Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 3121–3140 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-42451

CVE-2024-42451

A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by calling a series of methods over an external protocol, ultimately retrieving the credentials using a malicious setup on the attacker's side. This exposes sensitive data, which could …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.677Z. Updated 2024-12-04T14:53:46.665Z.

CVSS7.7v3.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:53 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-42453

CVE-2024-42453

A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 3121 to 3140 of 3433.First page Next page

Published 2024-12-04T01:06:04.668Z. Updated 2024-12-04T14:54:37.763Z.

CVSS7.4v3.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:54 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-45207

CVE-2024-45207

DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently, allowing the attacker to ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.660Z. Updated 2024-12-04T15:21:30.380Z.

CVSS7v3.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 22:21 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-42457

CVE-2024-42457

A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combination of methods in a remote management interface. This can be achieved using a session object that allows for credential enumeration and exploitation, leading to the leak of plaintex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.658Z. Updated 2024-12-04T16:00:32.213Z.

CVSS7.7v3.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 23:00 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-42452

CVE-2024-42452

A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials, effectively escalating privileges to system-level access. This allows the attacker to upload files to the server with elevated privileges. The vulnerability exists because remote …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.654Z. Updated 2024-12-04T16:03:26.578Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 23:03 WIB

Official record

MedPublished 04 Dec 2024, 08:06 WIB

CVE-2024-45206

CVE-2024-45206

A vulnerability in Veeam Service Provider Console has been identified, which allows to perform arbitrary HTTP requests to arbitrary hosts of the network and get information about internal resources.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.650Z. Updated 2025-03-13T18:36:04.573Z.

CVSS6.5v3.0KEVNot listedEPSSPresentUpdated14 Mar 2025, 01:36 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-45205

CVE-2024-45205

An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point. Affected Products: UniFi iOS App (Version 10.17.7 and earlier) Mitigati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.643Z. Updated 2024-12-04T16:29:27.075Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 23:29 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-40717

CVE-2024-40717

A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privileges by default. The use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.636Z. Updated 2025-03-13T17:40:27.483Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated14 Mar 2025, 00:40 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-42456

CVE-2024-42456

A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates critical configuration settings, such as modifying the trusted client certificate used for authentication on a specific port. This can result in unauthorized access, enabling the use…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.627Z. Updated 2024-12-04T16:48:57.686Z.

CVSS8.8v3.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 23:48 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-42455

CVE-2024-42455

A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with service account privileges. The vulnerability is cause…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.626Z. Updated 2024-12-05T10:59:46.913Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated05 Dec 2024, 17:59 WIB

Official record

HighPublished 04 Dec 2024, 08:06 WIB

CVE-2024-42449

CVE-2024-42449

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T01:06:04.625Z. Updated 2025-03-13T14:54:19.282Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated13 Mar 2025, 21:54 WIB

Official record

MedPublished 04 Dec 2024, 07:23 WIB

CVE-2024-11479

Authenticated HTML Injection in Issuetrak Ticket Comment Function

A HTML Injection vulnerability was identified in Issuetrak version 17.1 that could be triggered by an authenticated user. HTML markup could be added to comments of tickets, which when submitted will render in the emails sent to all users on that ticket.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:23:39.944Z. Updated 2024-12-04T14:49:43.102Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated04 Dec 2024, 21:49 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-37574

CVE-2024-37574

The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the com.iui.mobile.presentation.MobileActivity.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-11T20:23:11.956Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 03:23 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-37575

CVE-2024-37575

The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place phone calls without user interaction by sending a crafted intent via the org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity component.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-11T15:58:53.219Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Dec 2024, 22:58 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-39163

CVE-2024-39163

binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-11T15:51:03.525Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Dec 2024, 22:51 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-39219

CVE-2024-39219

An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier firmware version, exposing the device to previously patched vulnerabilities.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-11T16:49:52.467Z.

CVSS—KEVNot listedEPSSPresentUpdated11 Dec 2024, 23:49 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-48453

CVE-2024-48453

An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-11T20:15:14.977Z.

CVSS—KEVNot listedEPSSPresentUpdated12 Dec 2024, 03:15 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-50947

CVE-2024-50947

An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-05T19:12:59.606Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 02:12 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-51210

CVE-2024-51210

Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and correspondi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-05T17:13:13.998Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 00:13 WIB

Official record

UnscoredPublished 04 Dec 2024, 07:00 WIB

CVE-2024-52676

CVE-2024-52676

Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to Cross Site Scripting (XSS) via /bcc_forum/members/home.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-04T00:00:00.000Z. Updated 2024-12-05T19:17:13.674Z.

CVSS—KEVNot listedEPSSPresentUpdated06 Dec 2024, 02:17 WIB

Official record