Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 3061–3080 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 10 Jan 2025, 07:00 WIB

CVE-2025-23111

CVE-2025-23111

An issue was discovered in REDCap 14.9.6. It allows HTML Injection via the Survey field name, exposing users to a redirection to a phishing website. An attacker can exploit this to trick the user that receives the survey into clicking on the field name, which redirects them to a phishing website. Thus, this allows mali…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-10T00:00:00.000Z. Updated 2025-01-13T20:50:35.709Z.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 03:50 WIB

Official record

MedPublished 10 Jan 2025, 07:00 WIB

CVE-2025-23112

CVE-2025-23112

An issue was discovered in REDCap 14.9.6. A stored cross-site scripting (XSS) vulnerability allows authenticated users to inject malicious scripts into the Survey field name of Survey. When a user receive the survey, if he clicks on the field name, it triggers the XSS payload.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3061 to 3080 of 4273.First page Next page

Published 2025-01-10T00:00:00.000Z. Updated 2025-01-13T20:47:26.043Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 03:47 WIB

Official record

LowPublished 10 Jan 2025, 07:00 WIB

CVE-2025-23113

CVE-2025-23113

An issue was discovered in REDCap 14.9.6. It has an action=myprojects&logout=1 CSRF issue in the alert-title while performing an upload of a CSV file containing a list of alert configuration. An attacker can send the victim a CSV file containing an HTML injection payload in the alert-title. Once the victim uploads the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-10T00:00:00.000Z. Updated 2025-01-13T20:35:35.849Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated14 Jan 2025, 03:35 WIB

Official record

HighPublished 10 Jan 2025, 05:32 WIB

CVE-2025-21380

Azure Marketplace SaaS Resources Information Disclosure Vulnerability

Improper access control in Azure SaaS Resources allows an authorized attacker to disclose information over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T22:32:46.772Z. Updated 2026-06-09T18:30:10.838Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated10 Jun 2026, 01:30 WIB

Official record

HighPublished 10 Jan 2025, 05:07 WIB

CVE-2025-21385

Microsoft Purview Information Disclosure Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T22:07:25.838Z. Updated 2026-06-09T18:30:11.802Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated10 Jun 2026, 01:30 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:28 WIB

CVE-2024-13312

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 11.8.0 before 12.3.10, from 12.4.0 before 12.4.9.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:28:53.431Z. Updated 2025-01-31T15:50:36.016Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jan 2025, 22:50 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:28 WIB

CVE-2024-13311

Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075

Vulnerability in Drupal Allow All File Extensions for file fields.This issue affects Allow All File Extensions for file fields: *.*.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:28:24.722Z. Updated 2025-01-31T15:43:38.167Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jan 2025, 22:43 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:27 WIB

CVE-2024-13310

Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074

Vulnerability in Drupal Git Utilities for Drupal.This issue affects Git Utilities for Drupal: *.*.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:27:59.058Z. Updated 2025-01-31T15:42:24.768Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jan 2025, 22:42 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:27 WIB

CVE-2024-13309

Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073

Improper Authentication vulnerability in Drupal Login Disable allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login Disable: from 2.0.0 before 2.1.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:27:35.812Z. Updated 2025-01-30T21:33:50.068Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jan 2025, 04:33 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:27 WIB

CVE-2024-13308

Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:27:03.983Z. Updated 2025-01-30T21:38:05.749Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jan 2025, 04:38 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:25 WIB

CVE-2024-13305

Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:25:32.400Z. Updated 2025-01-10T16:14:21.172Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Jan 2025, 23:14 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:25 WIB

CVE-2024-13304

Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:25:04.098Z. Updated 2025-01-10T17:53:34.294Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jan 2025, 00:53 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:24 WIB

CVE-2024-13303

Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

Missing Authorization vulnerability in Drupal Download All Files allows Forceful Browsing.This issue affects Download All Files: from 0.0.0 before 2.0.2.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:24:30.952Z. Updated 2025-01-10T17:55:12.067Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jan 2025, 00:55 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:24 WIB

CVE-2024-13302

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:24:05.171Z. Updated 2025-01-10T17:56:17.360Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jan 2025, 00:56 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:23 WIB

CVE-2024-13301

OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, fro…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:23:31.496Z. Updated 2025-01-10T16:15:41.342Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Jan 2025, 23:15 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:23 WIB

CVE-2024-13300

Print Anything - Critical - Unsupported - SA-CONTRIB-2024-066

Vulnerability in Drupal Print Anything.This issue affects Print Anything: *.*.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:23:03.508Z. Updated 2025-01-14T15:00:16.586Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Jan 2025, 22:00 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:22 WIB

CVE-2024-13299

Megamenu Framework - Critical - Unsupported - SA-CONTRIB-2024-065

Vulnerability in Drupal Megamenu Framework.This issue affects Megamenu Framework: *.*.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:22:31.347Z. Updated 2025-01-14T15:05:09.195Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Jan 2025, 22:05 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:21 WIB

CVE-2024-13298

Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:21:56.291Z. Updated 2025-01-10T16:16:43.369Z.

CVSS—KEVNot listedEPSSPresentUpdated10 Jan 2025, 23:16 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:21 WIB

CVE-2024-13297

Eloqua - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-063

Deserialization of Untrusted Data vulnerability in Drupal Eloqua allows Object Injection.This issue affects Eloqua: from 7.X-* before 7.X-1.15.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:21:09.904Z. Updated 2025-01-10T18:10:59.660Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jan 2025, 01:10 WIB

Official record

UnscoredPublished 10 Jan 2025, 03:19 WIB

CVE-2024-13296

Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-09T20:19:25.611Z. Updated 2025-01-10T18:11:48.262Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Jan 2025, 01:11 WIB

Official record