Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 3241–3260 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

HighPublished 08 Nov 2024, 00:55 WIB

CVE-2024-51995

Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop

Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` that is allowed. This issue has been addressed in version 3.2.0 by applying the same access control pattern as in `UI.php` to the `ajax.render.php` page which does not allow arbitrary…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T17:55:15.598Z. Updated 2024-11-07T18:16:51.358Z.

CVSS7.1v3.0KEVNot listedEPSSPresentUpdated08 Nov 2024, 01:16 WIB

Official record

HighPublished 08 Nov 2024, 00:50 WIB

CVE-2024-51989

Cross-site Scripting (XSS) Vulnerability in PasswordPusher

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability was identified in the PasswordPusher application, affecting versions `v1.41.1` through and including `v.1.48.0`. The issue arises from an un-sanitized parameter which could allow a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 3241 to 3260 of 4054.First page Next page

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T17:50:41.881Z. Updated 2024-11-07T19:09:41.347Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated08 Nov 2024, 02:09 WIB

Official record

LowPublished 08 Nov 2024, 00:46 WIB

CVE-2024-51758

Exported files stored in default (`public`) filesystem if not reconfigured in filament

Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without havi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T17:46:36.151Z. Updated 2024-11-21T16:23:23.083Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 23:23 WIB

Official record

HighPublished 08 Nov 2024, 00:42 WIB

CVE-2024-45794

SQL Injection in CreateUser API in devtron

devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API (/orchestrator/user). This issue has been addressed in version 0.7.2 and all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T17:42:58.662Z. Updated 2024-11-07T19:33:42.084Z.

CVSS8.3v3.1KEVNot listedEPSSPresentUpdated08 Nov 2024, 02:33 WIB

Official record

CritPublished 08 Nov 2024, 00:31 WIB

CVE-2024-47073

Dataease arbitrary interface access vulnerability

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The vulnerability has been fixed in v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T17:31:23.535Z. Updated 2024-11-21T16:23:47.430Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 23:23 WIB

Official record

MedPublished 08 Nov 2024, 00:00 WIB

CVE-2024-10965

emqx neuron JSON File schema information disclosure

A vulnerability classified as problematic was found in emqx neuron up to 2.10.0. Affected by this vulnerability is an unknown functionality of the file /api/v2/schema of the component JSON File Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The patch is named c9ce39747e0…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T17:00:12.641Z. Updated 2024-11-08T16:43:43.952Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Nov 2024, 23:43 WIB

Official record

MedPublished 08 Nov 2024, 00:00 WIB

CVE-2024-10964

emqx neuron plugin_handle.c handle_add_plugin buffer overflow

A vulnerability classified as critical has been found in emqx neuron up to 2.10.0. Affected is the function handle_add_plugin in the library cmd.library of the file plugins/restful/plugin_handle.c. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. It is recommended to apply a patc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T17:00:09.615Z. Updated 2024-11-08T16:54:35.833Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated08 Nov 2024, 23:54 WIB

Official record

HighPublished 07 Nov 2024, 23:40 WIB

CVE-2024-40715

CVE-2024-40715

A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle (MITM) attack to exploit this vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T16:40:37.566Z. Updated 2025-03-25T16:53:22.623Z.

CVSS7.7v3.0KEVNot listedEPSSPresentUpdated25 Mar 2025, 23:53 WIB

Official record

HighPublished 07 Nov 2024, 23:02 WIB

CVE-2024-10963

Pam: improper hostname interpretation in pam_access leads to access control bypass

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T16:02:34.873Z. Updated 2026-10-13T02:17:22.807Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated13 Oct 2026, 09:17 WIB

Official record

MedPublished 07 Nov 2024, 22:22 WIB

CVE-2024-10668

Auth Bypass in Quickshare

There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk in the Downloads folder…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T15:22:24.280Z. Updated 2024-11-21T10:32:45.723Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated21 Nov 2024, 17:32 WIB

Official record

UnscoredPublished 07 Nov 2024, 22:07 WIB

CVE-2024-8378

Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass

The Safe SVG WordPress plugin before 2.2.6 has its sanitisation code is only running for paths that call wp_handle_upload, but not for example for code that uses wp_handle_sideload which is often used to upload attachments via raw POST data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T15:07:36.788Z. Updated 2024-11-07T19:53:59.721Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Nov 2024, 02:53 WIB

Official record

UnscoredPublished 07 Nov 2024, 22:02 WIB

CVE-2024-9926

Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access

The Jetpack WordPress plugin does not have proper authorisation in one of its REST endpoint, allowing any authenticated users, such as subscriber to read arbitrary feedbacks data sent via the Jetpack Contact Form

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T15:02:38.050Z. Updated 2024-11-07T19:53:07.815Z.

CVSS—KEVNot listedEPSSPresentUpdated08 Nov 2024, 02:53 WIB

Official record

HighPublished 07 Nov 2024, 20:32 WIB

CVE-2024-43440

Moodle: lfi vulnerability when restoring malformed block backups

A flaw was found in moodle. A local file may include risks when restoring block backups.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:32:16.113Z. Updated 2024-11-07T14:38:59.743Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated07 Nov 2024, 21:38 WIB

Official record

HighPublished 07 Nov 2024, 20:31 WIB

CVE-2024-43438

Moodle: idor in feedback non-respondents report allows messaging arbitrary site users

A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:31:20.238Z. Updated 2024-11-07T16:48:06.773Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated07 Nov 2024, 23:48 WIB

Official record

HighPublished 07 Nov 2024, 20:29 WIB

CVE-2024-43436

Moodle: site administration sql injection via xmldb editor

A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:29:57.912Z. Updated 2024-11-07T15:57:00.698Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated07 Nov 2024, 22:57 WIB

Official record

HighPublished 07 Nov 2024, 20:28 WIB

CVE-2024-43434

Moodle: csrf risk in feedback non-respondents report

The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:28:27.671Z. Updated 2024-11-07T15:56:27.455Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated07 Nov 2024, 22:56 WIB

Official record

HighPublished 07 Nov 2024, 20:27 WIB

CVE-2024-43431

Moodle: idor in badges allows deletion of arbitrary badges

A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:27:07.968Z. Updated 2024-11-07T15:55:57.730Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated07 Nov 2024, 22:55 WIB

Official record

HighPublished 07 Nov 2024, 20:24 WIB

CVE-2024-43428

Moodle: cache poisoning via injection into storage

To address a cache poisoning risk in Moodle, additional validation for local storage was required.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:24:11.512Z. Updated 2025-02-10T22:26:35.081Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated11 Feb 2025, 05:26 WIB

Official record

HighPublished 07 Nov 2024, 20:22 WIB

CVE-2024-43426

Moodle: arbitrary file read risk through pdftex

A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:22:42.839Z. Updated 2025-02-10T22:27:06.037Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated11 Feb 2025, 05:27 WIB

Official record

HighPublished 07 Nov 2024, 20:21 WIB

CVE-2024-43425

Moodle: remote code execution via calculated question types

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-07T13:21:59.014Z. Updated 2024-11-07T14:45:17.071Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated07 Nov 2024, 21:45 WIB

Official record