# CVEs published 2024-04-17

295 CVEs were published on April 17, 2024: 18 critical, 103 high. Days are UTC.

- [CVE-2024-3928](https://cve.now/CVE-2024-3928.md): Dromara open-capacity-platform auth-server heapdump information disclosure (CVSS 4.3, Dromara open-capacity-platform)
- [CVE-2023-4509](https://cve.now/CVE-2023-4509.md): It is possible for an API key to be logged in clear text in the audit log file after an invalid login attempt. (CVSS 4.3, Octopus Deploy Octopus Server)
- [CVE-2023-4235](https://cve.now/CVE-2023-4235.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode\_deliver\_report() function (CVSS 8.1, ofono · Fedora)
- [CVE-2023-4234](https://cve.now/CVE-2023-4234.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode\_submit\_report() function (CVSS 8.1, ofono · Fedora)
- [CVE-2023-4233](https://cve.now/CVE-2023-4233.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the sms\_decode\_address\_field() function (CVSS 8.1, ofono · Fedora)
- [CVE-2023-4232](https://cve.now/CVE-2023-4232.md): Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode\_status\_report() function (CVSS 8.1, ofono · Fedora)
- [CVE-2024-29955](https://cve.now/CVE-2024-29955.md): Insertion of Sensitive Information into Brocade SANnav Log File (CVSS 5.0, Brocade SANnav)
- [CVE-2024-29952](https://cve.now/CVE-2024-29952.md): Clear text storage of sensistive information by manipulating command variables (CVSS 5.5, Brocade SANnav)
- [CVE-2024-32472](https://cve.now/CVE-2024-32472.md): excalidraw vulnerable to a Stored XSS in excalidraw's web embed component (CVSS 6.1, excalidraw · @excalidraw/excalidraw)
- [CVE-2024-0257](https://cve.now/CVE-2024-0257.md): RoboDK Heap-based Buffer Overflow (CVSS 3.3, RoboDK)
- [CVE-2024-3817](https://cve.now/CVE-2024-3817.md): HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches (CVSS 9.8, HashiCorp Shared library · github.com/hashicorp/go-getter)
- [CVE-2024-21990](https://cve.now/CVE-2024-21990.md): Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility (CVSS 5.4, NetApp ONTAP Select Deploy administration utility)
- [CVE-2024-21989](https://cve.now/CVE-2024-21989.md): Privilege Escalation Vulnerability in ONTAP Select Deploy administration utility (CVSS 8.1, NetApp ONTAP Select Deploy administration utility)
- [CVE-2024-29951](https://cve.now/CVE-2024-29951.md): Brocade SANnav has weak encryption in internal SSH ports (CVSS 5.7, Brocade SANnav)
- [CVE-2024-3323](https://cve.now/CVE-2024-3323.md): Reflected Cross Site Scripting (XSS) vulnerability (CVSS 8.3, TIBCO JasperReports Server)
- [CVE-2024-3900](https://cve.now/CVE-2024-3900.md): Out-of-bounds stack array write in Xpdf 4.05 due to missing zero check (CVSS 2.9, Xpdf)
- [CVE-2024-29950](https://cve.now/CVE-2024-29950.md): Brocade SANnav before v2.3.1, v2.3.0a uses weak encryption (CVSS 7.5, Brocade SANnav)
- [CVE-2024-2961](https://cve.now/CVE-2024-2961.md): The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converti (CVSS 7.3, The GNU C Library glibc)
- [CVE-2024-3914](https://cve.now/CVE-2024-3914.md): Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-28073](https://cve.now/CVE-2024-28073.md): SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability (CVSS 8.4, SolarWinds ServU)
- [CVE-2023-5407](https://cve.now/CVE-2023-5407.md): Controller denial of service due to improper handling of a specially crafted message received by the controller. (CVSS 5.9, Honeywell C300)
- [CVE-2023-5406](https://cve.now/CVE-2023-5406.md): Server communication with a controller can lead to remote code execution using a specially crafted message from the controller. (CVSS 5.9, Honeywell Experion Server)
- [CVE-2023-5405](https://cve.now/CVE-2023-5405.md): Server information leak for the CDA Server process memory can occur when an error is generated in response to a specially crafted message. (CVSS 5.9, Honeywell Experion Server)
- [CVE-2023-5404](https://cve.now/CVE-2023-5404.md): Server receiving a malformed message can cause a pointer to be overwritten which can result in a remote code execution or failure. (CVSS 8.1, Honeywell Experion Server)
- [CVE-2023-5403](https://cve.now/CVE-2023-5403.md): Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure (CVSS 8.1, Honeywell Experion Server)
- [CVE-2023-5401](https://cve.now/CVE-2023-5401.md): Server receiving a malformed message based on a using the specified key values can cause a stack overflow vulnerability which could lead to (CVSS 8.1, Honeywell Experion Server)
- [CVE-2023-5400](https://cve.now/CVE-2023-5400.md): Server receiving a malformed message based on a using the specified key values can cause a heap overflow vulnerability which could lead to a (CVSS 8.1, Honeywell Experion Server)
- [CVE-2023-5398](https://cve.now/CVE-2023-5398.md): Server receiving a malformed message based on a list of IPs resulting in heap corruption causing a denial of service. (CVSS 5.9, Honeywell Experion Server)
- [CVE-2023-5397](https://cve.now/CVE-2023-5397.md): Server receiving a malformed message to create a new connection could lead to an attacker performing remote code execution or causing a fail (CVSS 8.1, Honeywell Experion Server)
- [CVE-2023-5396](https://cve.now/CVE-2023-5396.md): Server receiving a malformed message creates connection for a hostname that may cause a stack overflow resulting in possible remote code exe (CVSS 7.4, Honeywell Experion Server)
- [CVE-2023-5395](https://cve.now/CVE-2023-5395.md): Server receiving a malformed message that uses the hostname in an internal table may cause a stack overflow resulting in possible remote cod (CVSS 8.1, Honeywell Experion Server)
