# CVEs published 2024-04-09

387 CVEs were published on April 9, 2024: 14 critical, 179 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-3120](https://cve.now/CVE-2024-3120.md): Stack-Buffer Overflow in 'Content-Length' and 'Warning' Header Processing in sngrep (CVSS 9.0, irontec sngrep)
- [CVE-2024-3119](https://cve.now/CVE-2024-3119.md): Stack-Buffer Overflow in 'Call-ID' and 'X-Call-ID' SIP Header Processing in sngrep (CVSS 9.0, irontec sngrep)
- [CVE-2024-3524](https://cve.now/CVE-2024-3524.md): Campcodes Online Event Management System process.php cross site scripting (CVSS 3.5, Campcodes Online Event Management System)
- [CVE-2024-3523](https://cve.now/CVE-2024-3523.md): Campcodes Online Event Management System index.php sql injection (CVSS 6.3, Campcodes Online Event Management System)
- [CVE-2024-3522](https://cve.now/CVE-2024-3522.md): Campcodes Online Event Management System process.php sql injection (CVSS 6.3, Campcodes Online Event Management System)
- [CVE-2024-3313](https://cve.now/CVE-2024-3313.md): SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy Component (CVSS 8.4, SUBNET Solutions PowerSYSTEM Server · SUBNET Solutions Subs…)
- [CVE-2024-3521](https://cve.now/CVE-2024-3521.md): Byzoro Smart S80 Management Platform userattestation.php unrestricted upload (CVSS 4.7, Byzoro Smart S80 Management Platform)
- [CVE-2024-3446](https://cve.now/CVE-2024-3446.md): Qemu: virtio: dma reentrancy issue leads to double free vulnerability (CVSS 8.2, Red Hat Enterprise Linux)
- [CVE-2022-4965](https://cve.now/CVE-2022-4965.md): Invitation Code Content Restriction Plugin from CreativeMinds \<= 1.5.4 - Reflected Cross-Site Scripting (CVSS 6.1, Invitation Code Content Restriction Plugin from CreativeMin…)
- [CVE-2023-6694](https://cve.now/CVE-2023-6694.md): Beaver Themer \<= 1.4.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, Beaver Builder Beaver Themer)
- [CVE-2024-1412](https://cve.now/CVE-2024-1412.md): Memberpress \<= 1.11.24 - Reflected Cross-Site Scripting via message and error (CVSS 6.1, Memberpress)
- [CVE-2023-6695](https://cve.now/CVE-2023-6695.md): Beaver Themer \<= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode (CVSS 6.5, Beaver Builder Beaver Themer)
- [CVE-2024-3545](https://cve.now/CVE-2024-3545.md): Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and D (CVSS 4.3, Devolutions Server · Devolutions Remote Desktop Manager)
- [CVE-2024-2311](https://cve.now/CVE-2024-2311.md): Avada \<= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2024-2138](https://cve.now/CVE-2024-2138.md): JetWidgets For Elementor \<= 1.0.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Box Widget (CVSS 6.4, jetmonsters JetWidgets For Elementor)
- [CVE-2024-2306](https://cve.now/CVE-2024-2306.md): Revslider \<= 6.6.20 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, Revolution Slider Slider Revolution)
- [CVE-2024-1352](https://cve.now/CVE-2024-1352.md): Classified Listing – Classified ads & Business Directory Plugin \<= 3.0.4 - Missing Authorization (CVSS 6.5, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2024-1498](https://cve.now/CVE-2024-1498.md): Happy Addons for Elementor \<= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-0952](https://cve.now/CVE-2024-0952.md): WP ERP \<= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id (CVSS 7.2, wedevs ERP: Complete HR, Accounting & CRM Suite with WooCom…)
- [CVE-2024-3267](https://cve.now/CVE-2024-3267.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_price\_list Shortcode (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2024-2347](https://cve.now/CVE-2024-2347.md): Astra \<= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name (CVSS 6.4, brainstormforce Astra)
- [CVE-2024-2787](https://cve.now/CVE-2024-2787.md): Happy Addons for Elementor \<= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-2093](https://cve.now/CVE-2024-2093.md): VK All in One Expansion Unit \<= 9.95.0.1 - Information Exposure (CVSS 6.5, kurudrive VK All in One Expansion Unit)
- [CVE-2024-3213](https://cve.now/CVE-2024-3213.md): Relevanssi – A Better Search \<= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update (CVSS 5.3, Relevanssi Premium · comesio Relevanssi – A Better Search)
- [CVE-2024-2341](https://cve.now/CVE-2024-2341.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.7.7 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2024-1984](https://cve.now/CVE-2024-1984.md): Graphene \<= 2.9.2 - Missing Authorization (CVSS 5.3, silverks Graphene)
- [CVE-2024-2081](https://cve.now/CVE-2024-2081.md): FooGallery \<= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, fooplugins Gallery by FooGallery)
- [CVE-2024-1458](https://cve.now/CVE-2024-1458.md): Elementor Addons by Livemesh \<= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Widget (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-2456](https://cve.now/CVE-2024-2456.md): Ecwid Ecommerce Shopping Cart \<= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Ecwid by Lightspeed Ecommerce Shopping Cart)
- [CVE-2024-2792](https://cve.now/CVE-2024-2792.md): Elementor Addon Elements \<= 1.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget (CVSS 6.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-2039](https://cve.now/CVE-2024-2039.md): Stackable – Page Builder Gutenberg Blocks \<= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block (CVSS 6.4, bfintal Stackable – Page Builder Gutenberg Blocks)
- [CVE-2024-1461](https://cve.now/CVE-2024-1461.md): Elementor Addons by Livemesh \<= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2023-6999](https://cve.now/CVE-2023-6999.md): Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, sc0ttkclark Pods – Custom Content Types and Fields)
- [CVE-2024-2946](https://cve.now/CVE-2024-2946.md): ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) \<= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget (CVSS 6.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-2327](https://cve.now/CVE-2024-2327.md): Global Elementor Buttons \<= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link (CVSS 6.4, tausworks Global Elementor Buttons)
- [CVE-2023-6486](https://cve.now/CVE-2023-6486.md): Spectra – WordPress Gutenberg Blocks \<= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS (CVSS 6.4, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2024-1812](https://cve.now/CVE-2024-1812.md): Everest Forms \<= 2.0.7 - Unauthenticated Server-Side Request Forgery via font\_url (CVSS 7.2, wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…)
- [CVE-2024-2501](https://cve.now/CVE-2024-2501.md): Hubbub Lite – Fast, Reliable Social Network Sharing Buttons \<= 1.33.1 - PHP Object Injection (CVSS 7.5, nerdpressteam Hubbub Lite – Fast, free social sharing and f…)
- [CVE-2024-3208](https://cve.now/CVE-2024-3208.md): Sydney Toolbox \<= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery (CVSS 6.4, smub Sydney Toolbox)
- [CVE-2024-2344](https://cve.now/CVE-2024-2344.md): Avada \<= 7.11.6 - Authenticated (Admin+) SQL Injection via entry (CVSS 7.2, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2024-2654](https://cve.now/CVE-2024-2654.md): File Manager \<= 7.2.5 - Authenticated (Administrator+) Directory Traversal (CVSS 6.8, mndpsingh287 File Manager)
