Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 441–460 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 28 Jan 2025, 14:21 WIB

CVE-2025-0321

ElementsKit Pro <= 3.7.8 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter

The ElementsKit Pro plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T07:21:40.701Z. Updated 2026-04-08T16:41:13.771Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:41 WIB

Official record

HighPublished 28 Jan 2025, 13:38 WIB

CVE-2024-13509

WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting

The WS Form LITE and PRO plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the url parameter in all versions up to, and including, 1.10.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 441 to 460 of 4273.First page Next page

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T06:38:42.309Z. Updated 2026-04-08T17:06:53.872Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:06 WIB

Official record

CritPublished 28 Jan 2025, 13:38 WIB

CVE-2024-13448

ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data

The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T06:38:41.703Z. Updated 2026-04-08T17:02:37.066Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:02 WIB

Official record

UnscoredPublished 28 Jan 2025, 13:00 WIB

CVE-2024-12807

Social Share Buttons for WordPress <= 2.7 - Admin+ Stored XSS

The Social Share Buttons for WordPress plugin through 2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T06:00:11.412Z. Updated 2025-01-28T15:15:04.341Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:15 WIB

Official record

UnscoredPublished 28 Jan 2025, 13:00 WIB

CVE-2024-12723

Infility Global <= 2.9.8 - Reflected XSS

The Infility Global WordPress plugin through 2.9.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T06:00:04.840Z. Updated 2025-01-28T15:15:18.941Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:15 WIB

Official record

MedPublished 28 Jan 2025, 11:36 WIB

CVE-2025-24810

CVE-2025-24810

Cross-site scripting vulnerability exists in Simple Image Sizes 3.2.3 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product with the administrative privilege and accessing the settings screen.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T04:36:53.852Z. Updated 2025-01-28T14:59:09.996Z.

CVSS4.8v3.0KEVNot listedEPSSPresentUpdated28 Jan 2025, 21:59 WIB

Official record

MedPublished 28 Jan 2025, 11:35 WIB

CVE-2025-23084

CVE-2025-23084

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.6 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T04:35:15.236Z. Updated 2025-11-04T21:09:38.409Z.

CVSS5.6v3.0KEVNot listedEPSSPresentUpdated05 Nov 2025, 04:09 WIB

Official record

HighPublished 28 Jan 2025, 11:21 WIB

CVE-2024-11135

Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees

The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all versions up to, and including, 3.9.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T04:21:32.872Z. Updated 2026-04-08T17:13:58.964Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:13 WIB

Official record

MedPublished 28 Jan 2025, 11:11 WIB

CVE-2024-53881

CVE-2024-53881

NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial of service.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T04:11:29.908Z. Updated 2025-01-28T15:12:54.967Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:12 WIB

Official record

HighPublished 28 Jan 2025, 11:09 WIB

CVE-2024-0146

CVE-2024-0146

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T04:09:24.737Z. Updated 2025-01-28T15:14:22.830Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:14 WIB

Official record

MedPublished 28 Jan 2025, 11:07 WIB

CVE-2024-53869

CVE-2024-53869

NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A successful exploit of this vulnerability might lead to information disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T04:07:47.554Z. Updated 2025-01-28T15:15:04.737Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:15 WIB

Official record

LowPublished 28 Jan 2025, 11:04 WIB

CVE-2024-0149

CVE-2024-0149

NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerability might lead to limited information disclosure.

Excerpt language: en.

Severity low: primary CNA CVSS 3.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T04:04:19.542Z. Updated 2025-03-27T20:03:01.774Z.

CVSS3.3v3.1KEVNot listedEPSSPresentUpdated28 Mar 2025, 03:03 WIB

Official record

MedPublished 28 Jan 2025, 10:27 WIB

CVE-2024-0147

CVE-2024-0147

NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data tampering.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T03:27:50.092Z. Updated 2025-01-28T15:20:41.498Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:20 WIB

Official record

HighPublished 28 Jan 2025, 10:26 WIB

CVE-2024-0150

CVE-2024-0150

NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or data tampering.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T03:26:55.489Z. Updated 2025-01-28T15:21:22.520Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:21 WIB

Official record

MedPublished 28 Jan 2025, 10:18 WIB

CVE-2024-0140

CVE-2024-0140

NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T03:18:30.778Z. Updated 2025-01-28T15:15:30.052Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:15 WIB

Official record

MedPublished 28 Jan 2025, 10:10 WIB

CVE-2024-0137

CVE-2024-0137

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host’s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T03:10:36.813Z. Updated 2025-01-28T15:15:38.917Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:15 WIB

Official record

HighPublished 28 Jan 2025, 10:09 WIB

CVE-2024-0136

CVE-2024-0136

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T03:09:53.568Z. Updated 2025-01-28T15:15:51.481Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:15 WIB

Official record

HighPublished 28 Jan 2025, 10:09 WIB

CVE-2024-0135

CVE-2024-0135

NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T03:09:02.626Z. Updated 2025-01-28T15:16:03.279Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:16 WIB

Official record

MedPublished 28 Jan 2025, 08:50 WIB

CVE-2024-22315

IBM Fusion improper communication restriction

IBM Fusion and IBM Fusion HCI 2.3.0 through 2.8.2 is vulnerable to insecure network connection by allowing an attacker who gains access to a Fusion container to establish an external network connection.

Excerpt language: en.

Severity medium: primary CNA CVSS 4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T01:50:54.965Z. Updated 2025-01-28T15:16:13.786Z.

CVSS4v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:16 WIB

Official record

UnscoredPublished 28 Jan 2025, 08:03 WIB

CVE-2025-22865

ParsePKCS1PrivateKey panic with partial keys in crypto/x509

Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T01:03:25.121Z. Updated 2025-01-30T19:14:21.959Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jan 2025, 02:14 WIB

Official record