- [CVE-2024-26920](https://cve.now/CVE-2024-26920.md): tracing/trigger: Fix to return error if failed to alloc snapshot (no CVSS, Linux)
- [CVE-2024-26919](https://cve.now/CVE-2024-26919.md): usb: ulpi: Fix debugfs directory leak (CVSS 7.8, Linux)
- [CVE-2024-26918](https://cve.now/CVE-2024-26918.md): PCI: Fix active state requirement in PME polling (CVSS 6.2, Linux)
- [CVE-2024-26917](https://cve.now/CVE-2024-26917.md): scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip-\>ctlr\_lock" (no CVSS, Linux)
- [CVE-2024-26916](https://cve.now/CVE-2024-26916.md): Revert "drm/amd: flush any delayed gfxoff on suspend entry" (no CVSS, Linux)
- [CVE-2024-26915](https://cve.now/CVE-2024-26915.md): drm/amdgpu: Reset IH OVERFLOW\_CLEAR bit (CVSS 5.5, Linux)
- [CVE-2024-26914](https://cve.now/CVE-2024-26914.md): drm/amd/display: fix incorrect mpc\_combine array size (CVSS 7.8, Linux)
- [CVE-2024-26913](https://cve.now/CVE-2024-26913.md): drm/amd/display: Fix dcn35 8k30 Underflow/Corruption Issue (no CVSS, Linux)
- [CVE-2024-26912](https://cve.now/CVE-2024-26912.md): drm/nouveau: fix several DMA buffer leaks (no CVSS, Linux)
- [CVE-2024-26911](https://cve.now/CVE-2024-26911.md): drm/buddy: Fix alloc\_range() error handling code (CVSS 7.8, Linux)
- [CVE-2024-26910](https://cve.now/CVE-2024-26910.md): netfilter: ipset: fix performance regression in swap operation (no CVSS, Linux)
- [CVE-2023-52645](https://cve.now/CVE-2023-52645.md): pmdomain: mediatek: fix race conditions with genpd (no CVSS, Linux)
- [CVE-2024-32463](https://cve.now/CVE-2024-32463.md): phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of \`href\` attributes on \`\<a\>\` tags (CVSS 7.1, phlex-ruby phlex · phlex)
- [CVE-2024-31463](https://cve.now/CVE-2024-31463.md): Ironic-image allows unauthenticated local access to Ironic API (CVSS 4.7, metal3-io ironic-image)
- [CVE-2024-30253](https://cve.now/CVE-2024-30253.md): Handling untrusted input can result in a crash, leading to loss of availability / denial of service (CVSS 7.5, solana-labs solana-web3.js · @solana/web3.js)
- [CVE-2024-3825](https://cve.now/CVE-2024-3825.md): CSRF in BlazeMeter Jenkins plugin (CVSS 4.3, BlazeMeter Jenkins plugin · com.blazemeter.plugins:BlazeMet…)
- [CVE-2024-29035](https://cve.now/CVE-2024-29035.md): Umbraco's Blind SSRF Leads to Port Scan by using Webhooks (CVSS 4.1, Umbraco-CMS · Umbraco.Cms.Core +1)
- [CVE-2024-2419](https://cve.now/CVE-2024-2419.md): Keycloak: path traversal in the redirect validation (CVSS 7.1, keycloak · Red Hat build of Keycloak +1)
- [CVE-2024-1249](https://cve.now/CVE-2024-1249.md): Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos (CVSS 7.4, keycloak · Red Hat AMQ Broker +16)
- [CVE-2024-1132](https://cve.now/CVE-2024-1132.md): Keycloak: path transversal in redirection validation (CVSS 8.1, keycloak · Red Hat Migration Toolkit for Runtimes 1 on… +15)
- [CVE-2023-43491](https://cve.now/CVE-2023-43491.md): An information disclosure vulnerability exists in the web interface /cgi-bin/debug\_dump.cgi functionality of Peplink Smart Reader v1.2.0 (in (CVSS 5.3, Peplink Smart Reader)
- [CVE-2023-45209](https://cve.now/CVE-2023-45209.md): An information disclosure vulnerability exists in the web interface /cgi-bin/download\_config.cgi functionality of Peplink Smart Reader v1.2. (CVSS 5.3, Peplink Smart Reader)
- [CVE-2023-45744](https://cve.now/CVE-2023-45744.md): A data integrity vulnerability exists in the web interface /cgi-bin/upload\_config.cgi functionality of Peplink Smart Reader v1.2.0 (in QEMU) (CVSS 8.3, Peplink Smart Reader)
- [CVE-2023-39367](https://cve.now/CVE-2023-39367.md): An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). (CVSS 9.1, Peplink Smart Reader)
- [CVE-2023-40146](https://cve.now/CVE-2023-40146.md): A privilege escalation vulnerability exists in the /bin/login functionality of Peplink Smart Reader v1.2.0 (in QEMU). (CVSS 6.8, Peplink Smart Reader)
- [CVE-2023-6805](https://cve.now/CVE-2023-6805.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF) (CVSS 6.4, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2024-3910](https://cve.now/CVE-2024-3910.md): Tenda AC500 DhcpListClient fromDhcpListClient stack-based overflow (CVSS 8.8, Tenda AC500)
- [CVE-2024-3333](https://cve.now/CVE-2024-3333.md): Essential Addons for Elementor \<= 5.9.14 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget URL Attribute (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-3909](https://cve.now/CVE-2024-3909.md): Tenda AC500 execCommand formexeCommand stack-based overflow (CVSS 8.8, Tenda AC500)
- [CVE-2024-3908](https://cve.now/CVE-2024-3908.md): Tenda AC500 WriteFacMac formWriteFacMac command injection (CVSS 6.3, Tenda AC500)
- [CVE-2024-3907](https://cve.now/CVE-2024-3907.md): Tenda AC500 setcfm formSetCfm stack-based overflow (CVSS 8.8, Tenda AC500)
- [CVE-2023-51418](https://cve.now/CVE-2023-51418.md): WordPress JVM rich text icons plugin \<= 1.2.6 - Arbitrary File Deletion vulnerability (CVSS 7.7, Joris van Montfort JVM rich text icons)
- [CVE-2023-51500](https://cve.now/CVE-2023-51500.md): WordPress Uncode Core plugin \<= 2.8.8 - Arbitrary File Deletion vulnerability (CVSS 7.7, Undsgn Uncode Core)
- [CVE-2024-3906](https://cve.now/CVE-2024-3906.md): Tenda AC500 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda AC500)
- [CVE-2024-3905](https://cve.now/CVE-2024-3905.md): Tenda AC500 execCommand R7WebsSecurityHandler stack-based overflow (CVSS 8.8, Tenda AC500)