- [CVE-2024-2117](https://cve.now/CVE-2024-2117.md): Elementor Website Builder – More than Just a Page Builder \<= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2023-6965](https://cve.now/CVE-2023-6965.md): Pods - Custom Content Types and Fields - Missing Authorization (CVSS 4.3, sc0ttkclark Pods – Custom Content Types and Fields)
- [CVE-2024-2504](https://cve.now/CVE-2024-2504.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes (CVSS 6.4, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2024-1792](https://cve.now/CVE-2024-1792.md): CMB2 \<= 2.10.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 7.5, jtsternberg CMB2)
- [CVE-2024-0873](https://cve.now/CVE-2024-0873.md): Watu Quiz \<= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, prasunsen Watu Quiz)
- [CVE-2024-1424](https://cve.now/CVE-2024-1424.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2024-1587](https://cve.now/CVE-2024-1587.md): Newsmatic \<= 1.3.4 - Unauthenticated Information Exposure via newsmatic\_filter\_posts\_load\_tab\_content (CVSS 5.3, blazethemes Newsmatic)
- [CVE-2024-2222](https://cve.now/CVE-2024-2222.md): Advanced Classifieds & Directory Pro \<= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion (CVSS 4.3, pluginsware Advanced Classifieds & Directory Pro)
- [CVE-2024-2789](https://cve.now/CVE-2024-2789.md): Happy Addons for Elementor \<= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-2623](https://cve.now/CVE-2024-2623.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-2325](https://cve.now/CVE-2024-2325.md): Link Library \<= 7.6.6 - Reflected Cross-Site Scripting (CVSS 6.1, jackdewey Link Library)
- [CVE-2024-1999](https://cve.now/CVE-2024-1999.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget (CVSS 6.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2023-6964](https://cve.now/CVE-2023-6964.md): Gutenberg Blocks by Kadence Blocks – Page Builder Features \<= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF) (CVSS 8.5, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-1387](https://cve.now/CVE-2024-1387.md): Happy Addons for Elementor \<= 3.10.4 - Incorrect Authorization to Information Exposure (CVSS 4.3, thehappymonster Happy Addons for Elementor)
- [CVE-2024-2287](https://cve.now/CVE-2024-2287.md): Knight Lab Timeline \<= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, nuknightlab Knight Lab Timeline)
- [CVE-2024-2348](https://cve.now/CVE-2024-2348.md): Gum Elementor Addon \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget (CVSS 6.4, celomitan Gum Addon for Elementor)
- [CVE-2024-0872](https://cve.now/CVE-2024-0872.md): Watu Quiz \<= 3.4.1 - Sensitive Information Disclosure (CVSS 4.3, prasunsen Watu Quiz)
- [CVE-2024-2305](https://cve.now/CVE-2024-2305.md): Cards for Beaver Builder \<= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link (CVSS 6.4, pratikchaskar Cards for Beaver Builder)
- [CVE-2024-1463](https://cve.now/CVE-2024-1463.md): LearnPress \<= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting (CVSS 4.4, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-1893](https://cve.now/CVE-2024-1893.md): Easy Property Listings \<= 3.5.2 - Authenticated(Contributor+) SQL Injection via Shortcode (CVSS 8.8, mervb1 Easy Property Listings)
- [CVE-2024-3167](https://cve.now/CVE-2024-3167.md): Ocean Extra \<= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, oceanwp Ocean Extra)
- [CVE-2024-2289](https://cve.now/CVE-2024-2289.md): PowerPack Lite for Beaver Builder \<= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link (CVSS 6.4, ideaboxcreations PowerPack Lite for Beaver Builder)
- [CVE-2024-2507](https://cve.now/CVE-2024-2507.md): JetWidgets For Elementor \<= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL (CVSS 6.4, jetmonsters JetWidgets For Elementor)
- [CVE-2024-2847](https://cve.now/CVE-2024-2847.md): WordPress File Upload \<= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, nickboss Iptanus File Upload)
- [CVE-2024-2335](https://cve.now/CVE-2024-2335.md): Elements Plus! \<= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links (CVSS 6.4, cssigniterteam Elements Plus!)
- [CVE-2024-2871](https://cve.now/CVE-2024-2871.md): Media Library Assistant \<= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 6.4, dglingren Media Library Assistant)
- [CVE-2024-3136](https://cve.now/CVE-2024-3136.md): MasterStudy LMS \<= 3.3.3 - Unauthenticated Local File Inclusion via template (CVSS 9.8, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2024-3214](https://cve.now/CVE-2024-3214.md): Relevanssi – A Better Search \<= 4.22.1 - Unauthenticated Second Order CSV Injection (CVSS 5.8, Relevanssi Premium · comesio Relevanssi – A Better Search)
- [CVE-2024-0598](https://cve.now/CVE-2024-0598.md): Gutenberg Blocks by Kadence Blocks \<= 3.2.17 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings (CVSS 4.4, stellarwp Kadence Blocks — Page Builder Toolkit for Gutenbe…)
- [CVE-2024-1465](https://cve.now/CVE-2024-1465.md): Elementor Addons by Livemesh \<= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-2340](https://cve.now/CVE-2024-2340.md): Avada \<= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing (CVSS 5.3, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2024-1813](https://cve.now/CVE-2024-1813.md): Simple Job Board \<= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields (CVSS 9.8, presstigers Simple Job Board)
- [CVE-2024-1934](https://cve.now/CVE-2024-1934.md): WP Compress – Image Optimizer \<= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification (CVSS 7.5, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2024-2026](https://cve.now/CVE-2024-2026.md): Passster \<= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via content\_protector Shortcode (CVSS 6.4, wpchill Passster – Password Protect Pages and Content)
- [CVE-2024-2343](https://cve.now/CVE-2024-2343.md): Avada \<= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form\_to\_url\_action (CVSS 6.4, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2024-1790](https://cve.now/CVE-2024-1790.md): Ajax Load More \<= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read (CVSS 4.9, dcooney Ajax Load More – Infinite Scroll, Load More, & Lazy…)
- [CVE-2024-2536](https://cve.now/CVE-2024-2536.md): Rank Math SEO with AI SEO Tools \<= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes (CVSS 6.4, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2024-0899](https://cve.now/CVE-2024-0899.md): s2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions \<= 230815 - Information Exposure (CVSS 5.3, clavaque s2Member – Excellent for All Kinds of Memberships,…)
- [CVE-2024-2693](https://cve.now/CVE-2024-2693.md): Link Whisper Free \<= 0.7.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, linkwhspr Link Whisper Free)
- [CVE-2024-1464](https://cve.now/CVE-2024-1464.md): Elementor Addons by Livemesh \<= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2023-7046](https://cve.now/CVE-2023-7046.md): WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score \<= 7.0 - Sensitive Information Exposure via insufficiently protected files (CVSS 7.5, gowebsmarty WP Encryption – One Click Free SSL Certificate…)
