Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 3101–3120 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

MedPublished 09 Nov 2024, 07:43 WIB

CVE-2024-52313

data.all authenticated users can obtain incorrect object level authorizations

An authenticated data.all user is able to manipulate a getDataset query to fetch additional information regarding the parent Environment resource that the user otherwise would not able to fetch by directly querying the object via getEnvironment in data.all.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-09T00:43:00.250Z. Updated 2025-10-14T19:26:56.176Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 02:26 WIB

Official record

MedPublished 09 Nov 2024, 07:42 WIB

CVE-2024-10953

data.all authenticated users can perform mutating update operations on persisted notification records

An authenticated data.all user is able to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user is not a member of.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-09T00:42:55.584Z. Updated 2025-10-14T19:03:41.864Z.

Showing 3101 to 3120 of 4054.First page Next page

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 02:03 WIB

Official record

MedPublished 09 Nov 2024, 07:42 WIB

CVE-2024-52311

data.all does not invalidate authentication token upon user logout

Authentication tokens issued via Cognito in data.all are not invalidated on log out, allowing for previously authenticated user to continue execution of authorized API Requests until token is expired.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-09T00:42:49.246Z. Updated 2025-10-14T19:25:04.120Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated15 Oct 2025, 02:25 WIB

Official record

HighPublished 09 Nov 2024, 05:28 WIB

CVE-2024-52007

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag ( <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]> could produce X…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T22:28:20.169Z. Updated 2024-11-12T18:47:14.559Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated13 Nov 2024, 01:47 WIB

Official record

HighPublished 09 Nov 2024, 05:24 WIB

CVE-2024-52009

Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlant…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T22:24:15.300Z. Updated 2024-11-12T19:19:58.293Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated13 Nov 2024, 02:19 WIB

Official record

HighPublished 09 Nov 2024, 05:20 WIB

CVE-2024-52000

Reflected Cross-site Scripting exploit in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. Affected versions are subject to a reflected Cross-site Scripting (XSS) exploit by way of editing a request's payload which can lead to malicious javascript execution. This issue has been addressed in version 3.2.0 via systematic escaping of error messages…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T22:20:02.422Z. Updated 2024-11-12T15:59:23.446Z.

CVSS8.1v3.0KEVNot listedEPSSPresentUpdated12 Nov 2024, 22:59 WIB

Official record

MedPublished 09 Nov 2024, 05:18 WIB

CVE-2024-52001

Portal user is able to access forbidden services information in Combodo iTop

Combodo iTop is a simple, web based IT Service Management tool. In affected versions portal users are able to access forbidden services information. This issue has been addressed in version 3.2.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T22:18:17.828Z. Updated 2024-11-12T15:22:35.988Z.

CVSS4.3v3.0KEVNot listedEPSSPresentUpdated12 Nov 2024, 22:22 WIB

Official record

HighPublished 09 Nov 2024, 05:16 WIB

CVE-2024-52002

Cross-Site Request Forgery (CSRF) in several iTop pages

Combodo iTop is a simple, web based IT Service Management tool. Several url endpoints are subject to a Cross-Site Request Forgery (CSRF) vulnerability. Please refer to the linked GHSA for the complete list. This issue has been addressed in version 3.2.0 and all users are advised to upgrade. There are no known workaroun…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T22:16:35.543Z. Updated 2024-11-12T15:23:26.819Z.

