# CVEs published 2024-02-26

73 CVEs were published on February 26, 2024: 15 critical, 24 high. Days are UTC.

- [CVE-2024-27093](https://cve.now/CVE-2024-27093.md): Minder trusts client-provided mapping from repo name to upstream ID (CVSS 4.6, stacklok minder · github.com/stacklok/minder)
- [CVE-2024-24564](https://cve.now/CVE-2024-24564.md): Vyper extract32 can ready dirty memory (CVSS 3.7, vyperlang vyper · vyper)
- [CVE-2024-26149](https://cve.now/CVE-2024-26149.md): Vyper \_abi\_decode Memory Overflow (CVSS 3.7, vyperlang vyper · vyper)
- [CVE-2024-27092](https://cve.now/CVE-2024-27092.md): Content spoofing - real Hoppscotch emails (CVSS 5.4, hoppscotch)
- [CVE-2024-1899](https://cve.now/CVE-2024-1899.md): Showdownjs Denial of Service (CVSS 5.3, Showdownjs Showdown · showdown)
- [CVE-2023-52474](https://cve.now/CVE-2023-52474.md): IB/hfi1: Fix bugs with non-PAGE\_SIZE-end multi-iovec user SDMA requests (CVSS 7.8, Linux)
- [CVE-2021-46906](https://cve.now/CVE-2021-46906.md): HID: usbhid: fix info leak in hid\_submit\_ctrl (no CVSS, Linux)
- [CVE-2020-36775](https://cve.now/CVE-2020-36775.md): f2fs: fix to avoid potential deadlock (no CVSS, Linux)
- [CVE-2019-25162](https://cve.now/CVE-2019-25162.md): i2c: Fix a potential use after free (CVSS 7.8, Linux)
- [CVE-2019-25160](https://cve.now/CVE-2019-25160.md): netlabel: fix out-of-bounds memory accesses (CVSS 9.1, Linux)
- [CVE-2024-27088](https://cve.now/CVE-2024-27088.md): es5-ext Regular Expression Denial of Service in \`function#copy\` and \`function#toStringTokens\` (CVSS 0.0, medikoo es5-ext · es5-ext)
- [CVE-2024-27087](https://cve.now/CVE-2024-27087.md): Kirby cross-site scripting (XSS) in the link field "Custom" type (CVSS 4.6, getkirby kirby · getkirby/cms)
- [CVE-2024-27081](https://cve.now/CVE-2024-27081.md): ESPHome remote code execution via arbitrary file write (CVSS 7.2, esphome)
- [CVE-2024-23837](https://cve.now/CVE-2024-23837.md): LibHTP unbounded folded header handling leads to denial service (CVSS 7.5, OISF libhtp)
- [CVE-2024-22201](https://cve.now/CVE-2024-22201.md): Jetty connection leaking on idle timeout when TCP congested (CVSS 7.5, jetty.project · org.eclipse.jetty.http2:http2-common +3)
- [CVE-2024-21825](https://cve.now/CVE-2024-21825.md): A heap-based buffer overflow vulnerability exists in the GGUF library GGUF\_TYPE\_ARRAY/GGUF\_TYPE\_STRING parsing functionality of llama.cpp Co (CVSS 8.8, llama.cpp)
- [CVE-2024-23496](https://cve.now/CVE-2024-23496.md): A heap-based buffer overflow vulnerability exists in the GGUF library gguf\_fread\_str functionality of llama.cpp Commit 18c2e17. (CVSS 8.8, llama.cpp)
- [CVE-2024-21802](https://cve.now/CVE-2024-21802.md): A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. (CVSS 8.8, llama.cpp)
- [CVE-2024-21836](https://cve.now/CVE-2024-21836.md): A heap-based buffer overflow vulnerability exists in the GGUF library header.n\_tensors functionality of llama.cpp Commit 18c2e17. (CVSS 8.8, llama.cpp)
- [CVE-2024-23605](https://cve.now/CVE-2024-23605.md): A heap-based buffer overflow vulnerability exists in the GGUF library header.n\_kv functionality of llama.cpp Commit 18c2e17. (CVSS 8.8, llama.cpp)
- [CVE-2024-1436](https://cve.now/CVE-2024-1436.md): WordPress WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit Plugin \<= 1.0.9 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Wiloke WooCommerce Coupon Popup, SmartBar, Slide In | MySho…)
- [CVE-2024-24568](https://cve.now/CVE-2024-24568.md): Suricata http2: header handling evasion (CVSS 5.3, OISF suricata)
- [CVE-2024-23839](https://cve.now/CVE-2024-23839.md): Suricata http: heap use after free with http.request\_header and http.response\_header keywords (CVSS 7.1, OISF suricata)
- [CVE-2024-23836](https://cve.now/CVE-2024-23836.md): crafted traffic can cause denial of service (CVSS 7.5, OISF suricata)