- [CVE-2024-2974](https://cve.now/CVE-2024-2974.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.13 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-2183](https://cve.now/CVE-2024-2183.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget (CVSS 6.4, WPZOOM Addons for Beaver Builder)
- [CVE-2024-3244](https://cve.now/CVE-2024-3244.md): EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-1991](https://cve.now/CVE-2024-1991.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2024-3097](https://cve.now/CVE-2024-3097.md): WordPress Gallery Plugin – NextGEN Gallery \<= 3.59 - Missing Authorization to Unauthenticated Information Disclosure (CVSS 5.3, smub Photo Gallery, Sliders, Proofing and Themes – NextGEN…)
- [CVE-2024-2543](https://cve.now/CVE-2024-2543.md): Plugin Permalink \<= 2.4.3.1 - Missing Authorization via get\_uri\_editor (CVSS 4.3, mbis Permalink Manager Lite)
- [CVE-2024-2186](https://cve.now/CVE-2024-2186.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget (CVSS 6.4, WPZOOM Addons for Beaver Builder)
- [CVE-2024-2457](https://cve.now/CVE-2024-2457.md): Modal Window – create popup modal window \<= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpcalc Modal Window – create popup modal window)
- [CVE-2024-2788](https://cve.now/CVE-2024-2788.md): Happy Addons for Elementor \<= 3.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-2650](https://cve.now/CVE-2024-2650.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-2783](https://cve.now/CVE-2024-2783.md): GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress \<= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, rubengc GamiPress – Gamification plugin to reward points, a…)
- [CVE-2024-2738](https://cve.now/CVE-2024-2738.md): Permalink Manager Lite and Permalink Manager Pro \<= 2.4.3.1 - Reflected Cross-Site Scripting (CVSS 6.1, mbis Permalink Manager Lite · mbis Permalink Manager Pro)
- [CVE-2024-0588](https://cve.now/CVE-2024-0588.md): Paid Memberships Pro \<= 2.12.10 - Cross-Site Request Forgery (CVSS 4.3, strangerstudios Paid Memberships Pro – Content Restriction,…)
- [CVE-2024-1948](https://cve.now/CVE-2024-1948.md): Getwid – Gutenberg Blocks \<= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content (CVSS 6.4, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2024-1571](https://cve.now/CVE-2024-1571.md): WP Recipe Maker \<= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed (CVSS 4.4, brechtvds WP Recipe Maker)
- [CVE-2024-2181](https://cve.now/CVE-2024-2181.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4, WPZOOM Addons for Beaver Builder)
- [CVE-2023-6799](https://cve.now/CVE-2023-6799.md): WP Reset \<= 2.0 - Sensitive Information Exposure due to Insufficient Randomness (CVSS 5.9, webfactory WP Reset)
- [CVE-2024-2027](https://cve.now/CVE-2024-2027.md): Real Media Library: Media Library Folder & File Manager \<= 4.22.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, devowl Real Media Library: Media Library Folder & File Mana…)
- [CVE-2024-1990](https://cve.now/CVE-2024-1990.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2024-2334](https://cve.now/CVE-2024-2334.md): Template Kit – Import \<= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload (CVSS 6.4, envato Template Kit – Import)
- [CVE-2024-1466](https://cve.now/CVE-2024-1466.md): Elementor Addons by Livemesh \<= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-2198](https://cve.now/CVE-2024-2198.md): Contact Form by BestWebSoft \<= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm\_contact\_address (CVSS 6.1, Contact Form by BestWebSoft – Advanced WP Contact Form Buil…)
- [CVE-2024-0626](https://cve.now/CVE-2024-0626.md): WooCommerce Clover Payment Gateway \<= 1.3.1 - Missing Authorization via callback\_handler (CVSS 5.3, elbanyaoui Clover Payment Gateway by Zaytech for WooCommerce)
- [CVE-2024-2112](https://cve.now/CVE-2024-2112.md): Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder \<= 1.15.22 - Sensitive Information Exposure (CVSS 5.9, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2024-0662](https://cve.now/CVE-2024-0662.md): The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 d (CVSS 4.4, colorlibplugins FancyBox for WordPress)
- [CVE-2024-2436](https://cve.now/CVE-2024-2436.md): Lightweight Accordion \<= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, someguy9 Lightweight Accordion)
- [CVE-2024-1315](https://cve.now/CVE-2024-1315.md): Classified Listing \<= 3.0.4 - Cross-Site Request Forgery to Account Takeover via rtcl\_update\_user\_account (CVSS 8.8, techlabpro1 Classified Listing – AI-Powered Classified ads…)
- [CVE-2023-6777](https://cve.now/CVE-2023-6777.md): WP Go Maps (formerly WP Google Maps) \<= 9.0.34 - Information Exposure to Potential Denial of Service (CVSS 5.3, wpgmaps WP Go Maps)
- [CVE-2024-2165](https://cve.now/CVE-2024-2165.md): SEOPress – On-site SEO \<= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, rainbowgeek SEOPress – On-site SEO & Analytics)
- [CVE-2024-2786](https://cve.now/CVE-2024-2786.md): Happy Addons for Elementor \<= 3.10.4 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title\_tag (CVSS 5.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-1850](https://cve.now/CVE-2024-1850.md): AI Post Generator | AutoWriter \<= 3.3 - Missing Authorization (CVSS 6.3, kekotron AI Post Generator | AutoWriter)
- [CVE-2024-2336](https://cve.now/CVE-2024-2336.md): Popup Maker – Popup for opt-ins, lead gen, & more \<= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, danieliser Popup Maker – Boost Sales, Conversions, Optins,…)
- [CVE-2024-0826](https://cve.now/CVE-2024-0826.md): Qi Addons For Elementor \<= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, qodeinteractive Qi Addons For Elementor)
- [CVE-2024-1308](https://cve.now/CVE-2024-1308.md): WooCommerce Cloak Affiliate Links \<= 1.0.33 - Missing Authorization to Unauthenticated Permalink Modification (CVSS 7.5, datafeedrcom Cloak Affiliate Links for WooCommerce)
- [CVE-2024-2513](https://cve.now/CVE-2024-2513.md): WP Chat App \<= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute (CVSS 6.4, ninjateam WP Chat App)
- [CVE-2024-2804](https://cve.now/CVE-2024-2804.md): Network Summary \<= 2.0.11 - Unauthenticated SQL Injection (CVSS 9.8, jokr Network Summary)
- [CVE-2024-1960](https://cve.now/CVE-2024-1960.md): ShopLentor \<= 2.8.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link (CVSS 6.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-2018](https://cve.now/CVE-2024-2018.md): WP Activity Log Premium \<= 4.6.4 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, wpwhitesecurity WP Activity Log Premium)
- [CVE-2024-2423](https://cve.now/CVE-2024-2423.md): UsersWP \<= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, stiofansisland UsersWP – Front-end login form, User Registr…)
- [CVE-2024-2261](https://cve.now/CVE-2024-2261.md): Event Tickets and Registration \<= 5.8.2 - Improper Authorization to Information Disclosure (CVSS 4.3, stellarwp Event Tickets and Registration)
- [CVE-2024-2845](https://cve.now/CVE-2024-2845.md): BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg \<= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpdevteam BetterDocs – Knowledge Base Docs & FAQ Solution…)
