CVEs published February 26, 2024
73 CVEs were published on February 26, 2024: 15 critical, 24 high.
- Published
- 73
- Critical
- 15
- High
- 24
- Medium
- 26
- Low
- 5
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Linux
- 6
- llama.cpp
- 5
- OISF suricata
- 4
- SourceCodester Employee Management System
- 3
- LG Electronics LG Signage
- 2
- vyperlang vyper · vyper
- 2
- Apache Software Foundation Apache Camel · org.apache.camel:…
- 1
- bagisto/bagisto
- 1
- bPlugins Icons Font Loader
- 1
- esphome
- 1
Critical 15
- CVE-2019-25160netlabel: fix out-of-bounds memory accessesLinux
- CVE-2024-25909WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File UploadJoomUnited WP Media folder
- CVE-2024-25913WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File UploadSkymoonlabs MoveTo
- CVE-2024-25925WordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin <= 3.5.12 is vulnerable to Arbitrary File UploadSYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Di…
- CVE-2024-1735A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentLINE Armeria · com.linecorp.armeria:armeria-saml
- CVE-2023-49959In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote
- CVE-2024-24401SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitorin
- CVE-2024-24402An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd compo
- CVE-2024-25247SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude
- CVE-2024-25248SQL Injection vulnerability in the orderGoodsDelivery() function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the
- CVE-2024-25751A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute
- CVE-2024-27444langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and executlangchain-experimental
- CVE-2024-27447pretix before 2024.1.1 mishandles file validation.pretix
- CVE-2024-27455In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts
- CVE-2024-27456rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.rack-cors
High 24
- CVE-2023-52474IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requestsLinux
- CVE-2019-25162i2c: Fix a potential use after freeLinux
- CVE-2024-27081ESPHome remote code execution via arbitrary file writeesphome
- CVE-2024-23837LibHTP unbounded folded header handling leads to denial serviceOISF libhtp
- CVE-2024-22201Jetty connection leaking on idle timeout when TCP congestedjetty.project · org.eclipse.jetty.http2:http2-common +3
- CVE-2024-21825A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Collama.cpp
- CVE-2024-23496A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17.llama.cpp
- CVE-2024-21802A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17.llama.cpp
- CVE-2024-21836A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17.llama.cpp
- CVE-2024-23605A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17.llama.cpp
- CVE-2024-23839Suricata http: heap use after free with http.request_header and http.response_header keywordsOISF suricata
- CVE-2024-23836crafted traffic can cause denial of serviceOISF suricata
- CVE-2024-24714WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File UploadbPlugins Icons Font Loader
- CVE-2024-23835Suricata's pgsql: memory exhaustion use on record parsingOISF suricata
- CVE-2024-1889Cross-Site Request Forgery vulnerability in SMA Cluster ControllerSMA Cluster Controller
- CVE-2024-1622Routinator terminates when RTR connection is reset too quickly after openingNLnet Labs Routinator
- CVE-2024-1876SourceCodester Employee Management System psubmit.php sql injectionSourceCodester Employee Management System
- CVE-2023-36237Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script.bagisto/bagisto
- CVE-2023-49960In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote att
- CVE-2024-22873Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/
- CVE-2024-25768OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c.
- CVE-2024-26455fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom_calyptia/calyptia.c.
- CVE-2024-26461Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
- CVE-2024-27454orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.orjson
Medium, low and unrated 34
- CVE-2024-27093Minder trusts client-provided mapping from repo name to upstream IDstacklok minder · github.com/stacklok/minder
- CVE-2024-24564Vyper extract32 can ready dirty memoryvyperlang vyper · vyper
- CVE-2024-26149Vyper _abi_decode Memory Overflowvyperlang vyper · vyper
- CVE-2024-27092Content spoofing - real Hoppscotch emailshoppscotch
- CVE-2024-1899Showdownjs Denial of ServiceShowdownjs Showdown · showdown
- CVE-2021-46906HID: usbhid: fix info leak in hid_submit_ctrlLinux
- CVE-2020-36775f2fs: fix to avoid potential deadlockLinux
- CVE-2024-27088es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`medikoo es5-ext · es5-ext
- CVE-2024-27087Kirby cross-site scripting (XSS) in the link field "Custom" typegetkirby kirby · getkirby/cms
- CVE-2024-1436WordPress WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data ExposureWiloke WooCommerce Coupon Popup, SmartBar, Slide In | MySho…
- CVE-2024-24568Suricata http2: header handling evasionOISF suricata
- CVE-2024-26606binder: signal epoll threads of self-workLinux
- CVE-2024-1890Clickjacking vulnerability in Sunny WebboxSMA Sunny Webbox
- CVE-2024-0387EDS-4000/G4000 Series IP Forwarding VulnerabilityMoxa EDS-4008 Series · Moxa EDS-4009 Series +5
- CVE-2023-49114Local Privilege Escalation via DLL HijackingQognify VMS Client Viewer
- CVE-2024-22371Apache Camel issue on ExchangeCreatedEventApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2024-1886Absolute path traversal attack on LG SignageLG Electronics LG Signage
- CVE-2024-1885Remote Code Execution attack on LG SignageLG Electronics LG Signage
- CVE-2024-1878SourceCodester Employee Management System myprofile.php sql injectionSourceCodester Employee Management System
- CVE-2024-1877SourceCodester Employee Management System cancel.php sql injectionSourceCodester Employee Management System
- CVE-2024-24721An issue was discovered on Innovaphone PBX before 14r1 devices.
- CVE-2024-25081Splinefont in FontForge through 20230101 allows command injection via crafted filenames.
- CVE-2024-25082Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
- CVE-2024-25344Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execut
- CVE-2024-25410flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.
- CVE-2024-25763openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c.
- CVE-2024-25767nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c.
- CVE-2024-25770libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c.
- CVE-2024-26458Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
- CVE-2024-26462Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.
- CVE-2024-26465A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 allo
- CVE-2024-26466A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before co
- CVE-2024-26467A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 al
- CVE-2024-26468A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers