Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates
4,273 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.
CVE-2024-50697
In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bounds checks. This may result in a stack-based buffer overflow.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2025-01-27T15:37:57.414Z.
CVE-2024-50698
SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2025-09-15T15:35:57.908Z.
CVE-2024-56404
In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installations are affected.
Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2025-01-24T19:43:57.848Z.
CVE-2024-57041
A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' section of their profile.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2026-07-05T00:54:13.969Z.
CVE-2024-57095
SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2025-02-05T16:46:02.219Z.
CVE-2024-57184
An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163 that can cause a denial of service (DOS) via a crafted MP4 file.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2025-01-24T14:58:49.637Z.
CVE-2024-57277
InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2026-01-26T14:38:52.188Z.
CVE-2025-23222
An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the…
Severity high: primary CNA CVSS 8.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-24T00:00:00.000Z. Updated 2025-02-12T20:41:30.901Z.
Sensitive data unnecessarily returned from authenticated API
Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin Console API on port 88…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T22:45:37.185Z. Updated 2025-01-24T14:22:16.478Z.
Issue with AWS Sign-in IAM User Login Flow - Possible Username Enumeration
Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid IAM usernames in an arbitrary AWS account.
Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T21:22:25.699Z. Updated 2025-10-14T18:42:46.835Z.
Fedora Repository fedoraIntCallUser default credentials
Fedora Repository 3.8.x includes a service account (fedoraIntCallUser) with default credentials and privileges to read read local files by manipulating datastreams. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T20:25:00.614Z. Updated 2025-02-12T20:41:30.107Z.
Fedora Repository archive extraction path traversal
Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015…
Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T20:22:30.958Z. Updated 2025-02-06T21:27:16.765Z.
Directus privilege escalation vulnerability using Share feature
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical user can specify an arbitrary role. It allows the user to use a higher-privileged role to see fields that otherwise the user should not be able to see. Instances that are impacted ar…
Severity medium: primary CNA CVSS 5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:45:32.868Z. Updated 2025-02-12T20:41:29.561Z.
@fastify/multipart vulnerable to unlimited consumption of resources
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.
Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:40:56.228Z. Updated 2025-02-12T20:41:29.689Z.
Himmelblau leaks credentials in the debug log
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled, user access tokens are inadvertently logged, potentially exposing sensitive aut…
Severity low: primary CNA CVSS 3.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:38:57.957Z. Updated 2025-02-12T20:41:29.818Z.
Weak default folder permissions
Xerox Workplace Suite has weak default folder permissions that allow unauthorized users to access, modify, or delete files
Severity medium: primary CNA CVSS 6.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:36:01.763Z. Updated 2025-02-24T17:18:39.252Z.
try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter
RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Via a type confusion bug in versions of the CPython interpreter starting in 3.11 and prior to 3.13.2 when using `try/except*`, RestrictedPython starting in version 6.0 and …
Severity high: primary CNA CVSS 7.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:34:27.056Z. Updated 2025-02-12T20:41:29.946Z.
IBM Security Verify Bridge data manipulation
IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow a local privileged user to overwrite files due to excessive privileges granted to the agent. which could also cause a denial of service.
Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:31:58.939Z. Updated 2025-01-23T19:01:40.369Z.
Mail spoofing
A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources.
Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:30:34.224Z. Updated 2025-02-24T17:17:09.394Z.
Clear text secrets returned & Remote system secrets in clear text
Xerox Workplace Suite exposes sensitive secrets in clear text, both locally and remotely. This vulnerability allows attackers to intercept or access secrets without encryption
Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2025-01-23T17:25:46.915Z. Updated 2025-02-24T17:16:19.462Z.