Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 3021–3040 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

UnscoredPublished 05 Dec 2024, 06:29 WIB

CVE-2018-9403

CVE-2018-9403

In the MTK_FLP_MSG_HAL_DIAG_REPORT_DATA_NTF handler of flp2hal_- interface.c, there is a possible stack buffer overflow due to a missing bounds check. This could lead to local escalation of privilege in a privileged process with System execution privileges needed. User interaction is not needed for expl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:29:24.147Z. Updated 2024-12-05T16:19:12.212Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:19 WIB

Official record

UnscoredPublished 05 Dec 2024, 06:27 WIB

CVE-2018-9402

CVE-2018-9402

In multiple functions of gl_proc.c, there is a buffer overwrite due to a missing bounds check. This could lead to escalation of privileges in the kernel.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:27:42.808Z. Updated 2024-12-05T16:21:56.367Z.

CVSS

Showing 3021 to 3040 of 3433.First page Next page

—

KEVNot listed

EPSSPresent

Updated05 Dec 2024, 23:21 WIB

Official record

CritPublished 05 Dec 2024, 06:27 WIB

CVE-2024-54221

WordPress FAT Services Booking plugin <= 5.6 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking.This issue affects FAT Services Booking: from n/a through <= 5.6.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:27:15.475Z. Updated 2026-04-28T16:10:47.700Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

UnscoredPublished 05 Dec 2024, 06:14 WIB

CVE-2018-9400

CVE-2018-9400

In gt1x_debug_write_proc and gt1x_tool_write of drivers/input/touchscreen/mediatek/GT1151/gt1x_generic.c and gt1x_tools.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:14:32.596Z. Updated 2024-12-05T16:29:20.701Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:29 WIB

Official record

UnscoredPublished 05 Dec 2024, 06:13 WIB

CVE-2018-9399

CVE-2018-9399

In /proc/driver/wmt_dbg driver, there are several possible out of bounds writes. These could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:13:11.225Z. Updated 2024-12-05T16:32:36.314Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:32 WIB

Official record

UnscoredPublished 05 Dec 2024, 06:11 WIB

CVE-2018-9398

CVE-2018-9398

In fm_set_stat of mediatek FM radio driver, there is a possible OOB write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:11:48.916Z. Updated 2024-12-05T16:43:06.134Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:43 WIB

Official record

UnscoredPublished 05 Dec 2024, 06:10 WIB

CVE-2018-9397

CVE-2018-9397

In WMT_unlocked_ioctl of MTK WMT device driver, there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:10:14.272Z. Updated 2024-12-05T16:52:04.806Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Dec 2024, 23:52 WIB

Official record

MedPublished 05 Dec 2024, 06:00 WIB

CVE-2024-12183

DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting

A vulnerability, which was classified as problematic, was found in DedeCMS 5.7.116. This affects the function RemoveXSS of the file /plus/carbuyaction.php of the component HTTP POST Request Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T23:00:13.891Z. Updated 2024-12-05T15:04:56.839Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 22:04 WIB

Official record

MedPublished 05 Dec 2024, 05:31 WIB

CVE-2024-12182

DedeCMS soft_add.php cross site scripting

A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7.116. Affected by this issue is some unknown functionality of the file /member/soft_add.php. The manipulation of the argument body leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T22:31:05.504Z. Updated 2024-12-05T14:55:18.542Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 21:55 WIB

Official record

HighPublished 05 Dec 2024, 05:20 WIB

CVE-2024-53982

Arbitrary file download in Zoo-Project Echo Example

ZOO-Project is a C-based WPS (Web Processing Service) implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is performed in this param…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T22:20:53.986Z. Updated 2024-12-05T18:48:13.359Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated06 Dec 2024, 01:48 WIB

Official record

MedPublished 05 Dec 2024, 05:00 WIB

CVE-2024-12181

DedeCMS SWF File uploads_add.php cross site scripting

A vulnerability classified as problematic was found in DedeCMS 5.7.116. Affected by this vulnerability is an unknown functionality of the file /member/uploads_add.php of the component SWF File Handler. The manipulation of the argument mediatype leads to cross site scripting. The attack can be launched remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T22:00:14.645Z. Updated 2024-12-05T14:52:40.916Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 21:52 WIB

Official record

MedPublished 05 Dec 2024, 05:00 WIB

CVE-2024-12180

DedeCMS article_add.php cross site scripting

A vulnerability classified as problematic has been found in DedeCMS 5.7.116. Affected is an unknown function of the file /member/article_add.php. The manipulation of the argument body leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T22:00:12.689Z. Updated 2024-12-05T14:46:10.618Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 21:46 WIB

Official record

UnscoredPublished 05 Dec 2024, 04:59 WIB

CVE-2018-9396

CVE-2018-9396

In rpc_msg_handler and related handlers of drivers/misc/mediatek/eccci/port_rpc.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T21:59:02.879Z. Updated 2024-12-05T17:08:24.572Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 00:08 WIB

Official record

LowPublished 05 Dec 2024, 04:06 WIB

CVE-2024-38829

Spring LDAP sensitive data exposure for case-sensitive comparisons

A vulnerability in Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0. The usage of String.toLowerCase() and String.toUpperCase() has some…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T21:06:05.021Z. Updated 2024-12-10T14:33:55.692Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated10 Dec 2024, 21:33 WIB

Official record

HighPublished 05 Dec 2024, 00:31 WIB

CVE-2024-12147

Netgear R6900 HTTP Header upgrade_check.cgi buffer overflow

A vulnerability was found in Netgear R6900 1.0.1.26_1.0.20. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file upgrade_check.cgi of the component HTTP Header Handler. The manipulation of the argument Content-Length leads to buffer overflow. The attack can be launche…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T17:31:04.826Z. Updated 2025-01-14T14:06:27.563Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated14 Jan 2025, 21:06 WIB

Official record

UnscoredPublished 05 Dec 2024, 00:20 WIB

CVE-2018-9395

CVE-2018-9395

In mtk_cfg80211_vendor_packet_keep_alive_start and mtk_cfg80211_vendor_set_config of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_vendor.c, there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T17:20:55.185Z. Updated 2024-12-05T17:13:11.248Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 00:13 WIB

Official record

UnscoredPublished 05 Dec 2024, 00:19 WIB

CVE-2018-9394

CVE-2018-9394

In mtk_p2p_wext_set_key of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_p2p.c, there is a possible OOB write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T17:19:10.992Z. Updated 2024-12-05T17:15:12.151Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 00:15 WIB

Official record

UnscoredPublished 05 Dec 2024, 00:18 WIB

CVE-2024-12148

CVE-2024-12148

Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T17:18:21.584Z. Updated 2024-12-05T18:45:02.579Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 01:45 WIB

Official record

UnscoredPublished 05 Dec 2024, 00:18 WIB

CVE-2024-12149

CVE-2024-12149

Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T17:18:01.565Z. Updated 2024-12-05T18:46:29.926Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 01:46 WIB

Official record

UnscoredPublished 05 Dec 2024, 00:17 WIB

CVE-2024-12151

CVE-2024-12151

Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T17:17:31.712Z. Updated 2024-12-05T18:48:20.286Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 01:48 WIB

Official record