Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 3821–3840 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

LowPublished 06 Jan 2025, 23:38 WIB

CVE-2024-51472

IBM DevOps Deploy / IBM UrbanCode Deploy HTML injection

IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:38:11.973Z. Updated 2025-08-27T21:33:04.984Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 04:33 WIB

Official record

HighPublished 06 Jan 2025, 23:30 WIB

CVE-2025-21618

NiceGUI On Air authentication issue

NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, including browsers in incognito mode. This vulnerability is fixed in 2.9.1.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:30:11.349Z. Updated 2025-01-06T16:47:43.489Z.

Showing 3821 to 3840 of 4273.First page Next page

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated06 Jan 2025, 23:47 WIB

Official record

MedPublished 06 Jan 2025, 23:25 WIB

CVE-2025-21615

AAT allows data exfiltration by other apps installed on the same device

AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:25:27.758Z. Updated 2025-01-06T16:43:43.192Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated06 Jan 2025, 23:43 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56769

media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg

In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000_read_reg(). Local u8 rb[2] is used in i2c_transfer() as a read buffer; in case that call fails, the buff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:46.838Z. Updated 2026-05-11T20:58:43.110Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:58 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56768

bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP On x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP disabled can trigger the following bug, as pcpu_hot is unavailable: [ 8.471774] BUG: unable to handle page fault for addr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:46.133Z. Updated 2026-05-11T20:58:41.982Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:58 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56767

dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset

In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len input is error, or the atchan->free_descs_list is empty and mem…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:45.430Z. Updated 2026-05-11T20:58:40.804Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:58 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56766

mtd: rawnand: fix double free in atmel_pmecc_create_user()

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:44.676Z. Updated 2026-05-23T15:56:02.490Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:56 WIB

Official record

HighPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56765

powerpc/pseries/vas: Add close() callback in vas_vm_ops struct

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migration to unmap the paste address if the window is active. The p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:43.966Z. Updated 2026-08-05T11:46:25.642Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:46 WIB

Official record

HighPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56764

ublk: detach gendisk from ublk device if add_disk() fails

In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), gendisk is grabbed for aborting all inflight requests. And ublk_abort_requests() is called when exiting the uring context or handling timeout. If add_disk() fail…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:43.256Z. Updated 2026-08-05T11:46:24.574Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:46 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56763

tracing: Prevent bad count for tracing_cpumask_write

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:42.530Z. Updated 2026-05-11T20:58:35.918Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:58 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56761

x86/fred: Clear WFE in missing-ENDBRANCH #CPs

In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted across the instruction boundary. When the decoder finds an inappropria…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:41.112Z. Updated 2026-05-11T20:58:34.766Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:58 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56760

PCI/MSI: Handle lack of irqdomain gracefully

In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support: WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:40.369Z. Updated 2026-05-11T20:58:33.614Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:58 WIB

Official record

HighPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56759

btrfs: fix use-after-free when COWing tree bock and tracing is enabled

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:39.668Z. Updated 2026-08-05T11:46:23.511Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:46 WIB

Official record

UnscoredPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56758

btrfs: check folio mapping after unlock in relocate_one_folio()

In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio() When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping (like remove it with invalidate) befo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:38.942Z. Updated 2026-05-23T15:56:00.758Z.

CVSS—KEVNot listedEPSSPresentUpdated23 May 2026, 22:56 WIB

Official record

HighPublished 06 Jan 2025, 23:20 WIB

CVE-2024-56757

Bluetooth: btusb: mediatek: add intf release flow when usb disconnect

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data transmission. The interface need to be released before unregistering hci device when usb disconnect. Removing BT usb dongl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:38.228Z. Updated 2026-08-05T11:46:22.431Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:46 WIB

Official record

HighPublished 06 Jan 2025, 23:20 WIB

CVE-2025-21614

go-git clients vulnerable to DoS via maliciously crafted Git server replies

go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers reso…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:20:16.140Z. Updated 2025-08-26T19:48:04.692Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 02:48 WIB

Official record

CritPublished 06 Jan 2025, 23:13 WIB

CVE-2025-21613

go-git has an Argument Injection via the URL field

go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file trans…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:13:10.611Z. Updated 2025-01-06T16:45:02.671Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated06 Jan 2025, 23:45 WIB

Official record

MedPublished 06 Jan 2025, 23:02 WIB

CVE-2024-31914

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:02:35.742Z. Updated 2025-08-27T21:12:59.393Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated28 Aug 2025, 04:12 WIB

Official record

MedPublished 06 Jan 2025, 23:02 WIB

CVE-2024-31913

IBM Sterling B2B Integrator cross-site scripting

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T16:02:07.224Z. Updated 2025-01-06T16:48:35.945Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated06 Jan 2025, 23:48 WIB

Official record

HighPublished 06 Jan 2025, 22:47 WIB

CVE-2025-21612

Cross-site Scripting in TabberTransclude in Extension:TabberNeue

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-06T15:47:27.214Z. Updated 2025-08-26T19:48:04.827Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated27 Aug 2025, 02:48 WIB

Official record