The archive.

Browse all tracked critical vulnerabilities, including records outside today's brief.

39,181 matching vulnerabilities · Page 438 of 784

geoserver1 vulnerability on this pageMax CVSS 9.8Priority 99KEV 1

CVE-2024-36401 · geoserver geoserver

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

KEV · due 5 Aug EPSS 100%public exploit SSVC act CVSS 9.8

Apache Software Foundation3 vulnerabilities on this pageMax CVSS 9.8Priority 97KEV 1

CVE-2024-38475 · Apache Software Foundation Apache HTTP Server

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

KEV · due 22 May EPSS 100%public exploit SSVC act CVSS 9.1

CVE-2024-38476 · Apache Software Foundation Apache HTTP Server

Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

EPSS 42%CVSS 9.8

CVE-2024-38474 · Apache Software Foundation Apache HTTP Server

Apache HTTP Server weakness with encoded question marks in backreferences

EPSS 2%CVSS 9.8

vanna-ai2 vulnerabilities on this pageMax CVSS 9.8Priority 57KEV 0

CVE-2024-5827 · vanna-ai vanna-ai/vanna

Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna

EPSS 3%public exploit CVSS 9.8

CVE-2024-5826 · vanna-ai vanna-ai/vanna

Remote Code Execution via Prompt Injection in vanna-ai/vanna

EPSS 0.9%public exploit CVSS 9.8

machform1 vulnerability on this pageMax CVSS 9.9Priority 55KEV 0

CVE-2024-37762 · machform machform

MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.

EPSS 1%public exploit CVSS 9.9

lightning-ai1 vulnerability on this pageMax CVSS 9.8Priority 54KEV 0

CVE-2024-5980 · lightning-ai lightning-ai/pytorch-lightning

Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning

EPSS 1%public exploit CVSS 9.8

ag-grid1 vulnerability on this pageMax CVSS 9.8Priority 53KEV 0

CVE-2024-38996 · ag-grid ag-grid-enterprise

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function.

EPSS 1%public exploit CVSS 9.8

jrburke1 vulnerability on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2024-38999 · jrburke requirejs

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure.

EPSS 0.8%public exploit CVSS 10.0

robinweser1 vulnerability on this pageMax CVSS 10.0Priority 52KEV 0

CVE-2024-39008 · robinweser fast-loops

robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep.

EPSS 0.9%public exploit CVSS 10.0

Tenda2 vulnerabilities on this pageMax CVSS 9.8Priority 52KEV 0

CVE-2024-6402 · Tenda A301

Tenda A301 SetOnlineDevName fromSetWirelessRepeat stack-based overflow

EPSS 1.0%public exploit CVSS 9.8

CVE-2024-6403 · Tenda A301

Tenda A301 SetOnlineDevName formWifiBasicSet stack-based overflow

EPSS 1.0%public exploit CVSS 9.8

berriai1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-5751 · berriai berriai/litellm

Remote Code Execution in BerriAI/litellm

EPSS 0.9%public exploit CVSS 9.8

gradio_project1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-39236 · gradio_project gradio

Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.

EPSS 0.9%public exploit CVSS 9.8

rjrodger1 vulnerability on this pageMax CVSS 9.8Priority 51KEV 0

CVE-2024-38993 · rjrodger jsonic-next

rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty.

EPSS 0.9%public exploit CVSS 9.8

thunderobot1 vulnerability on this pageMax CVSS 10.0Priority 51KEV 0

CVE-2024-39251 · thunderobot control_center

An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensit…

EPSS 0.7%public exploit CVSS 10.0

agreejs_shared1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-39017 · agreejs_shared agreejs_shared

agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents.

EPSS 0.7%public exploit CVSS 9.8

cafebazaar1 vulnerability on this pageMax CVSS 9.8Priority 50KEV 0

CVE-2024-39015 · cafebazaar hod

cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request.

EPSS 0.7%public exploit CVSS 9.8

tpm2-software1 vulnerability on this pageMax CVSS 9.1Priority 50KEV 0

CVE-2024-29039 · tpm2-software tpm2-tools

Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state

EPSS 1.0%public exploit CVSS 9.1

BC Security1 vulnerability on this pageMax CVSS 9.8Priority 49KEV 0

CVE-2024-6127 · BC Security Empire

BC Security Empire Path Traversal RCE

EPSS 10%CVSS 9.8

stitionai1 vulnerability on this pageMax CVSS 9.1Priority 49KEV 0

CVE-2024-5926 · stitionai stitionai/devika

Path Traversal in stitionai/devika

EPSS 0.9%public exploit CVSS 9.1

gaizhenbiao1 vulnerability on this pageMax CVSS 9.8Priority 48KEV 0

CVE-2024-5822 · gaizhenbiao gaizhenbiao/chuanhuchatgpt

Server-Side Request Forgery (SSRF) in gaizhenbiao/ChuanhuChatGPT

EPSS 0.5%public exploit CVSS 9.8

SDG Technologies1 vulnerability on this pageMax CVSS 9.3Priority 48KEV 0

CVE-2024-2882 · SDG Technologies PnPSCADA

Missing Authorization in SDG Technologies PnPSCADA

EPSS 0.7%public exploit CVSS 9.3

stiofansisland1 vulnerability on this pageMax CVSS 9.8Priority 46KEV 0

CVE-2024-6265 · stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by'

EPSS 2%CVSS 9.8

mitre1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-39704 · mitre

Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev.

