# CVEs published 2024-05-01

253 CVEs were published on May 1, 2024: 16 critical, 90 high. Days are UTC.

- [CVE-2023-51631](https://cve.now/CVE-2023-51631.md): D-Link DIR-X3260 prog.cgi SetUsersSettings Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 6.8, D-Link DIR-X3260)
- [CVE-2024-4142](https://cve.now/CVE-2024-4142.md): JFrog Artifactory Improper input validation within token creation flow (CVSS 9.0, JFrog Artifactory)
- [CVE-2024-29011](https://cve.now/CVE-2024-29011.md): Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. (CVSS 7.5, SonicWall GMS)
- [CVE-2024-29010](https://cve.now/CVE-2024-29010.md): The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the di (CVSS 7.1, SonicWall GMS)
- [CVE-2023-7241](https://cve.now/CVE-2023-7241.md): Webroot Antivirus COM-Hijacking LPE (CVSS 7.9, Webroot AntiVirus (Consumer) and Webroot Endpoint Protection)
- [CVE-2024-20376](https://cve.now/CVE-2024-20376.md): A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to cause an (CVSS 7.5, Cisco IP Phones with Multiplatform Firmware · Cisco PhoneOS)
- [CVE-2024-20378](https://cve.now/CVE-2024-20378.md): A vulnerability in the web-based management interface of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to retrieve (CVSS 7.5, Cisco IP Phones with Multiplatform Firmware · Cisco PhoneOS)
- [CVE-2024-20357](https://cve.now/CVE-2024-20357.md): A vulnerability in the XML service of Cisco IP Phone firmware could allow an unauthenticated, remote attacker to initiate phone calls on an (CVSS 5.9, Cisco IP Phones with Multiplatform Firmware · Cisco PhoneOS)
- [CVE-2024-28764](https://cve.now/CVE-2024-28764.md): IBM WebSphere Automation CSV injection (CVSS 6.5, IBM WebSphere Automation)
- [CVE-2024-33518](https://cve.now/CVE-2024-33518.md): An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-33517](https://cve.now/CVE-2024-33517.md): An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Radio Frequency Manager service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-33516](https://cve.now/CVE-2024-33516.md): An unauthenticated Denial of Service (DoS) vulnerability exists in the Auth service accessed via the PAPI protocol provided by ArubaOS. (CVSS 5.3, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-33515](https://cve.now/CVE-2024-33515.md): Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-23480](https://cve.now/CVE-2024-23480.md): Insecure MacOS code sign check fallback (CVSS 7.5, Zscaler Client Connector)
- [CVE-2024-33514](https://cve.now/CVE-2024-33514.md): Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. (CVSS 5.3, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-23457](https://cve.now/CVE-2024-23457.md): Anti-tampering can be disabled with uninstall password enforced (CVSS 7.8, Zscaler Client Connector)
- [CVE-2024-25015](https://cve.now/CVE-2024-25015.md): IBM MQ denial of service (CVSS 7.5, IBM MQ)
- [CVE-2024-33513](https://cve.now/CVE-2024-33513.md): Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the AP Management service accessed via the PAPI protocol. (CVSS 5.9, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-28893](https://cve.now/CVE-2024-28893.md): Certain HP software packages (SoftPaqs) are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been (CVSS 7.7, HP software packages)
- [CVE-2023-47212](https://cve.now/CVE-2023-47212.md): A heap-based buffer overflow vulnerability exists in the comment functionality of stb \_vorbis.c v1.22. (CVSS 9.8, stb\_vorbis.c)
- [CVE-2023-47166](https://cve.now/CVE-2023-47166.md): A firmware update vulnerability exists in the luci2-io file-import functionality of Milesight UR32L v32.3.0.7-r2. (CVSS 8.8, Milesight UR32L)
- [CVE-2023-49606](https://cve.now/CVE-2023-49606.md): A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. (CVSS 9.8, Tinyproxy)
- [CVE-2024-33512](https://cve.now/CVE-2024-33512.md): There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated rem (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-33511](https://cve.now/CVE-2024-33511.md): There is a buffer overflow vulnerability in the underlying Automatic Reporting service that could lead to unauthenticated remote code execut (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-26305](https://cve.now/CVE-2024-26305.md): There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sendin (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-26304](https://cve.now/CVE-2024-26304.md): There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2024-24912](https://cve.now/CVE-2024-24912.md): Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file (CVSS 6.7, checkpoint Harmony Endpoint Security Client for Windows)
- [CVE-2024-24978](https://cve.now/CVE-2024-24978.md): Denial-of-service (DoS) vulnerability exists in TvRock 0.9t8a. (CVSS 4.3, TvRock)
- [CVE-2024-27392](https://cve.now/CVE-2024-27392.md): nvme: host: fix double-free of struct nvme\_id\_ns in ns\_update\_nuse() (CVSS 7.8, Linux)
- [CVE-2024-27391](https://cve.now/CVE-2024-27391.md): wifi: wilc1000: do not realloc workqueue everytime an interface is added (no CVSS, Linux)
- [CVE-2024-27390](https://cve.now/CVE-2024-27390.md): ipv6: mcast: remove one synchronize\_net() barrier in ipv6\_mc\_down() (no CVSS, Linux)
- [CVE-2024-27389](https://cve.now/CVE-2024-27389.md): pstore: inode: Only d\_invalidate() is needed (CVSS 7.8, Linux)
- [CVE-2024-27388](https://cve.now/CVE-2024-27388.md): SUNRPC: fix some memleaks in gssx\_dec\_option\_array (CVSS 9.8, Linux)
- [CVE-2024-27080](https://cve.now/CVE-2024-27080.md): btrfs: fix race when detecting delalloc ranges during fiemap (no CVSS, Linux)
- [CVE-2024-27079](https://cve.now/CVE-2024-27079.md): iommu/vt-d: Fix NULL domain on device release (no CVSS, Linux)
- [CVE-2024-27078](https://cve.now/CVE-2024-27078.md): media: v4l2-tpg: fix some memleaks in tpg\_alloc (no CVSS, Linux)
- [CVE-2024-27077](https://cve.now/CVE-2024-27077.md): media: v4l2-mem2mem: fix a memleak in v4l2\_m2m\_register\_entity (no CVSS, Linux)
- [CVE-2024-27076](https://cve.now/CVE-2024-27076.md): media: imx: csc/scaler: fix v4l2\_ctrl\_handler memory leak (no CVSS, Linux)
- [CVE-2024-27075](https://cve.now/CVE-2024-27075.md): media: dvb-frontends: avoid stack overflow warnings with clang (no CVSS, Linux)
- [CVE-2024-27074](https://cve.now/CVE-2024-27074.md): media: go7007: fix a memleak in go7007\_load\_encoder (no CVSS, Linux)
- [CVE-2024-27073](https://cve.now/CVE-2024-27073.md): media: ttpci: fix two memleaks in budget\_av\_attach (CVSS 7.8, Linux)
- [CVE-2024-27072](https://cve.now/CVE-2024-27072.md): media: usbtv: Remove useless locks in usbtv\_video\_free() (CVSS 5.5, Linux)
- [CVE-2024-27071](https://cve.now/CVE-2024-27071.md): backlight: hx8357: Fix potential NULL pointer dereference (no CVSS, Linux)
- [CVE-2024-27070](https://cve.now/CVE-2024-27070.md): f2fs: fix to avoid use-after-free issue in f2fs\_filemap\_fault (CVSS 7.1, Linux)
- [CVE-2024-27069](https://cve.now/CVE-2024-27069.md): ovl: relax WARN\_ON in ovl\_verify\_area() (no CVSS, Linux)
- [CVE-2024-27068](https://cve.now/CVE-2024-27068.md): thermal/drivers/mediatek/lvts\_thermal: Fix a memory leak in an error handling path (no CVSS, Linux)
- [CVE-2024-27067](https://cve.now/CVE-2024-27067.md): xen/evtchn: avoid WARN() when unbinding an event channel (no CVSS, Linux)
- [CVE-2024-27066](https://cve.now/CVE-2024-27066.md): virtio: packed: fix unmap leak for indirect desc table (CVSS 7.5, Linux)
- [CVE-2024-27065](https://cve.now/CVE-2024-27065.md): netfilter: nf\_tables: do not compare internal table flags on updates (no CVSS, Linux)
- [CVE-2024-27064](https://cve.now/CVE-2024-27064.md): netfilter: nf\_tables: Fix a memory leak in nf\_tables\_updchain (no CVSS, Linux)
- [CVE-2023-52653](https://cve.now/CVE-2023-52653.md): SUNRPC: fix a memleak in gss\_import\_v2\_context (CVSS 5.5, Linux)
- [CVE-2023-52652](https://cve.now/CVE-2023-52652.md): NTB: fix possible name leak in ntb\_register\_device() (no CVSS, Linux)
- [CVE-2022-48669](https://cve.now/CVE-2022-48669.md): powerpc/pseries: Fix potential memleak in papr\_get\_attr() (CVSS 5.5, Linux)
- [CVE-2024-27063](https://cve.now/CVE-2024-27063.md): leds: trigger: netdev: Fix kernel panic on interface rename trig notify (no CVSS, Linux)
- [CVE-2024-27062](https://cve.now/CVE-2024-27062.md): nouveau: lock the client object tree. (CVSS 7.8, Linux)
- [CVE-2024-27061](https://cve.now/CVE-2024-27061.md): crypto: sun8i-ce - Fix use after free in unprepare (CVSS 7.8, Linux)
- [CVE-2024-27060](https://cve.now/CVE-2024-27060.md): thunderbolt: Fix NULL pointer dereference in tb\_port\_update\_credits() (no CVSS, Linux)
- [CVE-2024-27059](https://cve.now/CVE-2024-27059.md): USB: usb-storage: Prevent divide-by-0 error in isd200\_ata\_command (no CVSS, Linux)
- [CVE-2024-27058](https://cve.now/CVE-2024-27058.md): tmpfs: fix race on handling dquot rbtree (CVSS 7.8, Linux)
- [CVE-2024-23597](https://cve.now/CVE-2024-23597.md): Cross-site request forgery (CSRF) vulnerability exists in TvRock 0.9t8a. (CVSS 4.3, TvRock)
- [CVE-2024-28775](https://cve.now/CVE-2024-28775.md): IBM WebSphere Automation cross-site scripting (CVSS 4.4, IBM WebSphere Automation)
- [CVE-2024-27057](https://cve.now/CVE-2024-27057.md): ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend (no CVSS, Linux)
- [CVE-2024-27056](https://cve.now/CVE-2024-27056.md): wifi: iwlwifi: mvm: ensure offloading TID queue exists (CVSS 7.8, Linux)
- [CVE-2024-27054](https://cve.now/CVE-2024-27054.md): s390/dasd: fix double module refcount decrement (CVSS 5.5, Linux)
- [CVE-2024-27053](https://cve.now/CVE-2024-27053.md): wifi: wilc1000: fix RCU usage in connect path (CVSS 8.8, Linux)
- [CVE-2024-27052](https://cve.now/CVE-2024-27052.md): wifi: rtl8xxxu: add cancel\_work\_sync() for c2hcmd\_work (CVSS 7.8, Linux)
- [CVE-2024-27051](https://cve.now/CVE-2024-27051.md): cpufreq: brcmstb-avs-cpufreq: add check for cpufreq\_cpu\_get's return value (no CVSS, Linux)
- [CVE-2024-27050](https://cve.now/CVE-2024-27050.md): libbpf: Use OPTS\_SET() macro in bpf\_xdp\_query() (CVSS 7.8, Linux)
- [CVE-2024-27049](https://cve.now/CVE-2024-27049.md): wifi: mt76: mt7925e: fix use-after-free in free\_irq() (no CVSS, Linux)
- [CVE-2024-27048](https://cve.now/CVE-2024-27048.md): wifi: brcm80211: handle pmk\_op allocation failure (no CVSS, Linux)
- [CVE-2024-27047](https://cve.now/CVE-2024-27047.md): net: phy: fix phy\_get\_internal\_delay accessing an empty array (no CVSS, Linux)
- [CVE-2024-27046](https://cve.now/CVE-2024-27046.md): nfp: flower: handle acti\_netdevs allocation failure (no CVSS, Linux)
- [CVE-2024-27045](https://cve.now/CVE-2024-27045.md): drm/amd/display: Fix a potential buffer overflow in 'dp\_dsc\_clock\_en\_read()' (CVSS 7.0, Linux)
- [CVE-2024-31413](https://cve.now/CVE-2024-31413.md): Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL\[\]\[\]D-V4 (The version which was installed with a DVD ve (CVSS 5.9, OMRON CX-One CX-One CXONE-AL\[\]\[\]D-V4 · OMRON Sysmac Studio…)
- [CVE-2024-27044](https://cve.now/CVE-2024-27044.md): drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10\_set\_output\_transfer\_func()' (no CVSS, Linux)
- [CVE-2024-27043](https://cve.now/CVE-2024-27043.md): media: edia: dvbdev: fix a use-after-free (CVSS 7.8, Linux)
- [CVE-2024-27041](https://cve.now/CVE-2024-27041.md): drm/amd/display: fix NULL checks for adev-\>dm.dc in amdgpu\_dm\_fini() (CVSS 5.5, Linux)
- [CVE-2024-27040](https://cve.now/CVE-2024-27040.md): drm/amd/display: Add 'replay' NULL check in 'edp\_set\_replay\_allow\_active()' (CVSS 4.7, Linux)
- [CVE-2024-27039](https://cve.now/CVE-2024-27039.md): clk: hisilicon: hi3559a: Fix an erroneous devm\_kfree() (no CVSS, Linux)
- [CVE-2024-27038](https://cve.now/CVE-2024-27038.md): clk: Fix clk\_core\_get NULL dereference (no CVSS, Linux)
- [CVE-2024-27037](https://cve.now/CVE-2024-27037.md): clk: zynq: Prevent null pointer dereference caused by kmalloc failure (CVSS 5.5, Linux)
- [CVE-2024-27036](https://cve.now/CVE-2024-27036.md): cifs: Fix writeback data corruption (no CVSS, Linux)
- [CVE-2024-27035](https://cve.now/CVE-2024-27035.md): f2fs: compress: fix to guarantee persisting compressed blocks by CP (CVSS 7.3, Linux)
- [CVE-2024-27034](https://cve.now/CVE-2024-27034.md): f2fs: compress: fix to cover normal cluster write with cp\_rwsem (CVSS 7.8, Linux)
- [CVE-2024-27033](https://cve.now/CVE-2024-27033.md): f2fs: fix to remove unnecessary f2fs\_bug\_on() to avoid panic (no CVSS, Linux)
- [CVE-2024-27032](https://cve.now/CVE-2024-27032.md): f2fs: fix to avoid potential panic during recovery (CVSS 6.3, Linux)
- [CVE-2024-27031](https://cve.now/CVE-2024-27031.md): NFS: Fix nfs\_netfs\_issue\_read() xarray locking for writeback interrupt (no CVSS, Linux)
- [CVE-2024-27030](https://cve.now/CVE-2024-27030.md): octeontx2-af: Use separate handlers for interrupts (CVSS 7.8, Linux)
- [CVE-2024-27029](https://cve.now/CVE-2024-27029.md): drm/amdgpu: fix mmhub client id out-of-bounds access (CVSS 7.1, Linux)
- [CVE-2024-27028](https://cve.now/CVE-2024-27028.md): spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (CVSS 6.5, Linux)
- [CVE-2023-52650](https://cve.now/CVE-2023-52650.md): drm/tegra: dsi: Add missing check for of\_find\_device\_by\_node (no CVSS, Linux)
- [CVE-2023-52649](https://cve.now/CVE-2023-52649.md): drm/vkms: Avoid reading beyond LUT array (no CVSS, Linux)
- [CVE-2024-31412](https://cve.now/CVE-2024-31412.md): Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL\[\]\[\]D-V4 Ver. (CVSS 7.8, OMRON CX-Programmer)
- [CVE-2024-4368](https://cve.now/CVE-2024-4368.md): Use after free in Dawn in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 6.3, Google Chrome)
- [CVE-2024-4331](https://cve.now/CVE-2024-4331.md): Use after free in Picture In Picture in Google Chrome prior to 124.0.6367.118 allowed a remote attacker to potentially exploit heap corrupti (CVSS 7.5, Google Chrome)
- [CVE-2024-27027](https://cve.now/CVE-2024-27027.md): dpll: fix dpll\_xa\_ref\_\*\_del() for multiple registrations (no CVSS, Linux)
- [CVE-2024-27026](https://cve.now/CVE-2024-27026.md): vmxnet3: Fix missing reserved tailroom (CVSS 7.5, Linux)
- [CVE-2024-27025](https://cve.now/CVE-2024-27025.md): nbd: null check for nla\_nest\_start (no CVSS, Linux)
- [CVE-2024-27024](https://cve.now/CVE-2024-27024.md): net/rds: fix WARNING in rds\_conn\_connect\_if\_down (no CVSS, Linux)
- [CVE-2024-27023](https://cve.now/CVE-2024-27023.md): md: Fix missing release of 'active\_io' for flush (no CVSS, Linux)
- [CVE-2024-4060](https://cve.now/CVE-2024-4060.md): Use after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 7.5, Google Chrome)
- [CVE-2024-4059](https://cve.now/CVE-2024-4059.md): Out of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to leak cross-site data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2024-4058](https://cve.now/CVE-2024-4058.md): Type confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 9.0, Google Chrome)
- [CVE-2022-38386](https://cve.now/CVE-2022-38386.md): IBM Cloud Pak for Security information disclosure (CVSS 5.9, IBM Cloud Pak for Security · IBM QRadar Suite for Software)
- [CVE-2024-0334](https://cve.now/CVE-2024-0334.md): Jeg Elementor Kit \<= 2.6.4 - Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-32979](https://cve.now/CVE-2024-32979.md): Reflected Cross-site Scripting potential in all object list views in Nautobot (CVSS 7.5, nautobot)
- [CVE-2024-32984](https://cve.now/CVE-2024-32984.md): Yamux Memory Exhaustion Vulnerability via Active::pending\_frames property (CVSS 7.5, libp2p rust-yamux · yamux)
- [CVE-2024-32973](https://cve.now/CVE-2024-32973.md): Remote for TLS session may be trusted despite constraints in Pluto lang (CVSS 4.8, PlutoLang Pluto)
- [CVE-2024-32967](https://cve.now/CVE-2024-32967.md): Zitadel exposes internal database user name and host information (CVSS 5.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-32963](https://cve.now/CVE-2024-32963.md): Parameter Tampering vulnerability in Navidrome (CVSS 4.2, navidrome · github.com/navidrome/navidrome)
- [CVE-2024-32890](https://cve.now/CVE-2024-32890.md): Stored Cross-site Scripting in results JSON API in librespeed/speedtest (CVSS 6.1, librespeed speedtest)
- [CVE-2024-23335](https://cve.now/CVE-2024-23335.md): Backups directory .htaccess deletion in. MyBB (CVSS 4.7, mybb)
- [CVE-2024-23336](https://cve.now/CVE-2024-23336.md): Incomplete disallowed remote addresses list in MyBB (CVSS 5.0, mybb)
- [CVE-2024-32018](https://cve.now/CVE-2024-32018.md): Ineffective size check due to assert() and buffer overflow in RIOT (CVSS 8.8, RIOT-OS RIOT)
- [CVE-2024-32017](https://cve.now/CVE-2024-32017.md): Buffer overflows in RIOT (CVSS 9.8, RIOT-OS RIOT)
- [CVE-2024-31225](https://cve.now/CVE-2024-31225.md): Lack of size check and buffer overflow in RIOT (CVSS 8.4, RIOT-OS RIOT)
- [CVE-2024-3591](https://cve.now/CVE-2024-3591.md): WordPress Geo Controller \< 8.6.5 - PHP Object Injection (CVSS 6.5, Geo Controller)
- [CVE-2024-32966](https://cve.now/CVE-2024-32966.md): Stored Cross-site Scripting in directory listings via file names in static-web-server (CVSS 5.8, static-web-server)
- [CVE-2024-27022](https://cve.now/CVE-2024-27022.md): fork: defer linking file vma until vma is fully initialized (CVSS 7.8, Linux)
- [CVE-2024-27021](https://cve.now/CVE-2024-27021.md): r8169: fix LED-related deadlock on module removal (no CVSS, Linux)
- [CVE-2024-27020](https://cve.now/CVE-2024-27020.md): netfilter: nf\_tables: Fix potential data-race in \_\_nft\_expr\_type\_get() (CVSS 7.8, Linux)
- [CVE-2024-27019](https://cve.now/CVE-2024-27019.md): netfilter: nf\_tables: Fix potential data-race in \_\_nft\_obj\_type\_get() (CVSS 7.8, Linux)
- [CVE-2024-27018](https://cve.now/CVE-2024-27018.md): netfilter: br\_netfilter: skip conntrack input hook for promisc packets (CVSS 8.2, Linux)
- [CVE-2024-27017](https://cve.now/CVE-2024-27017.md): netfilter: nft\_set\_pipapo: walk over current view on netlink dump (CVSS 7.8, Linux)
- [CVE-2024-27016](https://cve.now/CVE-2024-27016.md): netfilter: flowtable: validate pppoe header (CVSS 7.1, Linux)
- [CVE-2024-27015](https://cve.now/CVE-2024-27015.md): netfilter: flowtable: incorrect pppoe tuple (no CVSS, Linux)
- [CVE-2024-27014](https://cve.now/CVE-2024-27014.md): net/mlx5e: Prevent deadlock while disabling aRFS (no CVSS, Linux)
- [CVE-2024-27013](https://cve.now/CVE-2024-27013.md): tun: limit printing rate when illegal packet received by tun dev (no CVSS, Linux)
- [CVE-2024-27012](https://cve.now/CVE-2024-27012.md): netfilter: nf\_tables: restore set elements when delete set fails (CVSS 7.8, Linux)
- [CVE-2024-27011](https://cve.now/CVE-2024-27011.md): netfilter: nf\_tables: fix memleak in map from abort path (no CVSS, Linux)
- [CVE-2024-27010](https://cve.now/CVE-2024-27010.md): net/sched: Fix mirred deadlock on device recursion (no CVSS, Linux)
- [CVE-2024-27009](https://cve.now/CVE-2024-27009.md): s390/cio: fix race condition during online processing (no CVSS, Linux)
- [CVE-2024-27008](https://cve.now/CVE-2024-27008.md): drm: nv04: Fix out of bounds access (no CVSS, Linux)
- [CVE-2024-27007](https://cve.now/CVE-2024-27007.md): userfaultfd: change src\_folio after ensuring it's unpinned in UFFDIO\_MOVE (CVSS 7.8, Linux)
- [CVE-2024-27006](https://cve.now/CVE-2024-27006.md): thermal/debugfs: Add missing count increment to thermal\_debug\_tz\_trip\_up() (no CVSS, Linux)
- [CVE-2024-27005](https://cve.now/CVE-2024-27005.md): interconnect: Don't access req\_list while it's being manipulated (CVSS 7.8, Linux)
- [CVE-2024-27004](https://cve.now/CVE-2024-27004.md): clk: Get runtime PM before walking tree during disable\_unused (no CVSS, Linux)
- [CVE-2024-27003](https://cve.now/CVE-2024-27003.md): clk: Get runtime PM before walking tree for clk\_summary (no CVSS, Linux)
- [CVE-2024-27002](https://cve.now/CVE-2024-27002.md): clk: mediatek: Do a runtime PM get on controllers during probe (no CVSS, Linux)
- [CVE-2024-27001](https://cve.now/CVE-2024-27001.md): comedi: vmk80xx: fix incomplete endpoint checking (no CVSS, Linux)
- [CVE-2024-27000](https://cve.now/CVE-2024-27000.md): serial: mxs-auart: add spinlock around changing cts state (no CVSS, Linux)
- [CVE-2024-26999](https://cve.now/CVE-2024-26999.md): serial/pmac\_zilog: Remove flawed mitigation for rx irq flood (no CVSS, Linux)
- [CVE-2024-26998](https://cve.now/CVE-2024-26998.md): serial: core: Clearing the circular buffer before NULLifying it (no CVSS, Linux)
- [CVE-2024-26997](https://cve.now/CVE-2024-26997.md): usb: dwc2: host: Fix dereference issue in DDMA completion flow. (no CVSS, Linux)
- [CVE-2024-26996](https://cve.now/CVE-2024-26996.md): usb: gadget: f\_ncm: Fix UAF ncm object at re-bind after usb ep transport error (CVSS 7.8, Linux)
- [CVE-2024-26995](https://cve.now/CVE-2024-26995.md): usb: typec: tcpm: Correct the PDO counting in pd\_set (no CVSS, Linux)
- [CVE-2024-26994](https://cve.now/CVE-2024-26994.md): speakup: Avoid crash on very long word (CVSS 7.8, Linux)
- [CVE-2024-26993](https://cve.now/CVE-2024-26993.md): fs: sysfs: Fix reference leak in sysfs\_break\_active\_protection() (no CVSS, Linux)
- [CVE-2024-26992](https://cve.now/CVE-2024-26992.md): KVM: x86/pmu: Disable support for adaptive PEBS (CVSS 7.3, Linux)
- [CVE-2024-26991](https://cve.now/CVE-2024-26991.md): KVM: x86/mmu: x86: Don't overflow lpage\_info when checking attributes (CVSS 5.5, Linux)
- [CVE-2024-26990](https://cve.now/CVE-2024-26990.md): KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status (CVSS 8.8, Linux)
- [CVE-2024-26989](https://cve.now/CVE-2024-26989.md): arm64: hibernate: Fix level3 translation fault in swsusp\_save() (no CVSS, Linux)
- [CVE-2024-26988](https://cve.now/CVE-2024-26988.md): init/main.c: Fix potential static\_command\_line memory overflow (no CVSS, Linux)
- [CVE-2024-26987](https://cve.now/CVE-2024-26987.md): mm/memory-failure: fix deadlock when hugetlb\_optimize\_vmemmap is enabled (no CVSS, Linux)
- [CVE-2024-26986](https://cve.now/CVE-2024-26986.md): drm/amdkfd: Fix memory leak in create\_process failure (no CVSS, Linux)
- [CVE-2024-26985](https://cve.now/CVE-2024-26985.md): drm/xe: Fix bo leak in intel\_fb\_bo\_framebuffer\_init (no CVSS, Linux)
- [CVE-2024-26984](https://cve.now/CVE-2024-26984.md): nouveau: fix instmem race condition around ptr stores (CVSS 5.5, Linux)
- [CVE-2024-26983](https://cve.now/CVE-2024-26983.md): bootconfig: use memblock\_free\_late to free xbc memory to buddy (CVSS 7.8, Linux)
- [CVE-2024-26982](https://cve.now/CVE-2024-26982.md): Squashfs: check the inode number is not the invalid value of zero (no CVSS, Linux)
- [CVE-2024-26981](https://cve.now/CVE-2024-26981.md): nilfs2: fix OOB in nilfs\_set\_de\_type (no CVSS, Linux)
- [CVE-2024-26980](https://cve.now/CVE-2024-26980.md): ksmbd: fix slab-out-of-bounds in smb2\_allocate\_rsp\_buf (CVSS 8.2, Linux)
- [CVE-2024-26936](https://cve.now/CVE-2024-26936.md): ksmbd: validate request buffer size in smb2\_allocate\_rsp\_buf() (CVSS 8.2, Linux)
- [CVE-2024-26978](https://cve.now/CVE-2024-26978.md): serial: max310x: fix NULL pointer dereference in I2C instantiation (no CVSS, Linux)
- [CVE-2024-26977](https://cve.now/CVE-2024-26977.md): pci\_iounmap(): Fix MMIO mapping leak (CVSS 5.5, Linux)
- [CVE-2024-26976](https://cve.now/CVE-2024-26976.md): KVM: Always flush async #PF workqueue when vCPU is being destroyed (CVSS 7.8, Linux)
- [CVE-2024-26975](https://cve.now/CVE-2024-26975.md): powercap: intel\_rapl: Fix a NULL pointer dereference (no CVSS, Linux)
- [CVE-2024-26974](https://cve.now/CVE-2024-26974.md): crypto: qat - resolve race condition during AER recovery (CVSS 7.8, Linux)
- [CVE-2024-26973](https://cve.now/CVE-2024-26973.md): fat: fix uninitialized field in nostale filehandles (no CVSS, Linux)
- [CVE-2024-26971](https://cve.now/CVE-2024-26971.md): clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays (CVSS 7.3, Linux)
- [CVE-2024-26970](https://cve.now/CVE-2024-26970.md): clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays (CVSS 5.5, Linux)
- [CVE-2024-26969](https://cve.now/CVE-2024-26969.md): clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays (CVSS 7.3, Linux)
- [CVE-2024-26968](https://cve.now/CVE-2024-26968.md): clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays (CVSS 7.3, Linux)
- [CVE-2024-26967](https://cve.now/CVE-2024-26967.md): clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays (CVSS 7.3, Linux)
- [CVE-2024-26966](https://cve.now/CVE-2024-26966.md): clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays (CVSS 7.8, Linux)
- [CVE-2024-26965](https://cve.now/CVE-2024-26965.md): clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays (CVSS 7.3, Linux)
- [CVE-2024-26964](https://cve.now/CVE-2024-26964.md): usb: xhci: Add error handling in xhci\_map\_urb\_for\_dma (no CVSS, Linux)
- [CVE-2024-26963](https://cve.now/CVE-2024-26963.md): usb: dwc3-am62: fix module unload/reload behavior (no CVSS, Linux)
- [CVE-2024-26962](https://cve.now/CVE-2024-26962.md): dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape (no CVSS, Linux)
- [CVE-2024-26961](https://cve.now/CVE-2024-26961.md): mac802154: fix llsec key resources release in mac802154\_llsec\_key\_del (CVSS 7.0, Linux)
- [CVE-2024-26960](https://cve.now/CVE-2024-26960.md): mm: swap: fix race between free\_swap\_and\_cache() and swapoff() (CVSS 7.0, Linux)
- [CVE-2024-26959](https://cve.now/CVE-2024-26959.md): Bluetooth: btnxpuart: Fix btnxpuart\_close (no CVSS, Linux)
- [CVE-2024-26958](https://cve.now/CVE-2024-26958.md): nfs: fix UAF in direct writes (CVSS 7.8, Linux)
- [CVE-2024-26957](https://cve.now/CVE-2024-26957.md): s390/zcrypt: fix reference counting on zcrypt card objects (CVSS 7.8, Linux)
- [CVE-2024-26956](https://cve.now/CVE-2024-26956.md): nilfs2: fix failure to detect DAT corruption in btree and direct mappings (CVSS 5.5, Linux)
- [CVE-2024-26955](https://cve.now/CVE-2024-26955.md): nilfs2: prevent kernel bug at submit\_bh\_wbc() (no CVSS, Linux)
- [CVE-2024-26954](https://cve.now/CVE-2024-26954.md): ksmbd: fix slab-out-of-bounds in smb\_strndup\_from\_utf16() (CVSS 8.1, Linux)
- [CVE-2024-26953](https://cve.now/CVE-2024-26953.md): net: esp: fix bad handling of pages from page\_pool (CVSS 9.8, Linux)
- [CVE-2024-26952](https://cve.now/CVE-2024-26952.md): ksmbd: fix potencial out-of-bounds when buffer offset is invalid (CVSS 8.3, Linux)
- [CVE-2024-26951](https://cve.now/CVE-2024-26951.md): wireguard: netlink: check for dangling peer via is\_dead instead of empty list (CVSS 7.8, Linux)
- [CVE-2024-26950](https://cve.now/CVE-2024-26950.md): wireguard: netlink: access device through ctx instead of peer (CVSS 7.8, Linux)
- [CVE-2024-26949](https://cve.now/CVE-2024-26949.md): drm/amdgpu/pm: Fix NULL pointer dereference when get power limit (no CVSS, Linux)
- [CVE-2024-26948](https://cve.now/CVE-2024-26948.md): drm/amd/display: Add a dc\_state NULL check in dc\_state\_release (no CVSS, Linux)
- [CVE-2024-26947](https://cve.now/CVE-2024-26947.md): ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses (no CVSS, Linux)
- [CVE-2024-26946](https://cve.now/CVE-2024-26946.md): kprobes/x86: Use copy\_from\_kernel\_nofault() to read from unsafe address (no CVSS, Linux)
- [CVE-2024-26945](https://cve.now/CVE-2024-26945.md): crypto: iaa - Fix nr\_cpus \< nr\_iaa case (CVSS 8.4, Linux)
- [CVE-2024-26944](https://cve.now/CVE-2024-26944.md): btrfs: zoned: fix use-after-free in do\_zone\_finish() (CVSS 7.8, Linux)
- [CVE-2024-26943](https://cve.now/CVE-2024-26943.md): nouveau/dmem: handle kcalloc() allocation failure (no CVSS, Linux)
- [CVE-2024-26942](https://cve.now/CVE-2024-26942.md): net: phy: qcom: at803x: fix kernel panic with at8031\_probe (CVSS 5.5, Linux)
- [CVE-2024-26941](https://cve.now/CVE-2024-26941.md): drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau (no CVSS, Linux)
- [CVE-2024-26940](https://cve.now/CVE-2024-26940.md): drm/vmwgfx: Create debugfs ttm\_resource\_manager entry only if needed (CVSS 5.5, Linux)
- [CVE-2024-26939](https://cve.now/CVE-2024-26939.md): drm/i915/vma: Fix UAF on destroy against retire race (CVSS 7.8, Linux)
- [CVE-2024-26938](https://cve.now/CVE-2024-26938.md): drm/i915/bios: Tolerate devdata==NULL in intel\_bios\_encoder\_supports\_dp\_dual\_mode() (no CVSS, Linux)
- [CVE-2024-26937](https://cve.now/CVE-2024-26937.md): drm/i915/gt: Reset queue\_priority\_hint on parking (no CVSS, Linux)
- [CVE-2024-26935](https://cve.now/CVE-2024-26935.md): scsi: core: Fix unremoved procfs host directory regression (no CVSS, Linux)
- [CVE-2024-26934](https://cve.now/CVE-2024-26934.md): USB: core: Fix deadlock in usb\_deauthorize\_interface() (no CVSS, Linux)
- [CVE-2024-26933](https://cve.now/CVE-2024-26933.md): USB: core: Fix deadlock in port "disable" sysfs attribute (no CVSS, Linux)
- [CVE-2024-26932](https://cve.now/CVE-2024-26932.md): usb: typec: tcpm: fix double-free issue in tcpm\_port\_unregister\_pd() (CVSS 7.8, Linux)
- [CVE-2024-26931](https://cve.now/CVE-2024-26931.md): scsi: qla2xxx: Fix command flush on cable pull (CVSS 8.8, Linux)
- [CVE-2024-26930](https://cve.now/CVE-2024-26930.md): scsi: qla2xxx: Fix double free of the ha-\>vp\_map pointer (CVSS 7.0, Linux)
- [CVE-2023-52648](https://cve.now/CVE-2023-52648.md): drm/vmwgfx: Unmap the surface before resetting it on a plane state (no CVSS, Linux)
- [CVE-2023-52647](https://cve.now/CVE-2023-52647.md): media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access (no CVSS, Linux)
- [CVE-2024-28979](https://cve.now/CVE-2024-28979.md): Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site S (CVSS 5.1, Dell OpenManage Enterprise)
- [CVE-2024-28978](https://cve.now/CVE-2024-28978.md): Dell OpenManage Enterprise, versions 3.10 and 4.0, contains an Improper Access Control vulnerability. (CVSS 5.2, Dell OpenManage Enterprise)
- [CVE-2023-23019](https://cve.now/CVE-2023-23019.md): Cross site scripting (XSS) vulnerability in file main.php in sourcecodester oretnom23 Blog Site 1.0 via the name and email parameters to fun (CVSS 5.4)
- [CVE-2023-23021](https://cve.now/CVE-2023-23021.md): Cross Site Scripting (XSS) vulnerability in sourcecodester oretnom23 pos point sale system 1.0, allows attackers to execute arbitrary code v (CVSS 6.1)
- [CVE-2023-23022](https://cve.now/CVE-2023-23022.md): Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 employee's payroll management system 1.0, allows attackers to execute a (CVSS 6.1)
- [CVE-2023-26793](https://cve.now/CVE-2023-26793.md): libmodbus v3.1.10 has a heap-based buffer overflow vulnerability in read\_io\_status function in src/modbus.c. (CVSS 9.8)
- [CVE-2023-46294](https://cve.now/CVE-2023-46294.md): An issue was discovered in Teledyne FLIR M300 2.00-19. (CVSS 3.4)
- [CVE-2023-46295](https://cve.now/CVE-2023-46295.md): An issue was discovered in Teledyne FLIR M300 2.00-19. (CVSS 9.8)
- [CVE-2024-22830](https://cve.now/CVE-2024-22830.md): Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system r (CVSS 5.3)
- [CVE-2024-24312](https://cve.now/CVE-2024-24312.md): SQL injection vulnerability in Vaales Technologies V\_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Model (CVSS 7.5)
- [CVE-2024-24313](https://cve.now/CVE-2024-24313.md): An issue in Vaales Technologies V\_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and (CVSS 7.5)
- [CVE-2024-25355](https://cve.now/CVE-2024-25355.md): s3-url-parser 1.0.3 is vulnerable to Denial of service via the regexes component. (CVSS 7.5, s3-url-parser)
- [CVE-2024-25458](https://cve.now/CVE-2024-25458.md): An issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM\_48B\_BC01\_v87\_0903 allows a remote (CVSS 7.5)
- [CVE-2024-25676](https://cve.now/CVE-2024-25676.md): An issue was discovered in ViewerJS 0.5.8. (CVSS 4.7)
- [CVE-2024-26504](https://cve.now/CVE-2024-26504.md): An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter. (CVSS 8.8)
- [CVE-2024-30176](https://cve.now/CVE-2024-30176.md): In Logpoint before 7.4.0, an attacker can enumerate a valid list of usernames by using publicly exposed URLs of shared widgets. (CVSS 5.3)
- [CVE-2024-32210](https://cve.now/CVE-2024-32210.md): The LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL co (CVSS 5.3)
- [CVE-2024-32211](https://cve.now/CVE-2024-32211.md): An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserCla (CVSS 5.5)
- [CVE-2024-32212](https://cve.now/CVE-2024-32212.md): SQL Injection vulnerability in LOGINT LoMag Inventory Management v1.0.20.120 and before allows an attacker to execute arbitrary code via the (CVSS 8.1)
- [CVE-2024-32213](https://cve.now/CVE-2024-32213.md): The LoMag WareHouse Management application version 1.0.20.120 and older were found to allow weak passwords. (CVSS 5.3)
- [CVE-2024-33078](https://cve.now/CVE-2024-33078.md): Tencent Libpag v4.3 is vulnerable to Buffer Overflow. (CVSS 9.8)
- [CVE-2024-33292](https://cve.now/CVE-2024-33292.md): SQL Injection vulnerability in Realisation MGSD v.1.0 allows a remote attacker to obtain sensitive information via the id parameter. (CVSS 8.2)
- [CVE-2024-33300](https://cve.now/CVE-2024-33300.md): Typora v1.0.0 through v1.7 version (below) Markdown editor has a cross-site scripting (XSS) vulnerability, which allows attackers to execute (CVSS 7.3)
- [CVE-2024-33304](https://cve.now/CVE-2024-33304.md): SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" under Add Users. (CVSS 6.1)
- [CVE-2024-33306](https://cve.now/CVE-2024-33306.md): SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" parameter in Create User. (CVSS 7.4)
- [CVE-2024-33307](https://cve.now/CVE-2024-33307.md): SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" parameter in Create User. (CVSS 5.4)
- [CVE-2024-33393](https://cve.now/CVE-2024-33393.md): An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the to (CVSS 6.2)
- [CVE-2024-33423](https://cve.now/CVE-2024-33423.md): Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML vi (CVSS 7.4)
- [CVE-2024-33424](https://cve.now/CVE-2024-33424.md): A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML (CVSS 6.1)
- [CVE-2024-33428](https://cve.now/CVE-2024-33428.md): Buffer-Overflow vulnerability at conv.c:68 of stsaz phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .w (CVSS 8.8)
- [CVE-2024-33429](https://cve.now/CVE-2024-33429.md): Buffer-Overflow vulnerability at pcm\_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via a crafted .wav (CVSS 7.1)
- [CVE-2024-33430](https://cve.now/CVE-2024-33430.md): An issue in phiola/src/afilter/pcm\_convert.h:513 of phiola v2.0-rc22 allows a remote attacker to execute arbitrary code via the a crafted .w (CVSS 8.8)
- [CVE-2024-33431](https://cve.now/CVE-2024-33431.md): An issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a denial of service via a crafted .wav file. (CVSS 6.5)
- [CVE-2024-33442](https://cve.now/CVE-2024-33442.md): An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add\_post.php component. (CVSS 4.3)
- [CVE-2024-33763](https://cve.now/CVE-2024-33763.md): lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp. (CVSS 7.5, lunasvg)
- [CVE-2024-33764](https://cve.now/CVE-2024-33764.md): lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h. (CVSS 5.5, lunasvg)
- [CVE-2024-33766](https://cve.now/CVE-2024-33766.md): lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend\_transformed\_tiled\_argb.isra.0. (CVSS 5.3, lunasvg)
- [CVE-2024-33767](https://cve.now/CVE-2024-33767.md): lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition\_solid\_source. (CVSS 5.0, lunasvg)
- [CVE-2024-33768](https://cve.now/CVE-2024-33768.md): lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition\_solid\_source\_over. (CVSS 9.8, lunasvg)
- [CVE-2024-33775](https://cve.now/CVE-2024-33775.md): An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet. (CVSS 8.8)
- [CVE-2024-33820](https://cve.now/CVE-2024-33820.md): Totolink AC1200 Wireless Dual Band Gigabit Router A3002R\_V4 Firmware V4.0.0-B20230531.1404 is vulnerable to Buffer Overflow via the formWlEn (CVSS 7.5)
- [CVE-2024-33835](https://cve.now/CVE-2024-33835.md): Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the remoteIp parameter from formSetSafeWanWebMan function. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.