- [CVE-2024-24714](https://cve.now/CVE-2024-24714.md): WordPress Icons Font Loader Plugin \<= 1.1.4 is vulnerable to Arbitrary File Upload (CVSS 7.2, bPlugins Icons Font Loader)
- [CVE-2024-23835](https://cve.now/CVE-2024-23835.md): Suricata's pgsql: memory exhaustion use on record parsing (CVSS 7.5, OISF suricata)
- [CVE-2024-25909](https://cve.now/CVE-2024-25909.md): WordPress WP Media folder Plugin \<= 5.7.2 is vulnerable to Arbitrary File Upload (CVSS 9.9, JoomUnited WP Media folder)
- [CVE-2024-25913](https://cve.now/CVE-2024-25913.md): WordPress MoveTo Plugin \<= 6.2 is vulnerable to Arbitrary File Upload (CVSS 10.0, Skymoonlabs MoveTo)
- [CVE-2024-25925](https://cve.now/CVE-2024-25925.md): WordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin \<= 3.5.12 is vulnerable to Arbitrary File Upload (CVSS 10.0, SYSBASICS WooCommerce Easy Checkout Field Editor, Fees & Di…)
- [CVE-2024-26606](https://cve.now/CVE-2024-26606.md): binder: signal epoll threads of self-work (no CVSS, Linux)
- [CVE-2024-1890](https://cve.now/CVE-2024-1890.md): Clickjacking vulnerability in Sunny Webbox (CVSS 6.4, SMA Sunny Webbox)
- [CVE-2024-1889](https://cve.now/CVE-2024-1889.md): Cross-Site Request Forgery vulnerability in SMA Cluster Controller (CVSS 8.8, SMA Cluster Controller)
- [CVE-2024-1622](https://cve.now/CVE-2024-1622.md): Routinator terminates when RTR connection is reset too quickly after opening (CVSS 7.5, NLnet Labs Routinator)
- [CVE-2024-0387](https://cve.now/CVE-2024-0387.md): EDS-4000/G4000 Series IP Forwarding Vulnerability (CVSS 6.5, Moxa EDS-4008 Series · Moxa EDS-4009 Series +5)
- [CVE-2023-49114](https://cve.now/CVE-2023-49114.md): Local Privilege Escalation via DLL Hijacking (CVSS 6.7, Qognify VMS Client Viewer)
- [CVE-2024-22371](https://cve.now/CVE-2024-22371.md): Apache Camel issue on ExchangeCreatedEvent (CVSS 2.9, Apache Software Foundation Apache Camel · org.apache.camel:…)
- [CVE-2024-1886](https://cve.now/CVE-2024-1886.md): Absolute path traversal attack on LG Signage (CVSS 3.0, LG Electronics LG Signage)
- [CVE-2024-1885](https://cve.now/CVE-2024-1885.md): Remote Code Execution attack on LG Signage (CVSS 6.3, LG Electronics LG Signage)
- [CVE-2024-1735](https://cve.now/CVE-2024-1735.md): A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authent (CVSS 9.1, LINE Armeria · com.linecorp.armeria:armeria-saml)
- [CVE-2024-1878](https://cve.now/CVE-2024-1878.md): SourceCodester Employee Management System myprofile.php sql injection (CVSS 6.3, SourceCodester Employee Management System)
- [CVE-2024-1877](https://cve.now/CVE-2024-1877.md): SourceCodester Employee Management System cancel.php sql injection (CVSS 6.3, SourceCodester Employee Management System)
- [CVE-2024-1876](https://cve.now/CVE-2024-1876.md): SourceCodester Employee Management System psubmit.php sql injection (CVSS 7.3, SourceCodester Employee Management System)
- [CVE-2023-36237](https://cve.now/CVE-2023-36237.md): Cross Site Request Forgery vulnerability in Bagisto before v.1.5.1 allows an attacker to execute arbitrary code via a crafted HTML script. (CVSS 8.8, bagisto/bagisto)
- [CVE-2023-49959](https://cve.now/CVE-2023-49959.md): In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote (CVSS 9.8)
- [CVE-2023-49960](https://cve.now/CVE-2023-49960.md): In Indo-Sol PROFINET-INspektor NT through 2.4.0, a path traversal vulnerability in the httpuploadd service of the firmware allows remote att (CVSS 7.5)
- [CVE-2024-22873](https://cve.now/CVE-2024-22873.md): Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to contain a Server-Side Request Forgery (SSRF) via the event subscription function (/ (CVSS 8.1)
- [CVE-2024-24401](https://cve.now/CVE-2024-24401.md): SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitorin (CVSS 9.8)
