Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters2 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 257 published records · 3 KEV · 257 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

257 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit257100%
High00.00%
Med00.00%
Low00.00%
None00.00%
Legacy00.00%
Unscored00.00%

Matching records by UTC month

Nov 24257

Signal coverage

KEV-listed: 3
With a forecast: 257
Unknown date: 0
Unscored severity: 0

Share of cohort: KEV 1.2% · forecast 100% · unscored 0.00%.

Showing 1–20 of 257By severity band: Critical · 9.0–10.0 257, High · 7.0–8.9 0, Medium · 4.0–6.9 0, Low · 0.1–3.9 0, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 0

CritPublished 30 Nov 2024, 01:11 WIB

CVE-2024-49360

Path traversal in Sandboxie

Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. An authenticated user (**UserA**) with no privileges is authorized to read all files created in sandbox belonging to other users in the sandbox folders `C:\Sandbox\UserB\xxx`. An authenticated attacker who can use …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T18:11:58.261Z. Updated 2024-12-02T20:32:39.725Z.

CVSS9.2v3.1KEVNot listedEPSSPresentUpdated03 Dec 2024, 03:32 WIB

Official record

CritPublished 29 Nov 2024, 23:53 WIB

CVE-2024-49806

IBM Security Verify Access Appliance hard coded credentials

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1 to 20 of 257.Next page

Published 2024-11-29T16:53:45.208Z. Updated 2024-11-29T17:09:49.806Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

CritPublished 29 Nov 2024, 23:52 WIB

CVE-2024-49805

IBM Security Verify Access Appliance hard coded credentials

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T16:52:15.174Z. Updated 2024-11-29T17:09:49.677Z.

CVSS9.4v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

CritPublished 29 Nov 2024, 23:50 WIB

CVE-2024-49803

IBM Security Verify Access Appliance command execution

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T16:50:31.964Z. Updated 2024-11-29T17:09:49.402Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated30 Nov 2024, 00:09 WIB

Official record

CritPublished 29 Nov 2024, 20:06 WIB

CVE-2024-11992

Path traversal vulnerability in Quick.CMS

Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and download any file if it has the appropriate permissions outside of documentroot configured on the server via the aDirFiles%5B0%5D parameter in the admin.php page. T…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T13:06:30.404Z. Updated 2024-11-29T13:24:05.020Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated29 Nov 2024, 20:24 WIB

Official record

CritPublished 29 Nov 2024, 16:06 WIB

CVE-2024-50357

CVE-2024-50357

FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The fac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T09:06:56.251Z. Updated 2024-12-02T18:15:27.594Z.

CVSS9.8v3.0KEVNot listedEPSSPresentUpdated03 Dec 2024, 01:15 WIB

Official record

CritPublished 29 Nov 2024, 14:03 WIB

CVE-2024-11482

CVE-2024-11482

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T07:03:33.494Z. Updated 2025-03-18T14:56:37.259Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated18 Mar 2025, 21:56 WIB

Official record

CritPublished 29 Nov 2024, 09:12 WIB

CVE-2024-11979

Interinfo DreamMaker - Unrestricted File Upload through Path Traversal

DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-29T02:12:14.052Z. Updated 2024-12-03T06:05:57.385Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated03 Dec 2024, 13:05 WIB

Official record

CritPublished 28 Nov 2024, 17:44 WIB

CVE-2024-52474

WordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Сервис “Экспресс Платежи” Express Payments Module express-pay allows Blind SQL Injection.This issue affects Express Payments Module: from n/a through <= 1.1.8.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-28T10:44:29.370Z. Updated 2026-04-28T16:10:43.290Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 28 Nov 2024, 17:42 WIB

CVE-2024-52490

WordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through <= 2.5.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-28T10:42:54.054Z. Updated 2026-04-28T16:10:43.548Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 28 Nov 2024, 17:34 WIB

CVE-2024-52475

WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Information Technology Wawp automation-web-platform allows Authentication Bypass.This issue affects Wawp: from n/a through < 3.0.18.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-28T10:34:02.078Z. Updated 2026-04-28T16:10:43.325Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:10 WIB

Official record

CritPublished 28 Nov 2024, 16:47 WIB

CVE-2024-11082

Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function

The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary fil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-28T09:47:12.805Z. Updated 2026-04-08T17:19:10.001Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:19 WIB

Official record

CritPublished 28 Nov 2024, 16:47 WIB

CVE-2024-8672

Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.7 via the display logic functionality that extends several page builders. This is due to the plugin allowing users to supply input that will be passed…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-28T09:47:11.729Z. Updated 2026-04-08T17:06:08.186Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:06 WIB

Official record

CritPublished 28 Nov 2024, 16:47 WIB

CVE-2024-11103

Contest Gallery <= 24.0.7 - Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover

The Contest Gallery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 24.0.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-28T09:47:09.248Z. Updated 2026-04-08T16:35:21.716Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:35 WIB

Official record

CritPublished 28 Nov 2024, 14:14 WIB

CVE-2024-11925

WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation

The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin not properly verifying a users identity when verifying an email address through the user_account_activation function. This makes it possible for unauthenticated at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-28T07:14:07.539Z. Updated 2026-04-08T16:33:15.499Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:33 WIB

Official record

CritPublished 27 Nov 2024, 19:05 WIB

CVE-2024-42330

JS - Internal strings in HTTP headers

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that can be used to access h…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-27T12:05:47.722Z. Updated 2025-11-03T22:04:43.106Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated04 Nov 2025, 05:04 WIB

Official record

CritPublished 27 Nov 2024, 19:04 WIB

CVE-2024-42327

SQL injection in user.get API

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. An SQLi exists in the CUser class in the addRelatedObjects function, this function is being called from the CUser.get function which is available for every user who ha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-27T12:04:31.950Z. Updated 2024-12-04T04:55:21.730Z.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated04 Dec 2024, 11:55 WIB

Official record

CritPublished 27 Nov 2024, 12:23 WIB

CVE-2024-52959

iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')

A Improper Control of Generation of Code ('Code Injection') vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to perform arbitrary system commands via a DLL file.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-27T05:23:11.281Z. Updated 2024-11-27T14:44:37.184Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Nov 2024, 21:44 WIB

Official record

CritPublished 27 Nov 2024, 12:22 WIB

CVE-2024-52958

iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature

A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-27T05:22:47.950Z. Updated 2024-11-27T14:46:28.815Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Nov 2024, 21:46 WIB

Official record

CritPublished 27 Nov 2024, 07:18 WIB

CVE-2024-53676

CVE-2024-53676

A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2024-11-27T00:18:28.527Z. Updated 2025-03-05T14:58:05.646Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Mar 2025, 21:58 WIB

Official record