CVSS7.6v3.0KEVNot listedEPSSPresentUpdated12 Nov 2024, 22:23 WIB

Official record

HighPublished 09 Nov 2024, 05:10 WIB

CVE-2024-52004

Remote code execution vulnerabilities in MediaCMS

MediaCMS is an open source video and media CMS, written in Python/Django and React, featuring a REST API. MediaCMS has been prone to vulnerabilities that upon special cases can lead to remote code execution. All versions before v4.1.0 are susceptible, and users are highly recommended to upgrade. The vulnerabilities are…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T22:10:07.361Z. Updated 2024-11-12T19:56:53.955Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated13 Nov 2024, 02:56 WIB

Official record

MedPublished 09 Nov 2024, 04:31 WIB

CVE-2024-11026

Intelligent Apps Freenow App Keystore SSL.java hard-coded password

A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown functionality of the file ch/qos/logback/core/net/ssl/SSL.java of the component Keystore Handler. The manipulation of the argument DEFAULT_KEYSTORE_PASSWORD with the inp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T21:31:04.769Z. Updated 2024-11-12T15:34:24.548Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated12 Nov 2024, 22:34 WIB

Official record

MedPublished 09 Nov 2024, 04:06 WIB

CVE-2024-21994

CVE-2024-21994 Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exploit by an authenticated attacker could lead to a service crash.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T21:06:32.380Z. Updated 2024-11-09T15:52:48.138Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Nov 2024, 22:52 WIB

Official record

HighPublished 09 Nov 2024, 01:40 WIB

CVE-2024-51997

The Attestation Results Token can be arbitrarily modified without being detected in Trustee

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Token**) token, generated by AS, could be manipulated by MITM attacker, but the verifier (CoCo Verification Demander like KBS) could still verify it successfully. In the payload of AR…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T18:40:31.701Z. Updated 2024-11-12T17:17:50.487Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated13 Nov 2024, 00:17 WIB

Official record

HighPublished 09 Nov 2024, 00:58 WIB

CVE-2024-9841

OpenText ArcSight Management Center and ArcSight Platform Stored XSS

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T17:58:53.697Z. Updated 2024-11-08T21:12:48.283Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated09 Nov 2024, 04:12 WIB

Official record

CritPublished 08 Nov 2024, 23:15 WIB

CVE-2024-45763

CVE-2024-45763

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T16:15:34.861Z. Updated 2024-11-13T18:39:26.443Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated14 Nov 2024, 01:39 WIB

Official record

CritPublished 08 Nov 2024, 23:08 WIB

CVE-2024-45764

CVE-2024-45764

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell recommends custome…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T16:08:01.769Z. Updated 2024-11-08T17:03:26.047Z.

CVSS9v3.1KEVNot listedEPSSPresentUpdated09 Nov 2024, 00:03 WIB

Official record

CritPublished 08 Nov 2024, 22:59 WIB

CVE-2024-45765

CVE-2024-45765

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T15:59:33.760Z. Updated 2024-11-08T17:03:50.218Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated09 Nov 2024, 00:03 WIB

Official record

UnscoredPublished 08 Nov 2024, 21:37 WIB

CVE-2024-50378

Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow dat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T14:37:09.699Z. Updated 2024-11-08T19:02:35.081Z.

CVSS—KEVNot listedEPSSPresentUpdated09 Nov 2024, 02:02 WIB

Official record

UnscoredPublished 08 Nov 2024, 19:15 WIB

CVE-2024-50592

Local Privilege Escalation via Race Condition

An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the service queries the server for a list of files and thei…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T12:15:25.835Z. Updated 2025-11-03T22:28:29.966Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 05:28 WIB

Official record

UnscoredPublished 08 Nov 2024, 19:06 WIB

CVE-2024-50593

Hardcoded Service Password

An attacker with local access to the medical office computer can access restricted functions of the Elefant Service tool by using a hard-coded "Hotline" password in the Elefant service binary, which is shipped with the software.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T12:06:28.619Z. Updated 2025-11-03T22:28:31.428Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 05:28 WIB

Official record

UnscoredPublished 08 Nov 2024, 19:01 WIB

CVE-2024-50591

Local Privilege Escalation via Command Injection

An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The command injection can be exploited by communicating with the Elefant Update Service which is running as "S…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-08T12:01:18.862Z. Updated 2025-11-03T22:28:28.503Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 05:28 WIB

Official record