EPSS 1%CVSS 9.8

Synology1 vulnerability on this pageMax CVSS 9.8Priority 44KEV 0

CVE-2024-39349 · Synology Camera Firmware

A vulnerability regarding buffer copy without checking size of input ('Classic Buffer Overflow') is found in the libjansson component and…

EPSS 1%CVSS 9.8

Juniper Networks1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-2973 · Juniper Networks Session Smart Router

Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed

EPSS 1%CVSS 10.0

PTC1 vulnerability on this pageMax CVSS 10.0Priority 43KEV 0

CVE-2024-6071 · PTC Creo Elements/Direct License

PTC Creo Elements/Direct License Server Missing Authorization

EPSS 1%CVSS 10.0

Siemens1 vulnerability on this pageMax CVSS 9.1Priority 43KEV 0

CVE-2024-37371 · Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending messa…

EPSS 2%CVSS 9.1

2o3t1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-39013 · 2o3t 2o3t-utility

2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend.

EPSS 0.8%CVSS 9.8

Microsoft1 vulnerability on this pageMax CVSS 9.8Priority 41KEV 0

CVE-2024-35260 · Microsoft Microsoft Power Platform

Microsoft Dataverse Remote Code Execution Vulnerability

EPSS 0.8%CVSS 9.8

cahilfoley1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-39014 · cahilfoley utils

ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set.

EPSS 0.7%CVSS 9.8

Dell1 vulnerability on this pageMax CVSS 9.8Priority 40KEV 0

CVE-2024-25943 · Dell Integrated Dell Remote Access Controller 9

iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vuln…

EPSS 0.7%CVSS 9.8

Elastic1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-37282 · Elastic Elastic Cloud Enterprise

It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be s…

EPSS 0.6%CVSS 9.8

goauthentik1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-38371 · goauthentik authentik

Insufficient access control for OAuth2 Device Code flow in authentik

EPSS 0.6%CVSS 9.8

SourceCodester1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-6419 · SourceCodester Medicine Tracker System

SourceCodester Medicine Tracker System sql injection

EPSS 0.6%CVSS 9.8

Spotfire1 vulnerability on this pageMax CVSS 9.9Priority 39KEV 0

CVE-2024-3330 · Spotfire Spotfire Analyst

Spotfire Remote Code Execution Vulnerability

EPSS 0.6%CVSS 9.9

VulDB1 vulnerability on this pageMax CVSS 9.8Priority 39KEV 0

CVE-2024-6416 · VulDB

SeaCMS sql injection

EPSS 0.5%CVSS 9.8

Concept Intermedia1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-3816 · Concept Intermedia S@M CMS

SQLi in S@M CMS

EPSS 0.5%CVSS 9.8

HCL Software1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-30110 · HCL Software DRYiCE AEX

Lack of input validation vulnerability affects DRYiCE AEX v10

EPSS 0.5%CVSS 9.8

MongoDB Inc1 vulnerability on this pageMax CVSS 9.8Priority 38KEV 0

CVE-2024-6376 · MongoDB Inc MongoDB Compass

ejson shell parser in MongoDB Compass maybe bypassed

EPSS 0.5%CVSS 9.8

MESbook2 vulnerabilities on this pageMax CVSS 9.3Priority 37KEV 0

CVE-2024-6424 · MESbook MESbook

Server-Side Request Forgery vulnerability in MESbook

EPSS 0.5%CVSS 9.3

CVE-2024-6425 · MESbook MESbook

Incorrect Provision of Specified Functionality vulnerability in MESbook

EPSS 0.5%CVSS 9.1

internet21 vulnerability on this pageMax CVSS 9.1Priority 35KEV 0

CVE-2024-39848 · internet2 grouper

Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways.

EPSS 0.4%CVSS 9.1

MediaTek, Inc.4 vulnerabilities on this pageMax CVSS 9.8Priority 34KEV 0

CVE-2024-20080 · MediaTek, Inc. MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6989, MT6990, MT8666, MT8667, MT8673, MT8676, MT8678

In gnss service, there is a possible escalation of privilege due to improper certificate validation.

EPSS 0.3%CVSS 9.8

CVE-2024-20078 · MediaTek, Inc. MT6768, MT6779, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796, MT8797, MT8798

In venc, there is a possible out of bounds write due to type confusion.

EPSS 0.3%CVSS 9.8

CVE-2024-20081 · MediaTek, Inc. MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6989, MT6990, MT8666, MT8667, MT8673, MT8676, MT8678

In gnss service, there is a possible out of bounds write due to improper input validation.

EPSS 0.2%CVSS 9.8

CVE-2024-20079 · MediaTek, Inc. MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT6989, MT8666, MT8667, MT8673, MT8676, MT8678

In gnss service, there is a possible out of bounds write due to improper input validation.

EPSS 0.2%CVSS 9.8

Qualcomm, Inc.1 vulnerability on this pageMax CVSS 9.1Priority 31KEV 0

CVE-2024-21456 · Qualcomm, Inc. Snapdragon

Buffer Over-read in WLAN HOST

EPSS 0.3%CVSS 9.1