Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 841–860 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 20 Dec 2024, 13:59 WIB

CVE-2024-11812

Wtyczka SeoPilot dla WP <= 3.3.091 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Wtyczka SeoPilot dla WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.091. This is due to missing or incorrect nonce validation on the SeoPilot_Admin_Options() function. This makes it possible for unauthenticated attackers to update settings and inject ma…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:59:06.593Z. Updated 2026-04-08T16:56:16.479Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:56 WIB

Official record

CritPublished 20 Dec 2024, 13:59 WIB

CVE-2024-12571

Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion

The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engine' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code i…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 841 to 860 of 3433.First page Next page

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:59:06.242Z. Updated 2024-12-20T16:03:56.627Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated20 Dec 2024, 23:03 WIB

Official record

MedPublished 20 Dec 2024, 13:59 WIB

CVE-2024-11411

Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Spotlightr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode in all versions up to, and including, 0.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contrib…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:59:05.818Z. Updated 2026-04-08T16:49:59.361Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:49 WIB

Official record

MedPublished 20 Dec 2024, 13:59 WIB

CVE-2024-11775

Particle Background <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Particle Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'particleground' shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:59:05.368Z. Updated 2026-04-08T16:48:59.542Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

MedPublished 20 Dec 2024, 13:59 WIB

CVE-2024-9503

Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Update

The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wploti_add_whitelisted_roles_option', 'wploti_remove_whitelisted_roles_option', 'wploti_add_whitelisted_users_option', 'wploti_remove_whitelisted_users_opti…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:59:04.625Z. Updated 2026-04-08T16:40:47.557Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:40 WIB

Official record

UnscoredPublished 20 Dec 2024, 13:00 WIB

CVE-2024-8968

MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color

The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:00:04.888Z. Updated 2024-12-20T16:58:57.823Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Dec 2024, 23:58 WIB

Official record

UnscoredPublished 20 Dec 2024, 13:00 WIB

CVE-2024-11108

Serious Slider < 1.2.7 - Contributor+ Stored XSS via Shortcode

The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:00:04.403Z. Updated 2024-12-20T16:11:45.944Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Dec 2024, 23:11 WIB

Official record

UnscoredPublished 20 Dec 2024, 13:00 WIB

CVE-2024-10706

Download Manager < 3.3.03 - Admin+ Stored XSS

The Download Manager WordPress plugin before 3.3.03 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:00:03.975Z. Updated 2024-12-20T16:13:51.124Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Dec 2024, 23:13 WIB

Official record

UnscoredPublished 20 Dec 2024, 13:00 WIB

CVE-2024-10555

MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width

The WordPress Button Plugin MaxButtons WordPress plugin before 9.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T06:00:02.298Z. Updated 2024-12-20T16:18:14.404Z.

CVSS—KEVNot listedEPSSPresentUpdated20 Dec 2024, 23:18 WIB

Official record

MedPublished 20 Dec 2024, 12:53 WIB

CVE-2024-5955

CVE-2024-5955

Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft requests causing arbitrary content to be injected into the response when accessing the epolicy Orchestrator.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T05:53:28.886Z. Updated 2024-12-20T17:37:43.395Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:37 WIB

Official record

HighPublished 20 Dec 2024, 12:00 WIB

CVE-2024-21549

CVE-2024-21549

Versions of the package spatie/browsershot before 5.0.3 are vulnerable to Improper Input Validation due to improper URL validation in the setUrl method. An attacker can exploit this vulnerability by utilizing view-source:file://, which allows for arbitrary file reading on a local file. **Note:** This is a bypass of t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T05:00:01.462Z. Updated 2026-08-15T15:25:14.543Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated15 Aug 2026, 22:25 WIB

Official record

UnscoredPublished 20 Dec 2024, 11:06 WIB

CVE-2024-44298

CVE-2024-44298

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access information about a user's contacts.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T04:06:20.221Z. Updated 2026-04-02T18:22:51.123Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:22 WIB

Official record

UnscoredPublished 20 Dec 2024, 11:06 WIB

CVE-2024-44293

CVE-2024-44293

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. A user may be able to view sensitive user information.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T04:06:19.170Z. Updated 2026-04-02T18:22:21.196Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:22 WIB

Official record

UnscoredPublished 20 Dec 2024, 11:06 WIB

CVE-2024-44211

CVE-2024-44211

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T04:06:18.132Z. Updated 2026-04-02T18:21:40.484Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:21 WIB

Official record

UnscoredPublished 20 Dec 2024, 11:06 WIB

CVE-2024-44231

CVE-2024-44231

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. A person with physical access to a Mac may be able to bypass Login Window during a software update.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T04:06:17.087Z. Updated 2026-04-02T18:20:33.629Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:20 WIB

Official record

UnscoredPublished 20 Dec 2024, 11:06 WIB

CVE-2024-44292

CVE-2024-44292

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T04:06:16.028Z. Updated 2026-04-02T18:17:43.861Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:17 WIB

Official record

UnscoredPublished 20 Dec 2024, 11:06 WIB

CVE-2024-44195

CVE-2024-44195

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T04:06:14.973Z. Updated 2026-04-02T18:12:25.525Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:12 WIB

Official record

UnscoredPublished 20 Dec 2024, 11:06 WIB

CVE-2024-44223

CVE-2024-44223

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access to a Mac may be able to view protected content from the Login Window.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T04:06:13.875Z. Updated 2026-04-02T18:11:13.773Z.

CVSS—KEVNot listedEPSSPresentUpdated03 Apr 2026, 01:11 WIB

Official record

UnscoredPublished 20 Dec 2024, 10:37 WIB

CVE-2023-42867

CVE-2023-42867

This issue was addressed with improved validation of the process entitlement and Team ID. This issue is fixed in GarageBand 10.4.9. An app may be able to gain root privileges.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T03:37:12.119Z. Updated 2025-11-04T19:22:41.981Z.

CVSS—KEVNot listedEPSSPresentUpdated05 Nov 2025, 02:22 WIB

Official record

MedPublished 20 Dec 2024, 09:24 WIB

CVE-2024-11776

PCRecruiter Extensions <= 1.4.22 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PCRecruiter Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'PCRecruiter' shortcode in all versions up to, and including, 1.4.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T02:24:40.700Z. Updated 2026-04-08T17:27:09.733Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:27 WIB

Official record