- [CVE-2024-2125](https://cve.now/CVE-2024-2125.md): EnvíaloSimple: Email Marketing y Newsletters \<= 2.3 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, dattateccom EnvíaloSimple: Email Marketing y Newsletters)
- [CVE-2023-6993](https://cve.now/CVE-2023-6993.md): Custom post types, Custom Fields & more \<= 5.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, totalpressorg Custom post types, Custom Fields & more)
- [CVE-2024-2200](https://cve.now/CVE-2024-2200.md): Contact Form by BestWebSoft \<= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm\_contact\_subject (CVSS 6.1, Contact Form by BestWebSoft – Advanced WP Contact Form Buil…)
- [CVE-2024-1794](https://cve.now/CVE-2024-1794.md): Forminator \<= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 7.2, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-3266](https://cve.now/CVE-2024-3266.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2024-2226](https://cve.now/CVE-2024-2226.md): Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE \<= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themeisle Otter Blocks – Gutenberg Blocks, Page Builder for…)
- [CVE-2024-1904](https://cve.now/CVE-2024-1904.md): MasterStudy LMS \<= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search\_posts (CVSS 4.3, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2024-1637](https://cve.now/CVE-2024-1637.md): 360 Javascript Viewer \<= 1.7.12 - Missing Authorization to Plugin Settings Update (CVSS 4.3, jtermaat 360 Javascript Viewer)
- [CVE-2023-6967](https://cve.now/CVE-2023-6967.md): Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, sc0ttkclark Pods – Custom Content Types and Fields)
- [CVE-2024-3053](https://cve.now/CVE-2024-3053.md): Forminator – Contact Form, Payment Form & Custom Form Builder \<= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator\_form Shortcode (CVSS 6.4, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-3064](https://cve.now/CVE-2024-3064.md): Elementor Addons, Widgets and Enhancements – Stax \<= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, staxwp Stax Addons for Elementor)
- [CVE-2024-1974](https://cve.now/CVE-2024-1974.md): HT Mega – Absolute Addons For Elementor \<= 2.4.5 - Authenticated (Contributor+) Directory Traversal (CVSS 8.8, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-2492](https://cve.now/CVE-2024-2492.md): PowerPack Addons for Elementor \<= 2.7.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget (CVSS 6.4, ideaboxcreations PowerPack Addons for Elementor)
- [CVE-2024-0376](https://cve.now/CVE-2024-0376.md): Premium Addons for Elementor \<= 4.10.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-1774](https://cve.now/CVE-2024-1774.md): Customily Product Personalizer \<= 1.23.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, Customily Product Personalizer)
- [CVE-2024-1641](https://cve.now/CVE-2024-1641.md): Accordion \<= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication (CVSS 5.4, pickplugins Accordions)
- [CVE-2024-1289](https://cve.now/CVE-2024-1289.md): LearnPress \<= 4.2.6.3 - Insecure Direct Object Reference (CVSS 6.5, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-2342](https://cve.now/CVE-2024-2342.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.7.7 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2024-2033](https://cve.now/CVE-2024-2033.md): Video Conferencing with Zoom \<= 4.4.5 - Sensitive Information Exposure (CVSS 4.3, j\_3rk Video Conferencing with Zoom)
- [CVE-2024-2302](https://cve.now/CVE-2024-2302.md): Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) \<= 3.2.9 - Sensitive Information Exposure (CVSS 5.3, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2024-2185](https://cve.now/CVE-2024-2185.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget (CVSS 6.4, WPZOOM Addons for Beaver Builder)
- [CVE-2024-1852](https://cve.now/CVE-2024-1852.md): WP-Members Membership Plugin \<= 3.4.9.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, cbutlerjr WP-Members Membership Plugin)
- [CVE-2024-2187](https://cve.now/CVE-2024-2187.md): Beaver Builder Addons by WPZOOM \<= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonials Widget (CVSS 6.4, WPZOOM Addons for Beaver Builder)
- [CVE-2024-2918](https://cve.now/CVE-2024-2918.md): Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM (CVSS 3.6, Devolutions Server)
- [CVE-2024-31457](https://cve.now/CVE-2024-31457.md): gin-vue-admin background arbitrary code coverage vulnerability (CVSS 7.7, flipped-aurora gin-vue-admin · github.com/flipped-aurora/gi…)
- [CVE-2024-25116](https://cve.now/CVE-2024-25116.md): Specially crafted CF.RESERVE command can lead to denial-of-service (CVSS 5.5, RedisBloom)
- [CVE-2024-25115](https://cve.now/CVE-2024-25115.md): RedisBloom heap buffer overflow in CF.LOADCHUNK command (CVSS 7.0, RedisBloom)
- [CVE-2024-24576](https://cve.now/CVE-2024-24576.md): Rusts's \`std::process::Command\` did not properly escape arguments of batch files on Windows (CVSS 10.0, rust-lang rust)
- [CVE-2024-22423](https://cve.now/CVE-2024-22423.md): yt-dlp \`--exec\` command injection when using \`%q\` in yt-dlp on Windows (CVSS 8.4, yt-dlp)
- [CVE-2024-31454](https://cve.now/CVE-2024-31454.md): PsiTransfer file integrity violation vulnerability (CVSS 6.5, psi-4ward psitransfer · psitransfer)
- [CVE-2024-27242](https://cve.now/CVE-2024-27242.md): Zoom Desktop Client for Linux - Cross Site Scripting (CVSS 4.1, Zoom Video Communications Zoom Desktop Client for Linux)
- [CVE-2024-27247](https://cve.now/CVE-2024-27247.md): Zoom Desktop Client for macOS - Improper Privilege Management (CVSS 5.5, Zoom Video Communications Zoom Desktop Client for macOS)
- [CVE-2024-24694](https://cve.now/CVE-2024-24694.md): Zoom Desktop Client for Windows - Improper Privilege Management (CVSS 5.9, Zoom Video Communications Zoom Desktop Client for Windows)
- [CVE-2024-31453](https://cve.now/CVE-2024-31453.md): PsiTransfer vulnerable to violation of the integrity of file distribution (CVSS 6.5, psi-4ward psitransfer · psitransfer)
- [CVE-2024-29993](https://cve.now/CVE-2024-29993.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Azure CycleCloud)
- [CVE-2024-29992](https://cve.now/CVE-2024-29992.md): Azure Identity Library for .NET Information Disclosure Vulnerability (CVSS 5.5, Microsoft Azure Identity Library for .NET · Azure.Identity)
- [CVE-2024-29989](https://cve.now/CVE-2024-29989.md): Azure Monitor Agent Elevation of Privilege Vulnerability (CVSS 8.4, Microsoft Azure Monitor)
- [CVE-2024-29985](https://cve.now/CVE-2024-29985.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-29984](https://cve.now/CVE-2024-29984.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-29983](https://cve.now/CVE-2024-29983.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-29982](https://cve.now/CVE-2024-29982.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-20670](https://cve.now/CVE-2024-20670.md): Outlook for Windows Spoofing Vulnerability (CVSS 8.1, Microsoft Outlook for Windows)
