Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,433 published records · 11 KEV · 3,433 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,433 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1935.6%
High95028%
Med1,50344%
Low752.2%
None00.00%
Legacy00.00%
Unscored71221%

Matching records by UTC month

Dec 243,433

Signal coverage

KEV-listed: 11
With a forecast: 3,433
Unknown date: 0
Unscored severity: 712

Share of cohort: KEV 0.32% · forecast 100% · unscored 21%.

Showing 921–940 of 3,433By severity band: Critical · 9.0–10.0 193, High · 7.0–8.9 950, Medium · 4.0–6.9 1,503, Low · 0.1–3.9 75, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 712

MedPublished 19 Dec 2024, 22:14 WIB

CVE-2024-12798

JaninoEventEvaluator vulnerability

ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T15:14:21.598Z. Updated 2025-01-03T13:38:58.152Z.

CVSS5.9v4.0KEVNot listedEPSSPresentUpdated03 Jan 2025, 20:38 WIB

Official record

HighPublished 19 Dec 2024, 22:00 WIB

CVE-2024-12786

X1a0He Adobe Downloader XPC Service com.x1a0he.macOS.Adobe-Downloader.helper shouldAcceptNewConnection privileges management

A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 921 to 940 of 3433.First page Next page

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T15:00:22.547Z. Updated 2024-12-20T20:18:23.612Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated21 Dec 2024, 03:18 WIB

Official record

MedPublished 19 Dec 2024, 21:31 WIB

CVE-2024-12785

itsourcecode Vehicle Management System sendmail.php sql injection

A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file sendmail.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T14:31:05.634Z. Updated 2024-12-19T14:50:31.958Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 21:50 WIB

Official record

HighPublished 19 Dec 2024, 21:18 WIB

CVE-2024-25131

Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T14:18:05.194Z. Updated 2025-07-23T22:46:15.035Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated24 Jul 2025, 05:46 WIB

Official record

HighPublished 19 Dec 2024, 21:08 WIB

CVE-2024-47093

Fix various XSS issues and potential RCE

Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T14:08:44.081Z. Updated 2025-11-03T19:31:17.975Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 02:31 WIB

Official record

CritPublished 19 Dec 2024, 21:00 WIB

CVE-2024-10244

SQLi in ISDO Software's Web Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ISDO Software Web Software allows SQL Injection. This issue affects Web Software: before 3.6.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T14:00:45.914Z. Updated 2026-06-02T06:53:02.670Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated02 Jun 2026, 13:53 WIB

Official record

MedPublished 19 Dec 2024, 21:00 WIB

CVE-2024-12784

itsourcecode Vehicle Management System editbill.php sql injection

A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been classified as critical. Affected is an unknown function of the file editbill.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T14:00:16.507Z. Updated 2024-12-19T15:10:48.663Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated19 Dec 2024, 22:10 WIB

Official record

CritPublished 19 Dec 2024, 20:56 WIB

CVE-2021-26102

CVE-2021-26102

A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete files on the system by sending a crafted POST request. In particular, deleting specific configuration files will reset the Admin password to its default value.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T13:56:38.177Z. Updated 2024-12-19T15:17:08.639Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated19 Dec 2024, 22:17 WIB

Official record

MedPublished 19 Dec 2024, 20:41 WIB

CVE-2024-9102

phpLDAPadmin: Improper Neutralization of Formula Elements

phpLDAPadmin since at least version 1.2.0 through the latest version 1.2.6.7 allows users to export elements from the LDAP directory into a Comma-Separated Value (CSV) file, but it does not neutralize special elements that could be interpreted as a command when the file is opened by a spreadsheet product. Thus, this co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T13:41:24.263Z. Updated 2025-04-16T11:41:48.766Z.

CVSS5v4.0KEVNot listedEPSSPresentUpdated16 Apr 2025, 18:41 WIB

Official record

LowPublished 19 Dec 2024, 20:41 WIB

CVE-2024-9101

phpLDAPadmin: Reflected Cross-Site Scripting in entry_chooser.php

A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T13:41:06.610Z. Updated 2024-12-20T20:20:24.165Z.

