA check_seal.php sql injection

A vulnerability classified as critical was found in Tongda OA up to 11.10. Affected by this vulnerability is an unknown functionality of the file /pda/approve_center/check_seal.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the pub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T15:00:07.012Z. Updated 2024-11-01T19:08:18.099Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Nov 2024, 02:08 WIB

Official record

MedPublished 01 Nov 2024, 22:00 WIB

CVE-2024-10657

Tongda OA prcs_info.php sql injection

A vulnerability classified as critical has been found in Tongda OA up to 11.10. Affected is an unknown function of the file /pda/approve_center/prcs_info.php. The manipulation of the argument RUN_ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T15:00:05.165Z. Updated 2024-11-01T19:08:48.431Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated02 Nov 2024, 02:08 WIB

Official record

MedPublished 01 Nov 2024, 21:31 WIB

CVE-2024-10656

Tongda OA 2017 apply.php sql injection

A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. This issue affects some unknown processing of the file /pda/meeting/apply.php. The manipulation of the argument mr_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T14:31:04.576Z. Updated 2024-11-01T15:10:27.062Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Nov 2024, 22:10 WIB

Official record

MedPublished 01 Nov 2024, 21:22 WIB

CVE-2024-37209

WordPress User Rights Access Manager plugin <= 1.1.2 - Broken Access Control vulnerability

Access Control vulnerability in Prism IT Systems User Rights Access Manager allows . This issue affects User Rights Access Manager: from n/a through 1.1.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T14:22:44.821Z. Updated 2026-04-28T16:09:56.700Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:09 WIB

Official record

MedPublished 01 Nov 2024, 21:18 WIB

CVE-2024-49256

WordPress Htaccess File Editor plugin <= 1.0.18 - Broken Access Control vulnerability

Incorrect Authorization vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Htaccess File Editor: from n/a through <= 1.0.18.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T14:18:46.447Z. Updated 2026-04-28T16:10:23.715Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

MedPublished 01 Nov 2024, 21:18 WIB

CVE-2024-48045

WordPress Happy Elementor Addons plugin <= 3.12.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.12.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-01T14:18:45.827Z. Updated 2026-04-28T16:10:22.217Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record