- [CVE-2024-29062](https://cve.now/CVE-2024-29062.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2024-29061](https://cve.now/CVE-2024-29061.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-29056](https://cve.now/CVE-2024-29056.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 4.3, Microsoft Windows Server)
- [CVE-2024-29054](https://cve.now/CVE-2024-29054.md): Microsoft Defender for IoT Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Defender for IoT)
- [CVE-2024-29055](https://cve.now/CVE-2024-29055.md): Microsoft Defender for IoT Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Defender for IoT)
- [CVE-2024-29053](https://cve.now/CVE-2024-29053.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Defender for IoT)
- [CVE-2024-29052](https://cve.now/CVE-2024-29052.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-29048](https://cve.now/CVE-2024-29048.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-29046](https://cve.now/CVE-2024-29046.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-29044](https://cve.now/CVE-2024-29044.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28944](https://cve.now/CVE-2024-28944.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28943](https://cve.now/CVE-2024-28943.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +5)
- [CVE-2024-28941](https://cve.now/CVE-2024-28941.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +5)
- [CVE-2024-28940](https://cve.now/CVE-2024-28940.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28938](https://cve.now/CVE-2024-28938.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +7)
- [CVE-2024-28937](https://cve.now/CVE-2024-28937.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6)
- [CVE-2024-28935](https://cve.now/CVE-2024-28935.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6)
- [CVE-2024-28934](https://cve.now/CVE-2024-28934.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +7)
- [CVE-2024-28933](https://cve.now/CVE-2024-28933.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio · Microsoft SQL Server +6)
- [CVE-2024-28930](https://cve.now/CVE-2024-28930.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6)
- [CVE-2024-28927](https://cve.now/CVE-2024-28927.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28926](https://cve.now/CVE-2024-28926.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +2)
- [CVE-2024-28917](https://cve.now/CVE-2024-28917.md): Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability (CVSS 6.2, Microsoft Azure Arc Extension)
- [CVE-2024-28907](https://cve.now/CVE-2024-28907.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-28904](https://cve.now/CVE-2024-28904.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-28900](https://cve.now/CVE-2024-28900.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-28897](https://cve.now/CVE-2024-28897.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-28925](https://cve.now/CVE-2024-28925.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-28924](https://cve.now/CVE-2024-28924.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-26257](https://cve.now/CVE-2024-26257.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC f…)
- [CVE-2024-26251](https://cve.now/CVE-2024-26251.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.8, Microsoft SharePoint Server)
- [CVE-2024-26240](https://cve.now/CVE-2024-26240.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-26239](https://cve.now/CVE-2024-26239.md): Windows Telephony Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26230](https://cve.now/CVE-2024-26230.md): Windows Telephony Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26228](https://cve.now/CVE-2024-26228.md): Windows Cryptographic Services Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26226](https://cve.now/CVE-2024-26226.md): Windows Distributed File System (DFS) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2024-26217](https://cve.now/CVE-2024-26217.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26216](https://cve.now/CVE-2024-26216.md): Windows File Server Resource Management Service Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows Server)
- [CVE-2024-26215](https://cve.now/CVE-2024-26215.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-26214](https://cve.now/CVE-2024-26214.md): Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26213](https://cve.now/CVE-2024-26213.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-26212](https://cve.now/CVE-2024-26212.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-26211](https://cve.now/CVE-2024-26211.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26208](https://cve.now/CVE-2024-26208.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2024-26207](https://cve.now/CVE-2024-26207.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26245](https://cve.now/CVE-2024-26245.md): Windows SMB Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26244](https://cve.now/CVE-2024-26244.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26242](https://cve.now/CVE-2024-26242.md): Windows Telephony Server Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-26237](https://cve.now/CVE-2024-26237.md): Windows Defender Credential Guard Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26236](https://cve.now/CVE-2024-26236.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-26235](https://cve.now/CVE-2024-26235.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-26234](https://cve.now/CVE-2024-26234.md): Proxy Driver Spoofing Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-26229](https://cve.now/CVE-2024-26229.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26210](https://cve.now/CVE-2024-26210.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26248](https://cve.now/CVE-2024-26248.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-26243](https://cve.now/CVE-2024-26243.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-26241](https://cve.now/CVE-2024-26241.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26233](https://cve.now/CVE-2024-26233.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26231](https://cve.now/CVE-2024-26231.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26227](https://cve.now/CVE-2024-26227.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26224](https://cve.now/CVE-2024-26224.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26223](https://cve.now/CVE-2024-26223.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26222](https://cve.now/CVE-2024-26222.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26221](https://cve.now/CVE-2024-26221.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26220](https://cve.now/CVE-2024-26220.md): Windows Mobile Hotspot Information Disclosure Vulnerability (CVSS 5.0, Microsoft Windows)
