Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 801–820 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

HighPublished 21 Dec 2024, 03:24 WIB

CVE-2024-56358

Cross-site Scripting vulnerability through svg attachment previews in grist-core

grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are advised to upgrade. Users…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T20:24:53.932Z. Updated 2024-12-24T15:53:26.149Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 22:53 WIB

Official record

HighPublished 21 Dec 2024, 03:24 WIB

CVE-2024-56357

Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core

grist-core is a spreadsheet hosting server. A user visiting a malicious document or submitting a malicious form could have their account compromised, because it was possible to use the `javascript:` scheme with custom widget URLs and form redirect URLs. This issue has been patched in version 1.3.1. Users are advised to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 801 to 820 of 3433.First page Next page

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T20:24:51.149Z. Updated 2024-12-24T15:56:14.305Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 22:56 WIB

Official record

MedPublished 21 Dec 2024, 03:17 WIB

CVE-2024-40875

Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52

There is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to version 13.52. Attackers with system administrator permissions can interfere with another system administrator’s use of the management console when the second administrator logs in. Attack complexity is high, atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T20:17:27.132Z. Updated 2024-12-24T15:57:03.223Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 22:57 WIB

Official record

HighPublished 21 Dec 2024, 03:15 WIB

CVE-2024-56335

Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker's account has admin or owner…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T20:15:35.854Z. Updated 2024-12-24T15:57:45.407Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 22:57 WIB

Official record

HighPublished 21 Dec 2024, 03:10 WIB

CVE-2024-56334

Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation

systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T20:10:12.578Z. Updated 2024-12-24T16:32:35.731Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated24 Dec 2024, 23:32 WIB

Official record

CritPublished 21 Dec 2024, 03:01 WIB

CVE-2024-56330

Session VNC may be accessed by other sessions on the same host in stardust

Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. This would allow users within a container to access another containers agent, therefore compromising access.The problem has been patched in any Stardust build past 12/20/24. Users ar…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T20:01:48.624Z. Updated 2024-12-24T16:34:13.485Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 23:34 WIB

Official record

MedPublished 21 Dec 2024, 03:00 WIB

CVE-2024-12842

Emlog Pro user.php cross site scripting

A vulnerability was found in Emlog Pro up to 2.4.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/user.php. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T20:00:13.813Z. Updated 2024-12-24T16:35:01.784Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 23:35 WIB

Official record

HighPublished 21 Dec 2024, 02:59 WIB

CVE-2024-56329

Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream

Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by Laravel Jetstream, with scaffolding that has support for Laravel Socialite. When linking a social account to an already authenticated user, the lack of a confirmation step introduces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T19:59:37.270Z. Updated 2024-12-24T16:37:21.474Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 23:37 WIB

Official record

CritPublished 21 Dec 2024, 02:52 WIB

CVE-2024-56333

Remote code execution in onyxia-api

Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environment for data scientists. This critical vulnerability allows authenticated users to remotely execute code within the Onyxia-API, leading to potential consequences such as unauthoriz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T19:52:25.818Z. Updated 2024-12-24T16:38:50.448Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 23:38 WIB

Official record

MedPublished 21 Dec 2024, 02:48 WIB

CVE-2024-56331

Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor

Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on the server by exploiting the `file:///` protocol. This vulnerability is triggered via the **"real-browser"** request type, which takes a screenshot of the URL prov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T19:48:45.641Z. Updated 2024-12-27T14:52:22.519Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated27 Dec 2024, 21:52 WIB

Official record

HighPublished 21 Dec 2024, 02:19 WIB

CVE-2024-12867

Server-Side Request Forgery in Arctic Hub URL Mapper allows an unauthenticated remote attacker to exfiltrate and modify configurations and data

Server-Side Request Forgery in URL Mapper in Arctic Security's Arctic Hub versions 3.0.1764-5.6.1877 allows an unauthenticated remote attacker to exfiltrate and modify configurations and data.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T19:19:43.985Z. Updated 2024-12-24T16:59:02.357Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 23:59 WIB

Official record

MedPublished 21 Dec 2024, 01:31 WIB

CVE-2024-12841

Emlog Pro tag.php cross site scripting

A vulnerability was found in Emlog Pro up to 2.4.1. It has been classified as problematic. This affects an unknown part of the file /admin/tag.php. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T18:31:05.248Z. Updated 2024-12-24T16:59:42.813Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 23:59 WIB

Official record

HighPublished 20 Dec 2024, 23:44 WIB

CVE-2024-12677

Delta Electronics DTM Soft Deserialization of Untrusted Data

Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T16:44:08.747Z. Updated 2024-12-24T00:40:13.881Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated24 Dec 2024, 07:40 WIB

Official record

HighPublished 20 Dec 2024, 22:52 WIB

CVE-2024-10385

Stored XSS in DirectAdmin Evo Skin

Ticket management system in DirectAdmin Evolution Skin is vulnerable to XSS (Cross-site Scripting), which allows a low-privileged user to inject and store malicious JavaScript code. If an admin views the ticket, the script might perform actions with their privileges, including command execution. This issue has been fi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T15:52:26.083Z. Updated 2024-12-20T16:48:15.413Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated20 Dec 2024, 23:48 WIB

Official record

UnscoredPublished 20 Dec 2024, 22:28 WIB

CVE-2024-56337

Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T15:28:54.738Z. Updated 2025-11-04T15:59:21.843Z.

CVSS—KEVNot listedEPSSPresentUpdated04 Nov 2025, 22:59 WIB

Official record

MedPublished 20 Dec 2024, 21:11 WIB

CVE-2024-56356

CVE-2024-56356

In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T14:11:17.496Z. Updated 2024-12-20T17:35:31.293Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:35 WIB

Official record

MedPublished 20 Dec 2024, 21:11 WIB

CVE-2024-56355

CVE-2024-56355

In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T14:11:17.093Z. Updated 2024-12-20T17:35:39.670Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:35 WIB

Official record

MedPublished 20 Dec 2024, 21:11 WIB

CVE-2024-56354

CVE-2024-56354

In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T14:11:16.668Z. Updated 2024-12-20T17:35:48.291Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:35 WIB

Official record

MedPublished 20 Dec 2024, 21:11 WIB

CVE-2024-56353

CVE-2024-56353

In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies

Excerpt language: en.

Severity medium: primary CNA CVSS 5.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T14:11:16.333Z. Updated 2024-12-20T17:35:55.458Z.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:35 WIB

Official record

MedPublished 20 Dec 2024, 21:11 WIB

CVE-2024-56352

CVE-2024-56352

In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page

Excerpt language: en.

Severity medium: primary CNA CVSS 4.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-20T14:11:15.886Z. Updated 2024-12-20T17:36:04.249Z.

CVSS4.6v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:36 WIB

Official record