Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 461–480 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

UnscoredPublished 28 Jan 2025, 08:03 WIB

CVE-2024-45336

Sensitive headers incorrectly sent after cross-domain redirect in net/http

The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T01:03:24.869Z. Updated 2025-09-18T18:41:11.116Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Sep 2025, 01:41 WIB

Official record

UnscoredPublished 28 Jan 2025, 08:03 WIB

CVE-2024-45340

GOAUTH credential leak in cmd/go

Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T01:03:24.605Z. Updated 2025-01-30T19:14:21.639Z.

Showing 461 to 480 of 4273.First page Next page

CVSS—KEVNot listedEPSSPresentUpdated31 Jan 2025, 02:14 WIB

Official record

UnscoredPublished 28 Jan 2025, 08:03 WIB

CVE-2024-45341

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T01:03:24.353Z. Updated 2025-02-21T18:03:33.296Z.

CVSS—KEVNot listedEPSSPresentUpdated22 Feb 2025, 01:03 WIB

Official record

UnscoredPublished 28 Jan 2025, 08:03 WIB

CVE-2024-45339

Vulnerability when creating log files in github.com/golang/glog

When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T01:03:24.105Z. Updated 2026-04-30T03:56:03.352Z.

CVSS—KEVNot listedEPSSPresentUpdated30 Apr 2026, 10:56 WIB

Official record

CritPublished 28 Jan 2025, 07:39 WIB

CVE-2024-12649

CVE-2024-12649

Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:39:54.686Z. Updated 2025-01-28T15:17:20.913Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:17 WIB

Official record

CritPublished 28 Jan 2025, 07:39 WIB

CVE-2024-12648

CVE-2024-12648

Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:39:15.098Z. Updated 2025-01-28T15:17:30.024Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:17 WIB

Official record

CritPublished 28 Jan 2025, 07:38 WIB

CVE-2024-12647

CVE-2024-12647

Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:38:17.973Z. Updated 2025-01-28T15:17:41.020Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:17 WIB

Official record

MedPublished 28 Jan 2025, 07:22 WIB

CVE-2023-50316

IBM Sterling B2B Integrator information disclosure

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:22:53.423Z. Updated 2025-01-28T15:17:53.763Z.

CVSS6.3v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:17 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:13 WIB

CVE-2022-3365

Emote Interactive Remote Mouse Server command injection due to weak encoding

Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:13:45.409Z. Updated 2025-01-28T15:18:05.386Z.

CVSS—KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:18 WIB

Official record

MedPublished 28 Jan 2025, 07:10 WIB

CVE-2024-27263

IBM Sterling B2B Integrator information disclosure

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to obtain sensitive information from the dashboard UI using man in the middle techniques.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:10:27.595Z. Updated 2025-01-28T15:18:15.494Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:18 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:00 WIB

CVE-2024-48310

CVE-2024-48310

AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:00:00.000Z. Updated 2025-03-25T13:25:29.259Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 20:25 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:00 WIB

CVE-2024-55968

CVE-2024-55968

An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication (IPC). Specifically, the service does not veri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:00:00.000Z. Updated 2025-03-24T16:20:21.772Z.

CVSS—KEVNot listedEPSSPresentUpdated24 Mar 2025, 23:20 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:00 WIB

CVE-2024-56529

CVE-2024-56529

Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on a victim's browser. After a user logs in, they are authenticated and the session identifier is valid. Then, a remote attacker can access the victim's web panel …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:00:00.000Z. Updated 2025-03-14T16:12:11.469Z.

CVSS—KEVNot listedEPSSPresentUpdated14 Mar 2025, 23:12 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:00 WIB

CVE-2024-57376

CVE-2024-57376

Buffer Overflow vulnerability in D-Link DSR-150, DSR-150N, DSR-250, DSR-250N, DSR-500N, DSR-1000N from 3.13 to 3.17B901C allows unauthenticated users to execute remote code execution.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:00:00.000Z. Updated 2025-01-29T15:39:34.881Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 22:39 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:00 WIB

CVE-2024-57514

CVE-2024-57514

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL. This allows the attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:00:00.000Z. Updated 2025-01-29T15:29:40.839Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 22:29 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:00 WIB

CVE-2024-57519

CVE-2024-57519

An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:00:00.000Z. Updated 2025-03-25T13:22:29.914Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Mar 2025, 20:22 WIB

Official record

UnscoredPublished 28 Jan 2025, 07:00 WIB

CVE-2025-22917

CVE-2025-22917

A reflected cross-site scripting (XSS) vulnerability in Audemium ERP <=0.9.0 allows remote attackers to execute an arbitrary JavaScript payload in the web browser of a user by including a malicious payload into the 'type' parameter of list.php.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-28T00:00:00.000Z. Updated 2025-01-29T16:03:43.299Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Jan 2025, 23:03 WIB

Official record

MedPublished 28 Jan 2025, 06:36 WIB

CVE-2024-28786

IBM QRadar SIEM information disclosure

IBM QRadar SIEM 7.5 transmits sensitive or security-critical data in cleartext in a communication channel that could be obtained by an unauthorized actor using man in the middle techniques.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-27T23:36:08.015Z. Updated 2025-01-28T15:18:25.774Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:18 WIB

Official record

MedPublished 28 Jan 2025, 06:28 WIB

CVE-2022-31749

Authenticated arbitrary file read/write in WatchGuard Fireware OS

An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-27T23:28:40.596Z. Updated 2025-01-28T15:18:35.068Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:18 WIB

Official record

LowPublished 28 Jan 2025, 05:57 WIB

CVE-2025-24369

Anubis has a bot protection bypass when a sophisticated attacker asks to pass a challenge of difficulty 0

Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce (such as 42069), and then …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-27T22:57:26.728Z. Updated 2025-01-28T15:18:44.746Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Jan 2025, 22:18 WIB

Official record