- [CVE-2024-26219](https://cve.now/CVE-2024-26219.md): HTTP.sys Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-26218](https://cve.now/CVE-2024-26218.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26209](https://cve.now/CVE-2024-26209.md): Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26202](https://cve.now/CVE-2024-26202.md): DHCP Server Service Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26195](https://cve.now/CVE-2024-26195.md): DHCP Server Service Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-26194](https://cve.now/CVE-2024-26194.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2024-26189](https://cve.now/CVE-2024-26189.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-26183](https://cve.now/CVE-2024-26183.md): Windows Kerberos Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-26180](https://cve.now/CVE-2024-26180.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-26175](https://cve.now/CVE-2024-26175.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26171](https://cve.now/CVE-2024-26171.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-26168](https://cve.now/CVE-2024-26168.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-26193](https://cve.now/CVE-2024-26193.md): Azure Migrate Remote Code Execution Vulnerability (CVSS 6.4, Microsoft Azure Migrate)
- [CVE-2024-21447](https://cve.now/CVE-2024-21447.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-21324](https://cve.now/CVE-2024-21324.md): Microsoft Defender for IoT Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Defender for IoT)
- [CVE-2024-21323](https://cve.now/CVE-2024-21323.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Defender for IoT)
- [CVE-2024-21322](https://cve.now/CVE-2024-21322.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Defender for IoT)
- [CVE-2024-20693](https://cve.now/CVE-2024-20693.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-20665](https://cve.now/CVE-2024-20665.md): BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2024-20678](https://cve.now/CVE-2024-20678.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-29990](https://cve.now/CVE-2024-29990.md): Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Azure Kubernetes Service)
- [CVE-2024-29988](https://cve.now/CVE-2024-29988.md): SmartScreen Prompt Security Feature Bypass Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2024-20685](https://cve.now/CVE-2024-20685.md): Azure Private 5G Core Denial of Service Vulnerability (CVSS 5.9, Microsoft Azure Private 5G Core)
- [CVE-2024-29066](https://cve.now/CVE-2024-29066.md): Windows Distributed File System (DFS) Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server)
- [CVE-2024-29064](https://cve.now/CVE-2024-29064.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2024-29063](https://cve.now/CVE-2024-29063.md): Azure AI Search Information Disclosure Vulnerability (CVSS 7.3, Microsoft Azure AI Search)
- [CVE-2024-29050](https://cve.now/CVE-2024-29050.md): Windows Cryptographic Services Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Windows)
- [CVE-2024-29047](https://cve.now/CVE-2024-29047.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server)
- [CVE-2024-29045](https://cve.now/CVE-2024-29045.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 7.5, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-29043](https://cve.now/CVE-2024-29043.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +6)
- [CVE-2024-28945](https://cve.now/CVE-2024-28945.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28942](https://cve.now/CVE-2024-28942.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +2)
- [CVE-2024-28939](https://cve.now/CVE-2024-28939.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28936](https://cve.now/CVE-2024-28936.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +7)
- [CVE-2024-28932](https://cve.now/CVE-2024-28932.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +7)
- [CVE-2024-28931](https://cve.now/CVE-2024-28931.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +7)
- [CVE-2024-28929](https://cve.now/CVE-2024-28929.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +6)
- [CVE-2024-28915](https://cve.now/CVE-2024-28915.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28914](https://cve.now/CVE-2024-28914.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +2)
- [CVE-2024-28913](https://cve.now/CVE-2024-28913.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28912](https://cve.now/CVE-2024-28912.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +2)
- [CVE-2024-28911](https://cve.now/CVE-2024-28911.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28910](https://cve.now/CVE-2024-28910.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28909](https://cve.now/CVE-2024-28909.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +2)
- [CVE-2024-28908](https://cve.now/CVE-2024-28908.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2024-28906](https://cve.now/CVE-2024-28906.md): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server 2022 for · Microsoft SQL Server +2)
- [CVE-2024-28905](https://cve.now/CVE-2024-28905.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-28903](https://cve.now/CVE-2024-28903.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-28902](https://cve.now/CVE-2024-28902.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-28901](https://cve.now/CVE-2024-28901.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-28898](https://cve.now/CVE-2024-28898.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.3, Microsoft Windows)
- [CVE-2024-28896](https://cve.now/CVE-2024-28896.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-28923](https://cve.now/CVE-2024-28923.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.4, Microsoft Windows)
- [CVE-2024-28919](https://cve.now/CVE-2024-28919.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-28921](https://cve.now/CVE-2024-28921.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-28922](https://cve.now/CVE-2024-28922.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 4.1, Microsoft Windows)
- [CVE-2024-28920](https://cve.now/CVE-2024-28920.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26232](https://cve.now/CVE-2024-26232.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-26158](https://cve.now/CVE-2024-26158.md): Microsoft Install Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26205](https://cve.now/CVE-2024-26205.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26200](https://cve.now/CVE-2024-26200.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26179](https://cve.now/CVE-2024-26179.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26172](https://cve.now/CVE-2024-26172.md): Windows DWM Core Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26256](https://cve.now/CVE-2024-26256.md): Libarchive Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26255](https://cve.now/CVE-2024-26255.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26254](https://cve.now/CVE-2024-26254.md): Microsoft Virtual Machine Bus (VMBus) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-26253](https://cve.now/CVE-2024-26253.md): Windows rndismp6.sys Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-26252](https://cve.now/CVE-2024-26252.md): Windows rndismp6.sys Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-26250](https://cve.now/CVE-2024-26250.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-21424](https://cve.now/CVE-2024-21424.md): Azure Compute Gallery Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure Compute Gallery)
- [CVE-2024-21409](https://cve.now/CVE-2024-21409.md): .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Visual Studio · Microsoft PowerShell +4)
- [CVE-2024-20689](https://cve.now/CVE-2024-20689.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Windows Server)
- [CVE-2024-20688](https://cve.now/CVE-2024-20688.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Windows Server)
- [CVE-2024-20669](https://cve.now/CVE-2024-20669.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2024-31455](https://cve.now/CVE-2024-31455.md): Minder GetRepositoryByName data leak (CVSS 4.3, stacklok minder · github.com/stacklok/minder)
- [CVE-2024-29905](https://cve.now/CVE-2024-29905.md): DIRAC: Unauthorized users can read proxy contents during generation (CVSS 8.1, DIRACGrid DIRAC · dirac)
- [CVE-2024-30262](https://cve.now/CVE-2024-30262.md): Contao's remember-me tokens will not be cleared after a password change (CVSS 5.9, contao · contao/core-bundle)
- [CVE-2024-31867](https://cve.now/CVE-2024-31867.md): Apache Zeppelin: LDAP search filter query Injection Vulnerability (CVSS 6.5, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-31868](https://cve.now/CVE-2024-31868.md): Apache Zeppelin: XSS vulnerability in the helium module (CVSS 6.1, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-31866](https://cve.now/CVE-2024-31866.md): Apache Zeppelin: Interpreter download command does not escape malicious code injection (CVSS 9.8, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-31865](https://cve.now/CVE-2024-31865.md): Apache Zeppelin: Cron arbitrary user impersonation with improper privileges (CVSS 6.5, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-31864](https://cve.now/CVE-2024-31864.md): Apache Zeppelin: Remote code execution by adding malicious JDBC connection string (CVSS 9.8, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-28235](https://cve.now/CVE-2024-28235.md): Contao possible cookie sharing with external domains while checking protected pages for broken links (CVSS 8.4, contao · contao/core-bundle)
- [CVE-2024-3281](https://cve.now/CVE-2024-3281.md): A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. (CVSS 8.8, HP Poly CCX devices)
- [CVE-2024-21755](https://cve.now/CVE-2024-21755.md): A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 th (CVSS 8.6, Fortinet FortiSandbox)
- [CVE-2023-48784](https://cve.now/CVE-2023-48784.md): A use of externally-controlled format string vulnerability \[CWE-134\] in FortiOS version 7.4.1 and below, version 7.2.7 and below, 7.0 all ve (CVSS 6.1, Fortinet FortiOS)
- [CVE-2023-47542](https://cve.now/CVE-2023-47542.md): A improper neutralization of special elements used in a template engine \[CWE-1336\] in FortiManager versions 7.4.1 and below, versions 7.2.4 (CVSS 6.3, Fortinet FortiManager)
- [CVE-2024-21756](https://cve.now/CVE-2024-21756.md): A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 th (CVSS 8.6, Fortinet FortiSandbox)
- [CVE-2023-47540](https://cve.now/CVE-2023-47540.md): An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 t (CVSS 6.5, Fortinet FortiSandbox)
- [CVE-2024-31487](https://cve.now/CVE-2024-31487.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, (CVSS 5.8, Fortinet FortiSandbox)
- [CVE-2023-41677](https://cve.now/CVE-2023-41677.md): A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 thr (CVSS 7.5, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2024-23671](https://cve.now/CVE-2024-23671.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.3, (CVSS 7.9, Fortinet FortiSandbox)
- [CVE-2023-47541](https://cve.now/CVE-2023-47541.md): An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.2 (CVSS 6.5, Fortinet FortiSandbox)
- [CVE-2023-45590](https://cve.now/CVE-2023-45590.md): An improper control of generation of code ('code injection') in Fortinet FortiClientLinux version 7.2.0, 7.0.6 through 7.0.10 and 7.0.3 thro (CVSS 9.4, Fortinet FortiClientLinux)
- [CVE-2024-23662](https://cve.now/CVE-2024-23662.md): An exposure of sensitive information to an unauthorized actor in Fortinet FortiOS at least version at least 7.4.0 through 7.4.1 and 7.2.0 th (CVSS 5.0, Fortinet FortiOS)
- [CVE-2023-49074](https://cve.now/CVE-2023-49074.md): A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1. (CVSS 7.4, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point)
- [CVE-2023-49134](https://cve.now/CVE-2023-49134.md): A command execution vulnerability exists in the tddpd enable\_test\_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (CVSS 8.1, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49133](https://cve.now/CVE-2023-49133.md): A command execution vulnerability exists in the tddpd enable\_test\_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (CVSS 8.1, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-48724](https://cve.now/CVE-2023-48724.md): A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 (CVSS 7.5, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point)
- [CVE-2023-49913](https://cve.now/CVE-2023-49913.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49912](https://cve.now/CVE-2023-49912.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49911](https://cve.now/CVE-2023-49911.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49910](https://cve.now/CVE-2023-49910.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49909](https://cve.now/CVE-2023-49909.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49908](https://cve.now/CVE-2023-49908.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49907](https://cve.now/CVE-2023-49907.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2023-49906](https://cve.now/CVE-2023-49906.md): A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi (CVSS 7.2, Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point · Tp-L…)
- [CVE-2024-28234](https://cve.now/CVE-2024-28234.md): Contao has insufficient BBCode sanitizer (CVSS 4.3, contao · contao/comments-bundle)
- [CVE-2024-28191](https://cve.now/CVE-2024-28191.md): Contao may have unencoded insert tags in the frontend (CVSS 3.1, contao · contao/core-bundle)
- [CVE-2024-28190](https://cve.now/CVE-2024-28190.md): Contao core bundle vulnerable to cross site scripting in the file manager (CVSS 5.4, contao · contao/core-bundle)
- [CVE-2023-6320](https://cve.now/CVE-2023-6320.md): Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint (CVSS 9.1, LG webOS)
- [CVE-2023-6319](https://cve.now/CVE-2023-6319.md): Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service (CVSS 9.1, LG webOS)
- [CVE-2023-6318](https://cve.now/CVE-2023-6318.md): Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service (CVSS 9.1, LG webOS)
- [CVE-2023-6317](https://cve.now/CVE-2023-6317.md): PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction (CVSS 7.2, LG WebOS)
- [CVE-2024-2224](https://cve.now/CVE-2024-2224.md): Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466) (CVSS 8.1, Bitdefender GravityZone Control Center · Bitdefender End… +1)
- [CVE-2024-2223](https://cve.now/CVE-2024-2223.md): Incorrect Regular Expression in GravityZone Update Server (VA-11465) (CVSS 8.1, Bitdefender GravityZone Control Center · Bitdefender End… +1)
- [CVE-2024-31863](https://cve.now/CVE-2024-31863.md): Apache Zeppelin: Replacing other users notebook, bypassing any permissions (CVSS 5.3, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-3046](https://cve.now/CVE-2024-3046.md): In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unauthe (CVSS 7.5, Eclipse Foundation Kura · org.eclipse.kura:org.eclipse.kura…)