- [CVE-2024-26909](https://cve.now/CVE-2024-26909.md): soc: qcom: pmic\_glink\_altmode: fix drm bridge use-after-free (CVSS 7.0, Linux)
- [CVE-2024-26907](https://cve.now/CVE-2024-26907.md): RDMA/mlx5: Fix fortify source warning while accessing Eth segment (CVSS 7.8, Linux)
- [CVE-2024-26906](https://cve.now/CVE-2024-26906.md): x86/mm: Disallow vsyscall page read for copy\_from\_kernel\_nofault() (no CVSS, Linux)
- [CVE-2024-26903](https://cve.now/CVE-2024-26903.md): Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm\_check\_security (CVSS 5.5, Linux)
- [CVE-2024-26902](https://cve.now/CVE-2024-26902.md): perf: RISCV: Fix panic on pmu overflow handler (no CVSS, Linux)
- [CVE-2024-26901](https://cve.now/CVE-2024-26901.md): do\_sys\_name\_to\_handle(): use kzalloc() to fix kernel-infoleak (CVSS 5.3, Linux)
- [CVE-2024-26900](https://cve.now/CVE-2024-26900.md): md: fix kmemleak of rdev-\>serial (no CVSS, Linux)
- [CVE-2024-26899](https://cve.now/CVE-2024-26899.md): block: fix deadlock between bd\_link\_disk\_holder and partition scan (no CVSS, Linux)
- [CVE-2024-26898](https://cve.now/CVE-2024-26898.md): aoe: fix the potential use-after-free problem in aoecmd\_cfg\_pkts (CVSS 7.8, Linux)
- [CVE-2024-26897](https://cve.now/CVE-2024-26897.md): wifi: ath9k: delay all of ath9k\_wmi\_event\_tasklet() until init is complete (no CVSS, Linux)
- [CVE-2024-26896](https://cve.now/CVE-2024-26896.md): wifi: wfx: fix memory leak when starting AP (no CVSS, Linux)
- [CVE-2024-26895](https://cve.now/CVE-2024-26895.md): wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces (CVSS 7.8, Linux)
- [CVE-2024-26894](https://cve.now/CVE-2024-26894.md): ACPI: processor\_idle: Fix memory leak in acpi\_processor\_power\_exit() (CVSS 6.0, Linux)
- [CVE-2024-26893](https://cve.now/CVE-2024-26893.md): firmware: arm\_scmi: Fix double free in SMC transport cleanup path (no CVSS, Linux)
- [CVE-2024-26892](https://cve.now/CVE-2024-26892.md): wifi: mt76: mt7921e: fix use-after-free in free\_irq() (no CVSS, Linux)
- [CVE-2024-26891](https://cve.now/CVE-2024-26891.md): iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected (no CVSS, Linux)
- [CVE-2024-26890](https://cve.now/CVE-2024-26890.md): Bluetooth: btrtl: fix out of bounds memory access (CVSS 7.8, Linux)
- [CVE-2024-26889](https://cve.now/CVE-2024-26889.md): Bluetooth: hci\_core: Fix possible buffer overflow (CVSS 5.5, Linux)
- [CVE-2024-26888](https://cve.now/CVE-2024-26888.md): Bluetooth: msft: Fix memory leak (no CVSS, Linux)
- [CVE-2024-26887](https://cve.now/CVE-2024-26887.md): Bluetooth: btusb: Fix memory leak (no CVSS, Linux)
- [CVE-2024-26886](https://cve.now/CVE-2024-26886.md): Bluetooth: af\_bluetooth: Fix deadlock (CVSS 6.5, Linux)
- [CVE-2024-26885](https://cve.now/CVE-2024-26885.md): bpf: Fix DEVMAP\_HASH overflow check on 32-bit arches (CVSS 7.8, Linux)
- [CVE-2024-26884](https://cve.now/CVE-2024-26884.md): bpf: Fix hashtab overflow check on 32-bit arches (CVSS 7.8, Linux)
- [CVE-2024-26883](https://cve.now/CVE-2024-26883.md): bpf: Fix stackmap overflow check on 32-bit arches (CVSS 7.8, Linux)
- [CVE-2024-26882](https://cve.now/CVE-2024-26882.md): net: ip\_tunnel: make sure to pull inner header in ip\_tunnel\_rcv() (CVSS 7.3, Linux)
- [CVE-2024-26881](https://cve.now/CVE-2024-26881.md): net: hns3: fix kernel crash when 1588 is received on HIP08 devices (CVSS 7.5, Linux)
- [CVE-2024-26880](https://cve.now/CVE-2024-26880.md): dm: call the resume method on internal suspend (CVSS 7.8, Linux)
- [CVE-2024-26879](https://cve.now/CVE-2024-26879.md): clk: meson: Add missing clocks to axg\_clk\_regmaps (no CVSS, Linux)
- [CVE-2024-26878](https://cve.now/CVE-2024-26878.md): quota: Fix potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2024-26877](https://cve.now/CVE-2024-26877.md): crypto: xilinx - call finalize with bh disabled (CVSS 9.8, Linux)
- [CVE-2024-26876](https://cve.now/CVE-2024-26876.md): drm/bridge: adv7511: fix crash on irq during probe (no CVSS, Linux)
- [CVE-2024-26875](https://cve.now/CVE-2024-26875.md): media: pvrusb2: fix uaf in pvr2\_context\_set\_notify (CVSS 6.4, Linux)
- [CVE-2024-26874](https://cve.now/CVE-2024-26874.md): drm/mediatek: Fix a null pointer crash in mtk\_drm\_crtc\_finish\_page\_flip (no CVSS, Linux)
- [CVE-2024-26873](https://cve.now/CVE-2024-26873.md): scsi: hisi\_sas: Fix a deadlock issue related to automatic dump (no CVSS, Linux)
- [CVE-2024-26872](https://cve.now/CVE-2024-26872.md): RDMA/srpt: Do not register event handler until srpt device is fully setup (CVSS 7.8, Linux)
- [CVE-2024-26871](https://cve.now/CVE-2024-26871.md): f2fs: fix NULL pointer dereference in f2fs\_submit\_page\_write() (no CVSS, Linux)
- [CVE-2024-26870](https://cve.now/CVE-2024-26870.md): NFSv4.2: fix nfs4\_listxattr kernel BUG at mm/usercopy.c:102 (CVSS 7.8, Linux)
- [CVE-2024-26869](https://cve.now/CVE-2024-26869.md): f2fs: fix to truncate meta inode pages forcely (CVSS 7.8, Linux)
- [CVE-2024-26868](https://cve.now/CVE-2024-26868.md): nfs: fix panic when nfs4\_ff\_layout\_prepare\_ds() fails (CVSS 7.5, Linux)
- [CVE-2024-26867](https://cve.now/CVE-2024-26867.md): comedi: comedi\_8255: Correct error in subdevice initialization (no CVSS, Linux)
- [CVE-2024-26866](https://cve.now/CVE-2024-26866.md): spi: lpspi: Avoid potential use-after-free in probe() (no CVSS, Linux)
- [CVE-2024-26865](https://cve.now/CVE-2024-26865.md): rds: tcp: Fix use-after-free of net in reqsk\_timer\_handler(). (CVSS 7.8, Linux)