CVSS2.1v4.0KEVNot listedEPSSPresentUpdated21 Dec 2024, 03:20 WIB

Official record

MedPublished 19 Dec 2024, 19:31 WIB

CVE-2024-12783

itsourcecode Vehicle Management System billaction.php cross site scripting

A vulnerability was found in itsourcecode Vehicle Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /billaction.php. The manipulation of the argument extra-cost leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T12:31:09.545Z. Updated 2024-12-20T22:01:48.194Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated21 Dec 2024, 05:01 WIB

Official record

MedPublished 19 Dec 2024, 19:31 WIB

CVE-2024-12782

Fujifilm Business Innovation Apeos C3070/Apeos C5570/Apeos C6580 Web Interface index.html#hashHome improper authorization

A vulnerability has been found in Fujifilm Business Innovation Apeos C3070, Apeos C5570 and Apeos C6580 up to 24.8.28 and classified as critical. This vulnerability affects unknown code of the file /home/index.html#hashHome of the component Web Interface. The manipulation leads to improper authorization. The attack can…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T12:31:07.155Z. Updated 2025-02-28T06:36:15.948Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Feb 2025, 13:36 WIB

Official record

HighPublished 19 Dec 2024, 19:22 WIB

CVE-2021-32589

CVE-2021-32589

A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.2.10 and below, version 5.0.12 and below and FortiAnalyzer version 7.0.0, version 6.4.5 and below, version 6.2.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T12:22:32.543Z. Updated 2024-12-20T21:55:26.925Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 04:55 WIB

Official record

UnscoredPublished 19 Dec 2024, 19:00 WIB

CVE-2024-45819

libxl leaks data to PVH guests via ACPI tables

PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is being allocated is left with its prior contents.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T12:00:50.271Z. Updated 2024-12-31T18:57:41.513Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Jan 2025, 01:57 WIB

Official record

UnscoredPublished 19 Dec 2024, 19:00 WIB

CVE-2024-45818

Deadlock in x86 HVM standard VGA handling

The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involved there has an unusual discipline, leaving a lock acquired past the return from the function that acquired it. This behavior results in a problem when emulating an instruction wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T12:00:41.413Z. Updated 2024-12-31T19:01:43.510Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Jan 2025, 02:01 WIB

Official record

MedPublished 19 Dec 2024, 18:24 WIB

CVE-2024-37962

WordPress Fusion Page Builder plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agency Dominion Inc. Fusion fusion.This issue affects Fusion: from n/a through <= 1.6.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T11:24:03.850Z. Updated 2026-04-28T16:10:03.637Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 19 Dec 2024, 18:14 WIB

CVE-2024-12626

AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘a-0-o-search_field_value’ parameter in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T11:14:15.433Z. Updated 2026-04-08T17:21:37.783Z.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:21 WIB

Official record

MedPublished 19 Dec 2024, 18:14 WIB

CVE-2024-12331

File Manager Pro – Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_install_plugin' function in all versions up to, and including, 1.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T11:14:14.862Z. Updated 2026-04-08T16:55:17.160Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:55 WIB

Official record

HighPublished 19 Dec 2024, 17:57 WIB

CVE-2021-26115

CVE-2021-26115

An OS command injection (CWE-78) vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command.An OS command injection (CWE-78) vulnerability in FortiWAN Command Line Inte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T10:57:54.695Z. Updated 2024-12-20T17:22:16.068Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:22 WIB

Official record

HighPublished 19 Dec 2024, 17:57 WIB

CVE-2020-15934

CVE-2020-15934

An execution with unnecessary privileges vulnerability in the VCM engine of FortiClient for Linux versions 6.2.7 and below, version 6.4.0. may allow local users to elevate their privileges to root by creating a malicious script or program on the target machine.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-12-19T10:57:39.255Z. Updated 2024-12-20T17:23:40.395Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated21 Dec 2024, 00:23 WIB

Official record