- [CVE-2024-31862](https://cve.now/CVE-2024-31862.md): Apache Zeppelin: Denial of service with invalid notebook name (CVSS 5.3, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2022-47894](https://cve.now/CVE-2022-47894.md): Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE (CVSS 5.3, Apache Software Foundation Apache Zeppelin SAP · org.apache…)
- [CVE-2021-28656](https://cve.now/CVE-2021-28656.md): Apache Zeppelin: CSRF vulnerability in the Credentials page (CVSS 5.4, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-31860](https://cve.now/CVE-2024-31860.md): Apache Zeppelin: Path traversal vulnerability (CVSS 6.5, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2024-31370](https://cve.now/CVE-2024-31370.md): WordPress CodeisAwesome AIKit plugin \<= 4.14.1 - SQL Injection vulnerability (CVSS 8.5, CodeIsAwesome AIKit)
- [CVE-2024-31978](https://cve.now/CVE-2024-31978.md): A vulnerability has been identified in SINEC NMS (All versions \< V2.0 SP2). (CVSS 7.6, Siemens SINEC NMS)
- [CVE-2024-30191](https://cve.now/CVE-2024-30191.md): A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788- (CVSS 8.4, Siemens SCALANCE W1748-1 M12 · Siemens SCALANCE W1788-1… +25)
- [CVE-2024-30190](https://cve.now/CVE-2024-30190.md): A vulnerability has been identified in SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0), SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0), SCALANCE W1788- (CVSS 6.1, Siemens SCALANCE W1748-1 M12 · Siemens SCALANCE W1788-1… +25)
- [CVE-2024-30189](https://cve.now/CVE-2024-30189.md): A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) ( (CVSS 6.1, Siemens SCALANCE W721-1 RJ45 · Siemens SCALANCE W722-1… +16)
- [CVE-2024-26277](https://cve.now/CVE-2024-26277.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0004), Parasolid V35.1 (All versions \< V35.1.254), Parasolid V36.0 (All v (CVSS 3.3, Siemens JT2Go · Siemens Parasolid +1)
- [CVE-2024-26276](https://cve.now/CVE-2024-26276.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0004), Parasolid V35.1 (All versions \< V35.1.254), Parasolid V36.0 (All v (CVSS 3.3, Siemens JT2Go · Siemens Parasolid +1)
- [CVE-2024-26275](https://cve.now/CVE-2024-26275.md): A vulnerability has been identified in JT2Go (All versions \< V2312.0004), Parasolid V35.1 (All versions \< V35.1.254), Parasolid V36.0 (All v (CVSS 7.8, Siemens JT2Go · Siemens Parasolid +1)
- [CVE-2023-50821](https://cve.now/CVE-2023-50821.md): A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions \< V9.1 SP2 UC04), SIMATIC WinCC Runtime Professional V17 (All versio (CVSS 6.2, Siemens SIMATIC PCS 7 · Siemens SIMATIC WinCC Runtime Pr… +1)
- [CVE-2024-31369](https://cve.now/CVE-2024-31369.md): WordPress Soledad theme \<= 8.4.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, PenciDesign Soledad)
- [CVE-2023-1083](https://cve.now/CVE-2023-1083.md): Welotec: improper access control in TK500v1 router series (CVSS 9.8, Welotec TK515L · Welotec TK515L-W +5)
- [CVE-2023-1082](https://cve.now/CVE-2023-1082.md): Welotec: Command injection vulnerability in TK500v1 router series (CVSS 8.8, Welotec TK515L · Welotec TK515L-W +5)
- [CVE-2024-31368](https://cve.now/CVE-2024-31368.md): WordPress Soledad theme \<= 8.4.2 - Unauthenticated Broken Access Control vulnerability (CVSS 6.5, PenciDesign Soledad)
- [CVE-2024-31367](https://cve.now/CVE-2024-31367.md): WordPress Soledad theme \<= 8.4.2 - Authenticated Broken Access Control vulnerability (CVSS 7.1, PenciDesign Soledad)
- [CVE-2024-31366](https://cve.now/CVE-2024-31366.md): WordPress Post Type Builder (PTB) plugin \<= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerability (CVSS 7.1, Themify Post Type Builder)
- [CVE-2024-31365](https://cve.now/CVE-2024-31365.md): WordPress Post Type Builder (PTB) plugin \< 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Themify Post Type Builder)
- [CVE-2024-1233](https://cve.now/CVE-2024-1233.md): Eap: wildfly-elytron has a ssrf security issue (CVSS 7.3, wildfly · Red Hat JBoss Enterprise Application Platform +1)
- [CVE-2024-1664](https://cve.now/CVE-2024-1664.md): Responsive Gallery Grid \< 2.3.11 - Admin+ Stored XSS (CVSS 6.1, Responsive Gallery Grid)
- [CVE-2024-27983](https://cve.now/CVE-2024-27983.md): An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 f (CVSS 8.2, NodeJS Node)
- [CVE-2024-30218](https://cve.now/CVE-2024-30218.md): Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (CVSS 6.5, SAP\_SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2024-30217](https://cve.now/CVE-2024-30217.md): Missing Authorization check in SAP S/4 HANA (Cash Management) (CVSS 4.3, SAP\_SE SAP S/4 HANA)
- [CVE-2024-2975](https://cve.now/CVE-2024-2975.md): A race condition was identified through which privilege escalation was possible in certain configurations. (CVSS 8.8, Octopus Deploy Octopus Server)
- [CVE-2024-30216](https://cve.now/CVE-2024-30216.md): Missing Authorization check in SAP S/4 HANA (Cash Management) (CVSS 4.3, SAP\_SE SAP S/4 HANA)
- [CVE-2024-30215](https://cve.now/CVE-2024-30215.md): Cross-Site Scripting (XSS) vulnerability in SAP Business Connector (CVSS 4.8, SAP\_SE SAP Business Connector)
- [CVE-2024-30214](https://cve.now/CVE-2024-30214.md): Cross-Site Scripting (XSS) vulnerability in SAP Business Connector (CVSS 4.8, SAP\_SE SAP Business Connector)
- [CVE-2024-28167](https://cve.now/CVE-2024-28167.md): Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data) (CVSS 6.5, SAP\_SE SAP Group Reporting Data Collection)
- [CVE-2024-27901](https://cve.now/CVE-2024-27901.md): Directory Traversal vulnerability in SAP Asset Accounting (CVSS 7.2, SAP\_SE SAP Asset Accounting)
- [CVE-2024-27899](https://cve.now/CVE-2024-27899.md): Security misconfiguration vulnerability in SAP NetWeaver AS Java User Management Engine (CVSS 8.8, SAP\_SE SAP NetWeaver AS Java User Management Engine)
- [CVE-2024-27898](https://cve.now/CVE-2024-27898.md): Server-Side Request Forgery in SAP NetWeaver (CVSS 5.3, SAP\_SE SAP NetWeaver)
- [CVE-2024-25646](https://cve.now/CVE-2024-25646.md): Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence (CVSS 7.7, SAP\_SE SAP BusinessObjects Web Intelligence)
- [CVE-2024-24245](https://cve.now/CVE-2024-24245.md): An issue in Canimaan Software LTD ClamXAV v3.1.2 through v3.6.1 and fixed in v.3.6.2 allows a local attacker to escalate privileges via the (CVSS 7.8)
- [CVE-2024-27665](https://cve.now/CVE-2024-27665.md): Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting (XSS) via file upload feature in Syllabus module. (CVSS 5.4)
- [CVE-2024-31506](https://cve.now/CVE-2024-31506.md): Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "id" parameter in admin/admin\_cs.php. (CVSS 4.9)
- [CVE-2024-31507](https://cve.now/CVE-2024-31507.md): Sourcecodester Online Graduate Tracer System v1.0 is vulnerable to SQL Injection via the "request" parameter in admin/fetch\_gendercs.php. (CVSS 8.6)
- [CVE-2024-31544](https://cve.now/CVE-2024-31544.md): A stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaSc (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.