- [CVE-2024-26864](https://cve.now/CVE-2024-26864.md): tcp: Fix refcnt handling in \_\_inet\_hash\_connect(). (CVSS 7.8, Linux)
- [CVE-2024-26863](https://cve.now/CVE-2024-26863.md): hsr: Fix uninit-value access in hsr\_get\_node() (no CVSS, Linux)
- [CVE-2024-26862](https://cve.now/CVE-2024-26862.md): packet: annotate data-races around ignore\_outgoing (no CVSS, Linux)
- [CVE-2024-26861](https://cve.now/CVE-2024-26861.md): wireguard: receive: annotate data-race around receiving\_counter.counter (no CVSS, Linux)
- [CVE-2024-26860](https://cve.now/CVE-2024-26860.md): dm-integrity: fix a memory leak when rechecking the data (no CVSS, Linux)
- [CVE-2024-26859](https://cve.now/CVE-2024-26859.md): net/bnx2x: Prevent access to a freed page in page\_pool (no CVSS, Linux)
- [CVE-2023-52644](https://cve.now/CVE-2023-52644.md): wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled (no CVSS, Linux)
- [CVE-2022-47151](https://cve.now/CVE-2022-47151.md): WordPress JS Help Desk plugin \<= 2.7.1 - Unauth. SQL Injection Vulnerability (CVSS 8.6, JS Help Desk – Best Help Desk & Support Plugin)
- [CVE-2024-26858](https://cve.now/CVE-2024-26858.md): net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata\_map (no CVSS, Linux)
- [CVE-2024-26857](https://cve.now/CVE-2024-26857.md): geneve: make sure to pull inner header in geneve\_rx() (CVSS 7.3, Linux)
- [CVE-2024-26856](https://cve.now/CVE-2024-26856.md): net: sparx5: Fix use after free inside sparx5\_del\_mact\_entry (CVSS 8.8, Linux)
- [CVE-2024-26855](https://cve.now/CVE-2024-26855.md): net: ice: Fix potential NULL pointer dereference in ice\_bridge\_setlink() (no CVSS, Linux)
- [CVE-2024-26854](https://cve.now/CVE-2024-26854.md): ice: fix uninitialized dplls mutex usage (CVSS 7.5, Linux)
- [CVE-2024-26853](https://cve.now/CVE-2024-26853.md): igc: avoid returning frame twice in XDP\_REDIRECT (CVSS 9.8, Linux)
- [CVE-2024-26852](https://cve.now/CVE-2024-26852.md): net/ipv6: avoid possible UAF in ip6\_route\_mpath\_notify() (CVSS 7.8, Linux)
- [CVE-2024-26851](https://cve.now/CVE-2024-26851.md): netfilter: nf\_conntrack\_h323: Add protection for bmp length out of range (CVSS 7.5, Linux)
- [CVE-2024-26850](https://cve.now/CVE-2024-26850.md): mm/debug\_vm\_pgtable: fix BUG\_ON with pud advanced test (no CVSS, Linux)
- [CVE-2024-26849](https://cve.now/CVE-2024-26849.md): netlink: add nla be16/32 types to minlen array (no CVSS, Linux)
- [CVE-2024-26847](https://cve.now/CVE-2024-26847.md): powerpc/rtas: use correct function name for resetting TCE tables (CVSS 5.1, Linux)
- [CVE-2022-41698](https://cve.now/CVE-2022-41698.md): WordPress If Menu – Visibility control for Menus plugin \<= 0.16.3 - Broken Access Control (CVSS 6.5, Layered If Menu)
- [CVE-2024-1350](https://cve.now/CVE-2024-1350.md): WordPress Honeypot for WP Comment plugin \<= 2.2.3 - Arbitrary File Deletion vulnerability (CVSS 5.3, Prasidhda Malla Honeypot for WP Comment)
- [CVE-2024-26846](https://cve.now/CVE-2024-26846.md): nvme-fc: do not wait in vain when unloading module (CVSS 4.4, Linux)
- [CVE-2024-26845](https://cve.now/CVE-2024-26845.md): scsi: target: core: Add TMF to tmr\_list handling (CVSS 7.5, Linux)
- [CVE-2024-26844](https://cve.now/CVE-2024-26844.md): block: Fix WARNING in \_copy\_from\_iter (no CVSS, Linux)
- [CVE-2024-26843](https://cve.now/CVE-2024-26843.md): efi: runtime: Fix potential overflow of soft-reserved region size (CVSS 6.0, Linux)
- [CVE-2024-26842](https://cve.now/CVE-2024-26842.md): scsi: ufs: core: Fix shift issue in ufshcd\_clear\_cmd() (no CVSS, Linux)
- [CVE-2024-26841](https://cve.now/CVE-2024-26841.md): LoongArch: Update cpu\_sibling\_map when disabling nonboot CPUs (no CVSS, Linux)
- [CVE-2024-26840](https://cve.now/CVE-2024-26840.md): cachefiles: fix memory leak in cachefiles\_add\_cache() (no CVSS, Linux)
- [CVE-2024-26839](https://cve.now/CVE-2024-26839.md): IB/hfi1: Fix a memleak in init\_credit\_return (no CVSS, Linux)
- [CVE-2024-26838](https://cve.now/CVE-2024-26838.md): RDMA/irdma: Fix KASAN issue with tasklet (CVSS 7.8, Linux)
- [CVE-2024-26837](https://cve.now/CVE-2024-26837.md): net: bridge: switchdev: Skip MDB replays of deferred events on offload (no CVSS, Linux)
- [CVE-2024-26836](https://cve.now/CVE-2024-26836.md): platform/x86: think-lmi: Fix password opcode ordering for workstations (no CVSS, Linux)
- [CVE-2024-26835](https://cve.now/CVE-2024-26835.md): netfilter: nf\_tables: set dormant flag on hook register failure (no CVSS, Linux)
- [CVE-2024-26834](https://cve.now/CVE-2024-26834.md): netfilter: nft\_flow\_offload: release dst in case direct xmit path is used (CVSS 7.5, Linux)
- [CVE-2024-26833](https://cve.now/CVE-2024-26833.md): drm/amd/display: Fix memory leak in dm\_sw\_fini() (no CVSS, Linux)
- [CVE-2024-26832](https://cve.now/CVE-2024-26832.md): mm: zswap: fix missing folio cleanup in writeback race path (no CVSS, Linux)
- [CVE-2024-26829](https://cve.now/CVE-2024-26829.md): media: ir\_toy: fix a memleak in irtoy\_tx (no CVSS, Linux)
- [CVE-2024-32130](https://cve.now/CVE-2024-32130.md): WordPress Payment Forms for Paystack plugin \<= 3.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Payment Forms for Paystack)
- [CVE-2024-32456](https://cve.now/CVE-2024-32456.md): WordPress Envo Extra plugin \<= 1.8.11 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, EnvoThemes Envo Extra)
- [CVE-2024-32457](https://cve.now/CVE-2024-32457.md): WordPress Elements Plus! plugin \<= 2.16.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, The CSSIgniter Team Elements Plus!)
- [CVE-2024-32505](https://cve.now/CVE-2024-32505.md): WordPress ElementsKit Elementor addons plugin \<= 3.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Roxnor ElementsKit Elementor addons Lite)
- [CVE-2024-32508](https://cve.now/CVE-2024-32508.md): WordPress DethemeKit For Elementor plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DethemeKit For Elementor)
- [CVE-2024-32510](https://cve.now/CVE-2024-32510.md): WordPress WP Cost Estimation & Payment Forms Builder plugin \<= 10.1.75 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Loopus WP Cost Estimation & Payment Forms Builder)
- [CVE-2024-32526](https://cve.now/CVE-2024-32526.md): WordPress Easy Textillate plugin \<= 2.02 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Flector Easy Textillate)
- [CVE-2024-32527](https://cve.now/CVE-2024-32527.md): WordPress Jotform Online Forms plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jotform Online Forms)
- [CVE-2024-32528](https://cve.now/CVE-2024-32528.md): WordPress WP Dynamic Keywords Injector plugin \<= 2.3.18 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Seerox WP Dynamic Keywords Injector)
- [CVE-2024-26831](https://cve.now/CVE-2024-26831.md): net/handshake: Fix handshake\_req\_destroy\_test1 (no CVSS, Linux)
- [CVE-2024-26830](https://cve.now/CVE-2024-26830.md): i40e: Do not allow untrusted VF to remove administratively set MAC (CVSS 8.4, Linux)
- [CVE-2024-26828](https://cve.now/CVE-2024-26828.md): cifs: fix underflow in parse\_server\_interfaces() (CVSS 9.4, Linux)
- [CVE-2024-26826](https://cve.now/CVE-2024-26826.md): mptcp: fix data re-injection from stale subflow (CVSS 7.5, Linux)
- [CVE-2024-26825](https://cve.now/CVE-2024-26825.md): nfc: nci: free rx\_data\_reassembly skb on NCI device cleanup (no CVSS, Linux)
- [CVE-2024-26824](https://cve.now/CVE-2024-26824.md): crypto: algif\_hash - Remove bogus SGL free on zero-length error path (CVSS 7.8, Linux)
- [CVE-2024-26823](https://cve.now/CVE-2024-26823.md): irqchip/gic-v3-its: Restore quirk probing for ACPI-based systems (CVSS 7.8, Linux)
- [CVE-2024-26822](https://cve.now/CVE-2024-26822.md): smb: client: set correct id, uid and cruid for multiuser automounts (CVSS 8.7, Linux)
- [CVE-2024-26820](https://cve.now/CVE-2024-26820.md): hv\_netvsc: Register VF in netvsc\_probe if NET\_DEVICE\_REGISTER missed (no CVSS, Linux)
- [CVE-2024-26818](https://cve.now/CVE-2024-26818.md): tools/rtla: Fix clang warning about mount\_point var size (no CVSS, Linux)
- [CVE-2023-52643](https://cve.now/CVE-2023-52643.md): iio: core: fix memleak in iio\_device\_register\_sysfs (no CVSS, Linux)
- [CVE-2023-52642](https://cve.now/CVE-2023-52642.md): media: rc: bpf attach/detach requires write permission (no CVSS, Linux)
- [CVE-2024-32529](https://cve.now/CVE-2024-32529.md): WordPress Yoga Schedule Momoyoga plugin \<= 2.7.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Yoga Schedule Momoyoga)
- [CVE-2024-32530](https://cve.now/CVE-2024-32530.md): WordPress Simple Testimonials Showcase plugin \<= 1.1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PressTigers Simple Testimonials Showcase)
- [CVE-2024-32531](https://cve.now/CVE-2024-32531.md): WordPress GuCherry Blog theme \<= 1.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Everest themes GuCherry Blog)
- [CVE-2023-44227](https://cve.now/CVE-2023-44227.md): WordPress Simple File List Plugin \<= 6.1.9 is vulnerable to Arbitrary File Deletion (CVSS 7.5, Mitchell Bennis Simple File List)
- [CVE-2023-36505](https://cve.now/CVE-2023-36505.md): WordPress Ninja Forms Plugin \<= 3.6.24 is vulnerable to Arbitrary File Deletion (CVSS 6.8, Saturday Drive Ninja Forms Contact Form)
- [CVE-2023-25043](https://cve.now/CVE-2023-25043.md): WordPress Data Tables Generator by Supsystic Plugin \<= 1.10.25 is vulnerable to Broken Access Control (CVSS 4.3, Supsystic Data Tables Generator)
- [CVE-2024-32533](https://cve.now/CVE-2024-32533.md): WordPress LH Add Media From Url plugin \<= 1.22 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Peter Shaw LH Add Media From Url)
- [CVE-2024-32534](https://cve.now/CVE-2024-32534.md): WordPress Form Maker plugin \<= 1.15.23 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, 10Web Form Builder Team Form Maker by 10Web)
- [CVE-2024-32535](https://cve.now/CVE-2024-32535.md): WordPress Access Category Password plugin \<= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jojaba Access Category Password)
- [CVE-2024-32536](https://cve.now/CVE-2024-32536.md): WordPress WP TradingView plugin \<= 1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Trade Pips WP TradingView)
- [CVE-2024-32538](https://cve.now/CVE-2024-32538.md): WordPress Easy CountDowner plugin \<= 1.0.8 - CSRF to XSS vulnerability (CVSS 6.5, Joshua Eldridge Easy CountDowner)
- [CVE-2024-24856](https://cve.now/CVE-2024-24856.md): NULL pointer deference in acpi\_db\_convert\_to\_package of Linux acpi module (CVSS 5.3, OpenAnolis Anolis OS)
- [CVE-2024-32539](https://cve.now/CVE-2024-32539.md): WordPress WP File Download Light plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, JoomUnited WP File Download Light)
- [CVE-2024-32540](https://cve.now/CVE-2024-32540.md): WordPress Fixed HTML Toolbar plugin \<= 1.0.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Web357 Fixed HTML Toolbar)
- [CVE-2024-32541](https://cve.now/CVE-2024-32541.md): WordPress WP-Cufon plugin \<= 1.6.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Tobias Battenberg WP-Cufon)
- [CVE-2024-32542](https://cve.now/CVE-2024-32542.md): WordPress Bulk Block Converter plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Organic Themes Bulk Block Converter)
- [CVE-2024-32543](https://cve.now/CVE-2024-32543.md): WordPress MJ Update History plugin \<= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Minoji MJ Update History)
- [CVE-2024-32544](https://cve.now/CVE-2024-32544.md): WordPress Netgsm plugin \<= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Netgsm)
- [CVE-2024-32545](https://cve.now/CVE-2024-32545.md): WordPress Canva – Design beautiful blog graphics plugin \<= 1.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Canva – Design beautiful blog graphics)
- [CVE-2024-32546](https://cve.now/CVE-2024-32546.md): WordPress Tax Rate Upload plugin \<= 2.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Adam Bowen Tax Rate Upload)
- [CVE-2024-32547](https://cve.now/CVE-2024-32547.md): WordPress Code Insert Manager (Q2W3 Inc Manager) plugin \<= 2.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.8, Max Bond Code Insert Manager)
- [CVE-2024-32548](https://cve.now/CVE-2024-32548.md): WordPress What's New Generator plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Hideki Tanaka What's New Generator)
- [CVE-2024-32550](https://cve.now/CVE-2024-32550.md): WordPress BMI Adult & Kid Calculator plugin \<= 1.2.1 - CSRF to XSS vulnerability (CVSS 7.1, BMI Adult & Kid Calculator)
- [CVE-2024-32549](https://cve.now/CVE-2024-32549.md): WordPress Related Posts for WordPress plugin \<= 4.0.3 - CSRF to XSS vulnerability (CVSS 7.1, Microkid Related Posts for WordPress)
- [CVE-2024-32506](https://cve.now/CVE-2024-32506.md): WordPress Radio Player plugin \<= 2.0.73 - Sensitive Data Exposure vulnerability (CVSS 5.4, SoftLab Radio Player)
- [CVE-2024-32513](https://cve.now/CVE-2024-32513.md): WordPress Product Feed PRO for WooCommerce plugin \<= 13.3.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, AdTribes.io Product Feed PRO for WooCommerce)
- [CVE-2024-32514](https://cve.now/CVE-2024-32514.md): WordPress WP Poll Maker plugin \<= 3.4 - Authenticated Arbitrary File Upload vulnerability (CVSS 9.9, Poll Maker & Voting Plugin Team (InfoTheme) WP Poll Maker)
- [CVE-2024-3847](https://cve.now/CVE-2024-3847.md): Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy (CVSS 9.8, Google Chrome)
- [CVE-2024-3846](https://cve.now/CVE-2024-3846.md): Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in (CVSS 5.4, Google Chrome)
- [CVE-2024-3845](https://cve.now/CVE-2024-3845.md): Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy vi (CVSS 9.8, Google Chrome)
- [CVE-2024-3844](https://cve.now/CVE-2024-3844.md): Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a cr (CVSS 4.3, Google Chrome)
- [CVE-2024-3843](https://cve.now/CVE-2024-3843.md): Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.6, Google Chrome)
- [CVE-2024-3841](https://cve.now/CVE-2024-3841.md): Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML (CVSS 7.6, Google Chrome)
- [CVE-2024-3840](https://cve.now/CVE-2024-3840.md): Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation res (CVSS 6.5, Google Chrome)
- [CVE-2024-3839](https://cve.now/CVE-2024-3839.md): Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information fr (CVSS 6.5, Google Chrome)
- [CVE-2024-3838](https://cve.now/CVE-2024-3838.md): Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malic (CVSS 4.3, Google Chrome)
- [CVE-2024-3837](https://cve.now/CVE-2024-3837.md): Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 5.9, Google Chrome)
- [CVE-2024-3834](https://cve.now/CVE-2024-3834.md): Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2024-3833](https://cve.now/CVE-2024-3833.md): Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption (CVSS 8.8, Google Chrome)
- [CVE-2024-3832](https://cve.now/CVE-2024-3832.md): Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2024-32509](https://cve.now/CVE-2024-32509.md): WordPress WP Cost Estimation & Payment Forms Builder plugin \<= 10.1.76 - Broken Access Control vulnerability (CVSS 6.5, Loopus WP Cost Estimation & Payment Forms Builder)
- [CVE-2024-32515](https://cve.now/CVE-2024-32515.md): WordPress Mega Addons For Elementor plugin \<= 1.8 - Broken Access Control vulnerability (CVSS 5.4, Qamar Sheeraz, Nasir Ahmad Mega Addons For Elementor)
- [CVE-2024-32516](https://cve.now/CVE-2024-32516.md): WordPress Multi Currency For WooCommerce plugin \<= 1.5.5 - Broken Access Control vulnerability (CVSS 4.3, Palscode Multi Currency For WooCommerce)
- [CVE-2024-32517](https://cve.now/CVE-2024-32517.md): WordPress Custom Thank You Page Customize For WooCommerce by Binary Carpenter plugin \<= 1.4.12 - Broken Access Control vulnerability (CVSS 4.3, WooCommerce & WordPress Tutorials Custom Thank You Page Cus…)
- [CVE-2024-32518](https://cve.now/CVE-2024-32518.md): WordPress PeproDev Ultimate Invoice plugin \<= 2.0.0 - Broken Access Control vulnerability (CVSS 5.3, Pepro Dev. Group PeproDev Ultimate Invoice)
- [CVE-2024-32519](https://cve.now/CVE-2024-32519.md): WordPress GG Woo Feed for WooCommerce plugin \<= 1.2.6 - Broken Access Control vulnerability (CVSS 4.3, GutenGeek GG Woo Feed for WooCommerce)
- [CVE-2024-32520](https://cve.now/CVE-2024-32520.md): WordPress WPC Grouped Product for WooCommerce plugin \<= 4.4.2 - Broken Access Control vulnerability (CVSS 4.3, WPClever WPC Grouped Product for WooCommerce)
- [CVE-2024-32522](https://cve.now/CVE-2024-32522.md): WordPress Open Close WooCommerce Store plugin \<= 4.9.1 - Broken Access Control vulnerability (CVSS 4.3, Jaed Mosharraf & Pluginbazar Team Open Close WooCommerce St…)
- [CVE-2024-32524](https://cve.now/CVE-2024-32524.md): WordPress Custom Order Statuses for WooCommerce plugin \<= 1.5.2 - Broken Access Control vulnerability (CVSS 4.3, Nuggethon Custom Order Statuses for WooCommerce)
- [CVE-2024-32525](https://cve.now/CVE-2024-32525.md): WordPress Theme My Login plugin \<= 7.1.6 - Broken Access Control vulnerability (CVSS 4.3, Theme My Login)
- [CVE-2024-32532](https://cve.now/CVE-2024-32532.md): WordPress Speed Optimizer plugin \<= 7.4.6 - Broken Access Control vulnerability (CVSS 5.3, SiteGround Speed Optimizer)
- [CVE-2024-22440](https://cve.now/CVE-2024-22440.md): HPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive Information (CVSS 6.8, Hewlett Packard Enterprise HPE Compute Scale-up Server 3200…)
- [CVE-2024-2309](https://cve.now/CVE-2024-2309.md): WP Staging \< 3.4.0, 5.4.0 (Pro Version) - Admin+ Stored XSS (CVSS 4.8, WP STAGING WordPress Backup Plugin · wp-staging-pro)
- [CVE-2024-2118](https://cve.now/CVE-2024-2118.md): Social Media Share Buttons \< 2.8.9 - Admin+ Stored XSS via settings (CVSS 5.9, Social Media Share Buttons & Social Sharing Icons)
- [CVE-2024-2102](https://cve.now/CVE-2024-2102.md): Salon booking system \< 9.6.3 - Unauthenticated Stored XSS (CVSS 4.7, Salon booking system)
- [CVE-2024-2101](https://cve.now/CVE-2024-2101.md): WordPress Plugin Salon Booking System \< 9.6.3 - Unauthenticated Stored Cross-Site Scripting (XSS) (CVSS 5.7, Salon booking system)
- [CVE-2024-1219](https://cve.now/CVE-2024-1219.md): Easy Social Feed \< 6.5.6 - Contributor+ Stored XSS (CVSS 5.3, Easy Social Feed)
- [CVE-2024-0868](https://cve.now/CVE-2024-0868.md): coreActivity \< 2.1 - Unauthenticated IP Spoofing (CVSS 5.3, coreActivity: Activity Logging plugin for WordPress)
- [CVE-2024-22329](https://cve.now/CVE-2024-22329.md): IBM WebSphere Application Server server-side request forgery (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2024-22354](https://cve.now/CVE-2024-22354.md): IBM WebSphere Application Server XML external entity injection (CVSS 7.0, IBM WebSphere Application Server)
- [CVE-2023-46060](https://cve.now/CVE-2023-46060.md): A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9 allows a remote attacker to cause a denial of service via the port parameter at the (CVSS 7.5)
- [CVE-2024-30950](https://cve.now/CVE-2024-30950.md): A stored cross-site scripting (XSS) vulnerability in FUDforum v3.1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 3.5)
- [CVE-2024-30951](https://cve.now/CVE-2024-30951.md): FUDforum v3.1.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the chpos parameter at /adm/admsmiley.php (CVSS 6.1)
- [CVE-2024-30952](https://cve.now/CVE-2024-30952.md): A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a craf (CVSS 6.1)
- [CVE-2024-30953](https://cve.now/CVE-2024-30953.md): A stored cross-site scripting (XSS) vulnerability in Htmly v2.9.5 allows attackers to execute arbitrary web scripts or HTML via a crafted pa (CVSS 6.1)
- [CVE-2024-30979](https://cve.now/CVE-2024-30979.md): Cross Site Scripting vulnerability in Cyber Cafe Management System 1.0 allows a remote attacker to execute arbitrary code via the compname p (CVSS 5.9)
- [CVE-2024-30980](https://cve.now/CVE-2024-30980.md): SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands (CVSS 9.8)
- [CVE-2024-30981](https://cve.now/CVE-2024-30981.md): SQL Injection vulnerability in /edit-computer-detail.php in phpgurukul Cyber Cafe Management System Using PHP & MySQL v1.0 allows attackers (CVSS 4.3)
- [CVE-2024-30982](https://cve.now/CVE-2024-30982.md): SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands (CVSS 9.8)
- [CVE-2024-30983](https://cve.now/CVE-2024-30983.md): SQL Injection vulnerability in phpgurukul Cyber Cafe Management System Using PHP & MySQL 1.0 allows attackers to run arbitrary SQL commands (CVSS 7.3)
- [CVE-2024-30985](https://cve.now/CVE-2024-30985.md): SQL Injection vulnerability in "B/W Dates Reports" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to exec (CVSS 9.8)
- [CVE-2024-30986](https://cve.now/CVE-2024-30986.md): Cross Site Scripting vulnerability in /edit-services-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attacke (CVSS 6.5)
- [CVE-2024-30987](https://cve.now/CVE-2024-30987.md): Cross Site Scripting vulnerability in /bwdates-reports-ds.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers (CVSS 6.8)
- [CVE-2024-30988](https://cve.now/CVE-2024-30988.md): Cross Site Scripting vulnerability in /search-invoices.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers to (CVSS 6.8)
- [CVE-2024-30989](https://cve.now/CVE-2024-30989.md): Cross Site Scripting vulnerability in /edit-client-details.php of phpgurukul Client Management System using PHP & MySQL 1.1 allows attackers (CVSS 5.4)
- [CVE-2024-30990](https://cve.now/CVE-2024-30990.md): SQL Injection vulnerability in the "Invoices" page in phpgurukul Client Management System using PHP & MySQL 1.1 allows attacker to execute a (CVSS 9.8)
- [CVE-2024-31031](https://cve.now/CVE-2024-31031.md): An issue in \`coap\_pdu.c\` in libcoap 4.3.4 allows attackers to cause undefined behavior via a sequence of messages leading to unsigned intege (CVSS 7.5)
- [CVE-2024-31040](https://cve.now/CVE-2024-31040.md): Buffer Overflow vulnerability in the get\_var\_integer function in mqtt\_parser.c in NanoMQ 0.21.7 allows remote attackers to cause a denial of (CVSS 2.7)
- [CVE-2024-31041](https://cve.now/CVE-2024-31041.md): Null Pointer Dereference vulnerability in topic\_filtern function in mqtt\_parser.c in NanoMQ 0.21.7 allows attackers to cause a denial of ser (CVSS 7.5)
- [CVE-2024-31578](https://cve.now/CVE-2024-31578.md): FFmpeg version n6.1.1 was discovered to contain a heap use-after-free via the av\_hwframe\_ctx\_init function. (CVSS 7.5)
- [CVE-2024-31580](https://cve.now/CVE-2024-31580.md): PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg\_functions.cpp. (CVSS 4.0, torch-npu · torch)
- [CVE-2024-31581](https://cve.now/CVE-2024-31581.md): FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbs\_h266\_syntax\_template.c. (CVSS 9.8)
- [CVE-2024-31582](https://cve.now/CVE-2024-31582.md): FFmpeg version n6.1 was discovered to contain a heap buffer overflow vulnerability in the draw\_block\_rectangle function of libavfilter/vf\_co (CVSS 7.8)
- [CVE-2024-31583](https://cve.now/CVE-2024-31583.md): Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp. (CVSS 7.8, torch)
- [CVE-2024-31585](https://cve.now/CVE-2024-31585.md): FFmpeg version n5.1 to n6.1 was discovered to contain an Off-by-one Error vulnerability in libavfilter/avf\_showspectrum.c. (CVSS 5.3)
- [CVE-2024-32161](https://cve.now/CVE-2024-32161.md): jizhiCMS 2.5 suffers from a File upload vulnerability. (CVSS 9.8)
- [CVE-2024-32162](https://cve.now/CVE-2024-32162.md): CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion. (CVSS 4.3)
- [CVE-2024-32163](https://cve.now/CVE-2024-32163.md): CMSeasy 7.7.7.9 is vulnerable to code execution. (CVSS 6.4)
- [CVE-2024-32281](https://cve.now/CVE-2024-32281.md): Tenda AC7V1.0 v15.03.06.44 firmware contains a command injection vulnerablility in formexeCommand function via the cmdinput parameter. (CVSS 8.8)
- [CVE-2024-32282](https://cve.now/CVE-2024-32282.md): Tenda FH1202 v1.2.0.14(408) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. (CVSS 6.3)
- [CVE-2024-32283](https://cve.now/CVE-2024-32283.md): Tenda FH1203 V2.0.1.6 firmware has a command injection vulnerablility in formexeCommand function via the cmdinput parameter. (CVSS 7.3)
- [CVE-2024-32285](https://cve.now/CVE-2024-32285.md): Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the password parameter in the formaddUserName function. (CVSS 8.0)
- [CVE-2024-32286](https://cve.now/CVE-2024-32286.md): Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromVirtualSer function. (CVSS 9.8)
- [CVE-2024-32287](https://cve.now/CVE-2024-32287.md): Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the qos parameter in the fromqossetting function. (CVSS 6.5)
- [CVE-2024-32288](https://cve.now/CVE-2024-32288.md): Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability located via the page parameter in the fromwebExcptypemanFilter fu (CVSS 6.3)
- [CVE-2024-32290](https://cve.now/CVE-2024-32290.md): Tenda W30E v1.0 v1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromAddressNat function. (CVSS 6.7)
- [CVE-2024-32291](https://cve.now/CVE-2024-32291.md): Tenda W30E v1.0 firmware v1.0.1.25(633) has a stack overflow vulnerability via the page parameter in the fromNatlimit function. (CVSS 7.5)
- [CVE-2024-32292](https://cve.now/CVE-2024-32292.md): Tenda W30E v1.0 V1.0.1.25(633) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput paramete (CVSS 8.8)
- [CVE-2024-32293](https://cve.now/CVE-2024-32293.md): Tenda W30E v1.0 V1.0.1.25(633) firmware has a stack overflow vulnerability via the page parameter in the fromDhcpListClient function. (CVSS 8.0)
- [CVE-2024-32299](https://cve.now/CVE-2024-32299.md): Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function. (CVSS 8.8)
- [CVE-2024-32301](https://cve.now/CVE-2024-32301.md): Tenda AC7V1.0 v15.03.06.44 firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function. (CVSS 9.8)
- [CVE-2024-32302](https://cve.now/CVE-2024-32302.md): Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the PPW parameter in the fromWizardHandle function. (CVSS 6.3)
- [CVE-2024-32303](https://cve.now/CVE-2024-32303.md): Tenda AC15 v15.03.20\_multi, v15.03.05.19, and v15.03.05.18 firmware has a stack overflow vulnerability located via the PPW parameter in the (CVSS 8.0)
- [CVE-2024-32305](https://cve.now/CVE-2024-32305.md): Tenda A18 v15.03.05.05 firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function. (CVSS 8.8)
- [CVE-2024-32306](https://cve.now/CVE-2024-32306.md): Tenda AC10U v1.0 Firmware v15.03.06.49 has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function. (CVSS 5.7)
- [CVE-2024-32307](https://cve.now/CVE-2024-32307.md): Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the PPW parameter in the fromWizardHandle function. (CVSS 7.4)
- [CVE-2024-32310](https://cve.now/CVE-2024-32310.md): Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the PPW parameter of the fromWizardHandle function. (CVSS 8.0)
- [CVE-2024-32311](https://cve.now/CVE-2024-32311.md): Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function. (CVSS 6.5)
- [CVE-2024-32312](https://cve.now/CVE-2024-32312.md): Tenda F1203 V2.0.1.6 firmware has a stack overflow vulnerability located in the adslPwd parameter of the formWanParameterSetting function. (CVSS 5.7)
- [CVE-2024-32313](https://cve.now/CVE-2024-32313.md): Tenda FH1205 V2.0.0.7(775) firmware has a stack overflow vulnerability located via the adslPwd parameter of the formWanParameterSetting func (CVSS 6.5)
- [CVE-2024-32314](https://cve.now/CVE-2024-32314.md): Tenda AC500 V2.0.1.9(1307) firmware contains a command injection vulnerablility in the formexeCommand function via the cmdinput parameter. (CVSS 3.8)
- [CVE-2024-32315](https://cve.now/CVE-2024-32315.md): Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterSetting function. (CVSS 4.7)
- [CVE-2024-32316](https://cve.now/CVE-2024-32316.md): Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability in the fromDhcpListClient function. (CVSS 6.5)
- [CVE-2024-32317](https://cve.now/CVE-2024-32317.md): Tenda AC10 v4.0 V16.03.10.13 and V16.03.10.20 firmware has a stack overflow vulnerability via the adslPwd parameter in the formWanParameterS (CVSS 7.5)
- [CVE-2024-32318](https://cve.now/CVE-2024-32318.md): Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability via the vlan parameter in the formSetVlanInfo function. (CVSS 9.8)
- [CVE-2024-32320](https://cve.now/CVE-2024-32320.md): Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability via the timeZone parameter in the formSetTimeZone function. (CVSS 5.9)
- [CVE-2024-32337](https://cve.now/CVE-2024-32337.md): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or (CVSS 6.1)
- [CVE-2024-32338](https://cve.now/CVE-2024-32338.md): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or (CVSS 5.4)
- [CVE-2024-32339](https://cve.now/CVE-2024-32339.md): Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts (CVSS 6.1)
- [CVE-2024-32340](https://cve.now/CVE-2024-32340.md): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or (CVSS 9.6)
- [CVE-2024-32341](https://cve.now/CVE-2024-32341.md): Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts o (CVSS 5.4)
- [CVE-2024-32342](https://cve.now/CVE-2024-32342.md): A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML v (CVSS 6.1)
- [CVE-2024-32343](https://cve.now/CVE-2024-32343.md): A cross-site scripting (XSS) vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML v (CVSS 6.1)
- [CVE-2024-32344](https://cve.now/CVE-2024-32344.md): A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML (CVSS 6.8)
- [CVE-2024-32345](https://cve.now/CVE-2024-32345.md): A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML (CVSS 7.2)
- [CVE-2024-32743](https://cve.now/CVE-2024-32743.md): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or (CVSS 5.5)
- [CVE-2024-32744](https://cve.now/CVE-2024-32744.md): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or (CVSS 4.6)
- [CVE-2024-32745](https://cve.now/CVE-2024-32745.md): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or (CVSS 5.9)
- [CVE-2024-32746](https://cve.now/CVE-2024-32746.md): A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or (CVSS 4.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.