- [CVE-2024-24402](https://cve.now/CVE-2024-24402.md): An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd compo (CVSS 9.8)
- [CVE-2024-24721](https://cve.now/CVE-2024-24721.md): An issue was discovered on Innovaphone PBX before 14r1 devices. (CVSS 6.5)
- [CVE-2024-25081](https://cve.now/CVE-2024-25081.md): Splinefont in FontForge through 20230101 allows command injection via crafted filenames. (CVSS 4.2)
- [CVE-2024-25082](https://cve.now/CVE-2024-25082.md): Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files. (CVSS 6.5)
- [CVE-2024-25247](https://cve.now/CVE-2024-25247.md): SQL Injection vulnerability in /app/api/controller/Store.php in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via latitude (CVSS 9.8)
- [CVE-2024-25248](https://cve.now/CVE-2024-25248.md): SQL Injection vulnerability in the orderGoodsDelivery() function in Niushop B2B2C V5 allows attackers to run arbitrary SQL commands via the (CVSS 9.8)
- [CVE-2024-25344](https://cve.now/CVE-2024-25344.md): Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execut (CVSS 6.1)
- [CVE-2024-25410](https://cve.now/CVE-2024-25410.md): flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update\_setting.php. (CVSS 6.5)
- [CVE-2024-25751](https://cve.now/CVE-2024-25751.md): A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42\_multi allows a remote attacker to execute (CVSS 9.8)
- [CVE-2024-25763](https://cve.now/CVE-2024-25763.md): openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. (CVSS 5.5)
- [CVE-2024-25767](https://cve.now/CVE-2024-25767.md): nanomq 0.21.2 contains a Use-After-Free vulnerability in /nanomq/nng/src/core/socket.c. (CVSS 6.5)
- [CVE-2024-25768](https://cve.now/CVE-2024-25768.md): OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc\_policy.c. (CVSS 7.5)
- [CVE-2024-25770](https://cve.now/CVE-2024-25770.md): libming 0.4.8 contains a memory leak vulnerability in /libming/src/actioncompiler/listaction.c. (CVSS 4.3)
- [CVE-2024-26455](https://cve.now/CVE-2024-26455.md): fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bit/plugins/custom\_calyptia/calyptia.c. (CVSS 7.5)
- [CVE-2024-26458](https://cve.now/CVE-2024-26458.md): Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap\_rmt.c. (CVSS 5.3)
- [CVE-2024-26461](https://cve.now/CVE-2024-26461.md): Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. (CVSS 7.5)
- [CVE-2024-26462](https://cve.now/CVE-2024-26462.md): Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. (CVSS 5.5)
- [CVE-2024-26465](https://cve.now/CVE-2024-26465.md): A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 allo (CVSS 6.1)
- [CVE-2024-26466](https://cve.now/CVE-2024-26466.md): A DOM based cross-site scripting (XSS) vulnerability in the component /dom/ranges/Range-test-iframe.html of web-platform-tests/wpt before co (CVSS 6.1)
- [CVE-2024-26467](https://cve.now/CVE-2024-26467.md): A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 al (CVSS 6.1)
- [CVE-2024-26468](https://cve.now/CVE-2024-26468.md): A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers (CVSS 6.1)
- [CVE-2024-27444](https://cve.now/CVE-2024-27444.md): langchain\_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execut (CVSS 9.8, langchain-experimental)
- [CVE-2024-27447](https://cve.now/CVE-2024-27447.md): pretix before 2024.1.1 mishandles file validation. (CVSS 9.8, pretix)
- [CVE-2024-27454](https://cve.now/CVE-2024-27454.md): orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents. (CVSS 7.5, orjson)
- [CVE-2024-27455](https://cve.now/CVE-2024-27455.md): In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts (CVSS 9.1)
- [CVE-2024-27456](https://cve.now/CVE-2024-27456.md): rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files. (CVSS 9.1, rack-cors)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.