Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 3061–3080 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

UnscoredPublished 04 Dec 2024, 21:20 WIB

CVE-2024-53131

nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints". This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints. This p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:20:37.455Z. Updated 2026-05-11T20:51:27.227Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:51 WIB

Official record

UnscoredPublished 04 Dec 2024, 21:20 WIB

CVE-2024-53130

nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint When using the "block:block_dirty_buffer" tracepoint, mark_buffer_dirty() may cause a NULL pointer dereference, or a general protection fault when KASAN is enabled. This happens because, si…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3061 to 3080 of 3433.First page Next page

Published 2024-12-04T14:20:36.741Z. Updated 2026-05-11T20:51:25.849Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:51 WIB

Official record

UnscoredPublished 04 Dec 2024, 21:20 WIB

CVE-2024-53129

drm/rockchip: vop: Fix a dereferenced before check warning

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop: Fix a dereferenced before check warning The 'state' can't be NULL, we should check crtc_state. Fix warning: drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1096 vop_plane_atomic_async_check() warn: variable dereferenced before check '…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:20:35.907Z. Updated 2026-05-11T20:51:24.713Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:51 WIB

Official record

UnscoredPublished 04 Dec 2024, 21:20 WIB

CVE-2024-53128

sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers

In the Linux kernel, the following vulnerability has been resolved: sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers When CONFIG_KASAN_SW_TAGS and CONFIG_KASAN_STACK are enabled, the object_is_on_stack() function may produce incorrect results due to the presence of tags in the obj pointer, while t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:20:34.985Z. Updated 2026-05-11T20:51:23.550Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 03:51 WIB

Official record

HighPublished 04 Dec 2024, 21:20 WIB

CVE-2024-53127

Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"

In the Linux kernel, the following vulnerability has been resolved: Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" The commit 8396c793ffdf ("mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K") increased the max_req_size, even for 4K pages, causing various issues: - Panic booting the kern…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:20:31.547Z. Updated 2026-08-05T11:43:57.321Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:43 WIB

Official record

HighPublished 04 Dec 2024, 21:20 WIB

CVE-2024-53126

vdpa: solidrun: Fix UB bug with devres

In the Linux kernel, the following vulnerability has been resolved: vdpa: solidrun: Fix UB bug with devres In psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to pcim_iomap_regions() is placed on the stack. Neither pcim_iomap_regions() nor the functions it calls copy that string. Should the string la…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:20:30.788Z. Updated 2026-08-05T11:43:56.206Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 18:43 WIB

Official record

HighPublished 04 Dec 2024, 21:11 WIB

CVE-2024-53125

bpf: sync_linked_regs() must preserve subreg_def

In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg_def marks, otherwise the following example is rewritten by verifier incorrectly when BPF_F_TEST_RND_HI32 flag is set: 0: call bpf_ktime_get_ns …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:11:09.326Z. Updated 2026-10-15T21:41:45.968Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 04:41 WIB

Official record

HighPublished 04 Dec 2024, 21:08 WIB

CVE-2024-51465

IBM App Connect Enterprise Certified Container command execution

IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:08:58.092Z. Updated 2024-12-04T14:29:54.978Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:29 WIB

Official record

MedPublished 04 Dec 2024, 21:03 WIB

CVE-2024-7488

Business Logic Error in RestApp Inc.'s Online Ordering System

Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks. This issue affects Online Ordering System: 8.2.1. NOTE: Vulnerability fixed in version 8.2.2 and does not exist before 8.2.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:03:49.141Z. Updated 2026-06-03T11:31:31.362Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated03 Jun 2026, 18:31 WIB

Official record

MedPublished 04 Dec 2024, 21:00 WIB

CVE-2024-12138

horilla create_skills deserialization

A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimbursement/key_result_current_value_update/create_meetings/create_skills. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T14:00:14.890Z. Updated 2024-12-04T14:22:19.291Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:22 WIB

Official record

MedPublished 04 Dec 2024, 19:37 WIB

CVE-2024-11935

Email Address Obfuscation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter

The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T12:37:46.701Z. Updated 2026-04-08T17:05:50.387Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:05 WIB

Official record

CritPublished 04 Dec 2024, 19:02 WIB

CVE-2024-10576

Unauthorized factory reset of Infinix devices

Infinix devices contain a pre-loaded "com.transsion.agingfunction" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android system permissions. After multiple attempts to contact the vendor we did not r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T12:02:22.601Z. Updated 2024-12-04T21:01:06.241Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 04:01 WIB

Official record

HighPublished 04 Dec 2024, 18:40 WIB

CVE-2024-8894

Out-of-bounds Write vulnerability in ODA SDK versions < 2025.10

Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing proper checks on received SectionIterator data can trigger an unhandled exception. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:40:22.411Z. Updated 2024-12-04T21:02:00.422Z.

CVSS8.1v4.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 04:02 WIB

Official record

HighPublished 04 Dec 2024, 18:25 WIB

CVE-2024-52269

AI Assistant PDF Document Spoofing in DocuSign

User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This issue affects DocuSign: through 2024-12-04.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:25:45.886Z. Updated 2025-01-06T17:39:56.341Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated07 Jan 2025, 00:39 WIB

Official record

LowPublished 04 Dec 2024, 18:16 WIB

CVE-2024-54158

CVE-2024-54158

In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding

Excerpt language: en.

Severity low: primary CNA CVSS 3.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:16:27.904Z. Updated 2024-12-04T14:09:10.593Z.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:09 WIB

Official record

MedPublished 04 Dec 2024, 18:16 WIB

CVE-2024-54157

CVE-2024-54157

In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:16:27.323Z. Updated 2024-12-04T14:09:10.737Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:09 WIB

Official record

MedPublished 04 Dec 2024, 18:16 WIB

CVE-2024-54156

CVE-2024-54156

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack

Excerpt language: en.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:16:26.573Z. Updated 2024-12-04T14:09:10.904Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:09 WIB

Official record

LowPublished 04 Dec 2024, 18:16 WIB

CVE-2024-54155

CVE-2024-54155

In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication

Excerpt language: en.

Severity low: primary CNA CVSS 3.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:16:25.997Z. Updated 2024-12-04T14:09:11.056Z.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:09 WIB

Official record

HighPublished 04 Dec 2024, 18:16 WIB

CVE-2024-54154

CVE-2024-54154

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

Excerpt language: en.

Severity high: primary CNA CVSS 8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:16:25.244Z. Updated 2024-12-04T14:25:35.177Z.

CVSS8v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:25 WIB

Official record

LowPublished 04 Dec 2024, 18:16 WIB

CVE-2024-54153

CVE-2024-54153

In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter

Excerpt language: en.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T11:16:24.494Z. Updated 2024-12-04T14:09:11.280Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:09 WIB

Official record