Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 721–740 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

HighPublished 24 Dec 2024, 00:23 WIB

CVE-2024-56363

APTRS has SSTI vulnerability

APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input that is incorporated into a Jinja2 template. Specifically, w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T17:23:57.120Z. Updated 2024-12-24T01:32:59.318Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 08:32 WIB

Official record

HighPublished 24 Dec 2024, 00:19 WIB

CVE-2024-56362

Navidrome Stores JWT Secret in Plaintext in navidrome.db

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This vulnerability is fix…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 721 to 740 of 3433.First page Next page

Published 2024-12-23T17:19:51.108Z. Updated 2024-12-24T01:35:29.314Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 08:35 WIB

Official record

MedPublished 24 Dec 2024, 00:13 WIB

CVE-2024-53276

GHSL-2024-092: Open CORS policy in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS policy in app.js may allow an attacker to view the images of home-gallery when it is using the default settings. The following express middleware allows any website to make a cross site re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T17:13:46.115Z. Updated 2025-02-18T21:48:40.822Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:48 WIB

Official record

MedPublished 24 Dec 2024, 00:13 WIB

CVE-2024-53275

GHSL-2024-091: DNS rebinding attack in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, the default setup of home-gallery is vulnerable to DNS rebinding. Home-gallery is set up without TLS and user authentication by default, leaving it vulnerable to DNS rebinding. In this attack, an attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T17:13:42.772Z. Updated 2025-02-18T21:48:11.075Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:48 WIB

Official record

MedPublished 23 Dec 2024, 22:52 WIB

CVE-2024-56364

Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in 1.0.12 and ending in 1.1.13, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. This vulnerability is fixed in 1.1.13.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:52:06.327Z. Updated 2024-12-28T00:48:18.868Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Dec 2024, 07:48 WIB

Official record

MedPublished 23 Dec 2024, 22:43 WIB

CVE-2024-56326

Jinja has a sandbox breakout through indirect reference to format method

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:43:49.400Z. Updated 2025-11-03T19:32:16.045Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:32 WIB

Official record

MedPublished 23 Dec 2024, 22:37 WIB

CVE-2024-56201

Jinja has a sandbox breakout through malicious filenames

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:37:36.110Z. Updated 2025-02-18T21:47:42.763Z.

CVSS5.4v4.0KEVNot listedEPSSPresentUpdated19 Feb 2025, 04:47 WIB

Official record

CritPublished 23 Dec 2024, 22:30 WIB

CVE-2024-45387

Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrade to versio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:30:13.873Z. Updated 2024-12-24T01:47:40.228Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 08:47 WIB

Official record

UnscoredPublished 23 Dec 2024, 22:26 WIB

CVE-2024-23945

Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentall…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:26:54.477Z. Updated 2025-03-19T13:34:26.019Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Mar 2025, 20:34 WIB

Official record

HighPublished 23 Dec 2024, 22:26 WIB

CVE-2024-55947

Gogs has a Path Traversal in file update API

Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:26:47.507Z. Updated 2024-12-24T15:59:02.793Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 22:59 WIB

Official record

HighPublished 23 Dec 2024, 22:22 WIB

CVE-2024-54148

Gogs has a Path Traversal in file editing UI

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:22:48.244Z. Updated 2024-12-24T01:52:58.173Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 08:52 WIB

Official record

HighPublished 23 Dec 2024, 22:17 WIB

CVE-2024-53256

Rizin has a command injection via RzBinInfo bclass due legacy code

Rizin is a UNIX-like reverse engineering framework and command-line toolset. `rizin.c` still had an old snippet of code which suffered a command injection due the usage of `rz_core_cmdf` to invoke the command `m` which was removed in v0.1.x. A malicious binary defining `bclass` (part of RzBinInfo) is executed if `rclas…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T15:17:50.587Z. Updated 2024-12-24T01:55:31.439Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 08:55 WIB

Official record

LowPublished 23 Dec 2024, 21:05 WIB

CVE-2024-55539

CVE-2024-55539

Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux) before build 39185, Acronis Cyber Protect 16 (Linux) before build 39938.

Excerpt language: en.

Severity low: primary CNA CVSS 2.5 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T14:05:20.298Z. Updated 2025-06-04T13:55:45.518Z.

CVSS2.5v3.0KEVNot listedEPSSPresentUpdated04 Jun 2025, 20:55 WIB

Official record

HighPublished 23 Dec 2024, 19:41 WIB

CVE-2024-12903

Incorrect default permissions in Biamp Evoko Home

Incorrect default permissions vulnerability in Evoko Home, affecting version 2.4.2 to 2.7.4. A non-admin user could exploit weak file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised machine. It has been identified that full control permissions exist on t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T12:41:12.704Z. Updated 2024-12-24T01:59:35.383Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 08:59 WIB

Official record

HighPublished 23 Dec 2024, 17:16 WIB

CVE-2024-12902

Global Wisdom Software ANCHOR - Undocumented Privileged Account

ANCHOR from Global Wisdom Software is an integrated product running on a Windows virtual machine. The underlying Windows OS of the product contains high-privilege service accounts. If these accounts use default passwords, attackers could remotely log in to the virtual machine using the default credentials.

Excerpt language: en.

Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T10:16:33.272Z. Updated 2024-12-24T02:01:08.577Z.

CVSS8.4v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 09:01 WIB

Official record

MedPublished 23 Dec 2024, 11:23 WIB

CVE-2024-11230

Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget

The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T04:23:13.165Z. Updated 2026-04-08T16:35:15.811Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

MedPublished 23 Dec 2024, 09:00 WIB

CVE-2024-12901

FoxCMS API Endpoint Site.php improper authorization

A vulnerability classified as critical was found in FoxCMS up to 1.2. Affected by this vulnerability is an unknown functionality of the file /app/api/controller/Site.php of the component API Endpoint. The manipulation of the argument password leads to improper authorization. The attack can be launched remotely. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T02:00:12.678Z. Updated 2024-12-24T02:03:30.493Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 09:03 WIB

Official record

MedPublished 23 Dec 2024, 08:31 WIB

CVE-2024-12900

FoxCMS Configuration File installdb.php code injection

A vulnerability classified as critical has been found in FoxCMS up to 1.2. Affected is an unknown function of the file /install/installdb.php of the component Configuration File Handler. The manipulation of the argument database password leads to code injection. It is possible to launch the attack remotely. The exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T01:31:05.891Z. Updated 2024-12-24T02:05:11.393Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 09:05 WIB

Official record

MedPublished 23 Dec 2024, 07:31 WIB

CVE-2024-12899

1000 Projects Attendance Tracking Management System course_action.php sql injection

A vulnerability was found in 1000 Projects Attendance Tracking Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/course_action.php. The manipulation of the argument course_code leads to sql injection. The attack may be initiated remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T00:31:04.662Z. Updated 2024-12-24T02:07:27.415Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 09:07 WIB

Official record

HighPublished 23 Dec 2024, 07:18 WIB

CVE-2024-54082

CVE-2024-54082

home 5G HR02 and Wi-Fi STATION SH-54C contain an OS command injection vulnerability in the configuration restore function. An arbitrary OS command may be executed with the root privilege by an administrative user.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-23T00:18:12.865Z. Updated 2024-12-24T00:39:24.102Z.

CVSS7.2v3.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 07:39 WIB

Official record