Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,054 published records · 16 KEV · 4,054 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,054 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2576.3%
High1,14328%
Med1,56539%
Low1323.3%
None10.02%
Legacy00.00%
Unscored95624%

Matching records by UTC month

Nov 244,054

Signal coverage

KEV-listed: 16
With a forecast: 4,054
Unknown date: 0
Unscored severity: 956

Share of cohort: KEV 0.39% · forecast 100% · unscored 24%.

Showing 41–60 of 4,054By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 1,143, Medium · 4.0–6.9 1,565, Low · 0.1–3.9 132, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 956

LowPublished 30 Nov 2024, 01:20 WIB

CVE-2024-52800

Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI

veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common us…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T18:20:27.825Z. Updated 2024-12-02T11:19:36.866Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated02 Dec 2024, 18:19 WIB

Official record

MedPublished 30 Nov 2024, 01:15 WIB

CVE-2024-52003

X-Forwarded-Prefix Header still allows for Open Redirect in traefik

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 41 to 60 of 4054.First page Next page

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T18:15:34.123Z. Updated 2024-12-02T11:19:36.740Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated02 Dec 2024, 18:19 WIB

Official record

CritPublished 30 Nov 2024, 01:11 WIB

CVE-2024-49360

Path traversal in Sandboxie

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T18:11:58.261Z. Updated 2024-12-02T20:32:39.725Z.

CVSS9.2v3.1KEVNot listedEPSSPresentUpdated03 Dec 2024, 03:32 WIB

Official record

HighPublished 29 Nov 2024, 23:55 WIB

CVE-2024-49804

IBM Security Verify Access Appliance privilege escalation

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to unnecessary permissions used to perform certain tasks.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T16:55:32.323Z. Updated 2024-11-29T17:09:49.542Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

CritPublished 29 Nov 2024, 23:53 WIB

CVE-2024-49806

IBM Security Verify Access Appliance hard coded credentials

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T16:53:45.208Z. Updated 2024-11-29T17:09:49.806Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

CritPublished 29 Nov 2024, 23:52 WIB

CVE-2024-49805

IBM Security Verify Access Appliance hard coded credentials

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T16:52:15.174Z. Updated 2024-11-29T17:09:49.677Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

CritPublished 29 Nov 2024, 23:50 WIB

CVE-2024-49803

IBM Security Verify Access Appliance command execution

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T16:50:31.964Z. Updated 2024-11-29T17:09:49.402Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

CritPublished 29 Nov 2024, 20:06 WIB

CVE-2024-11992

Path traversal vulnerability in Quick.CMS

Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and download any file if it has the appropriate permissions outside of documentroot configured on the server via the aDirFiles%5B0%5D parameter in the admin.php page. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T13:06:30.404Z. Updated 2024-11-29T13:24:05.020Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 20:24 WIB

Official record

MedPublished 29 Nov 2024, 20:00 WIB

CVE-2024-11990

Cross-Site Scripting (XSS) en SurgeMail de NetWin

A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate payload injected into vulnerable parameters.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T13:00:57.502Z. Updated 2024-11-29T13:25:05.049Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 20:25 WIB

Official record

MedPublished 29 Nov 2024, 16:52 WIB

CVE-2024-47094

Logging of sitesecret to automations log

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T09:52:18.988Z. Updated 2025-09-11T07:16:20.513Z.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated11 Sep 2025, 14:16 WIB

Official record

CritPublished 29 Nov 2024, 16:06 WIB

CVE-2024-50357

CVE-2024-50357

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The fac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T09:06:56.251Z. Updated 2024-12-02T18:15:27.594Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated03 Dec 2024, 01:15 WIB

Official record

MedPublished 29 Nov 2024, 15:06 WIB

CVE-2024-11014

CVE-2024-11014

Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a attacker to hijack the authentication of screens on the device via the management interface.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T08:06:19.712Z. Updated 2025-07-24T14:37:20.170Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated24 Jul 2025, 21:37 WIB

Official record

HighPublished 29 Nov 2024, 15:03 WIB

CVE-2024-11013

CVE-2024-11013

Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T08:03:07.458Z. Updated 2025-07-24T14:40:37.401Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated24 Jul 2025, 21:40 WIB

Official record

MedPublished 29 Nov 2024, 14:40 WIB

CVE-2024-9044

XML External Entity (XXE) Vulnerability in EasyTax

A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T07:40:08.009Z. Updated 2024-11-29T13:43:41.079Z.

CVSS4.6v4.0KEVNot listedEPSSPresentUpdated29 Nov 2024, 20:43 WIB

Official record

CritPublished 29 Nov 2024, 14:03 WIB

CVE-2024-11482

CVE-2024-11482

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T07:03:33.494Z. Updated 2025-03-18T14:56:37.259Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:56 WIB

Official record

HighPublished 29 Nov 2024, 14:01 WIB

CVE-2024-11481

CVE-2024-11481

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T07:01:44.562Z. Updated 2024-11-29T13:55:59.611Z.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 20:55 WIB

Official record

HighPublished 29 Nov 2024, 13:57 WIB

CVE-2024-11983

Billion Electric router - OS Command Injection

Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T06:57:24.047Z. Updated 2024-11-29T14:10:39.561Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:10 WIB

Official record

HighPublished 29 Nov 2024, 13:45 WIB

CVE-2024-11982

Billion Electric router - Plaintext Storage of a Password

Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T06:45:33.819Z. Updated 2024-11-29T14:22:56.724Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:22 WIB

Official record

HighPublished 29 Nov 2024, 13:21 WIB

CVE-2024-11981

Billion Electric router - Authentication Bypass

Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T06:21:31.476Z. Updated 2024-11-29T14:31:52.528Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:31 WIB

Official record

HighPublished 29 Nov 2024, 13:03 WIB

CVE-2024-11980

Billion Electric router - Missing Authentication

Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T06:03:04.983Z. Updated 2024-11-29T14:40:54.541Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 21:40 WIB

Official record