# CVEs published 2024-05-09

226 CVEs were published on May 9, 2024: 20 critical, 77 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-4671](https://cve.now/CVE-2024-4671.md): Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to pot (CVSS 9.6, KEV, Google Chrome)
- [CVE-2024-0098](https://cve.now/CVE-2024-0098.md): CVE (CVSS 5.5, nvidia ChatRTX)
- [CVE-2024-0097](https://cve.now/CVE-2024-0097.md): CVE (CVSS 7.5, nvidia ChatRTX)
- [CVE-2024-0096](https://cve.now/CVE-2024-0096.md): CVE (CVSS 7.5, nvidia ChatRTX)
- [CVE-2024-0088](https://cve.now/CVE-2024-0088.md): CVE (CVSS 5.5, NVIDIA Triton Inference Server)
- [CVE-2024-0100](https://cve.now/CVE-2024-0100.md): CVE (CVSS 6.5, NVIDIA Triton Inference Server)
- [CVE-2024-0087](https://cve.now/CVE-2024-0087.md): CVE (CVSS 9.0, NVIDIA Triton Inference Server)
- [CVE-2024-4688](https://cve.now/CVE-2024-4688.md): Campcodes Complete Web-Based School Management System conversation\_history\_admin.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4687](https://cve.now/CVE-2024-4687.md): Campcodes Complete Web-Based School Management System create\_events.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-32985](https://cve.now/CVE-2024-32985.md): Stellar-core's Overlay - security fix for DDoS mitigation (CVSS 5.9, stellar-core)
- [CVE-2024-4686](https://cve.now/CVE-2024-4686.md): Campcodes Complete Web-Based School Management System emarks\_range\_grade\_update\_form.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-3808](https://cve.now/CVE-2024-3808.md): Porto Theme - Functionality \<= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, P-THEMES Porto Theme - Functionality)
- [CVE-2024-2290](https://cve.now/CVE-2024-2290.md): Advanced Ads – Ad Manager & AdSense \<= 1.52.1 - Authenticated (Admin+) PHP Object Injection (CVSS 7.2, monetizemore Advanced Ads – Ad Manager & AdSense)
- [CVE-2024-3809](https://cve.now/CVE-2024-3809.md): Porto Theme - Functionality \<= 3.0.9 - Authenticated (Contributor+) Local File Inclusion via Post Meta (CVSS 8.8, P-THEMES Porto Theme - Functionality)
- [CVE-2024-4397](https://cve.now/CVE-2024-4397.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload (CVSS 8.8, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2024-4104](https://cve.now/CVE-2024-4104.md): ADFO – Custom data in admin dashboard \<= 1.9.0 - Reflected Cross-Site Scripting (CVSS 6.1, giuliopanda ADFO – Custom data in admin dashboard)
- [CVE-2024-4038](https://cve.now/CVE-2024-4038.md): Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro \<= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, propluginslab Back In Stock Notifier for WooCommerce | WooC…)
- [CVE-2024-2785](https://cve.now/CVE-2024-2785.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-1467](https://cve.now/CVE-2024-1467.md): Starter Templates — Elementor, WordPress & Beaver Builder Templates \<= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery (CVSS 4.3, brainstormforce Starter Templates – AI-Powered Templates fo…)
- [CVE-2024-4463](https://cve.now/CVE-2024-4463.md): Squelch Tabs and Accordions Shortcodes \<= 0.4.7 - Cross-Site Request Forgery (CVSS 4.3, Squelch Tabs and Accordions Shortcodes)
- [CVE-2024-4193](https://cve.now/CVE-2024-4193.md): Testimonial Slider \<= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, davidanderson Testimonial Slider)
- [CVE-2024-4567](https://cve.now/CVE-2024-4567.md): Themify Shortcodes \<= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify\_button Shortcode (CVSS 6.4, themifyme Themify Shortcodes)
- [CVE-2024-4082](https://cve.now/CVE-2024-4082.md): Joli FAQ SEO – WordPress FAQ Plugin \<= 1.3.2 - Cross-Site Request Forgery (CVSS 4.3, wpjoli Joli FAQ SEO – WordPress FAQ Plugin)
- [CVE-2024-3070](https://cve.now/CVE-2024-3070.md): Last Viewed Posts by WPBeginner \<= 1.0.0 - Unauthenticated PHP Object Injection (CVSS 9.8, jottlieb Last Viewed Posts by WPBeginner)
- [CVE-2024-0445](https://cve.now/CVE-2024-0445.md): The Plus Addons for Elementor \<= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-2846](https://cve.now/CVE-2024-2846.md): Visual Footer Credit Remover \<= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, upwerd Visual Footer Credit Remover)
- [CVE-2024-3923](https://cve.now/CVE-2024-3923.md): Beaver Builder – WordPress Page Builder \<= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, beaverbuilder Beaver Builder Page Builder – Drag and Drop W…)
- [CVE-2024-3990](https://cve.now/CVE-2024-3990.md): HT Mega – Absolute Addons For Elementor \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-3806](https://cve.now/CVE-2024-3806.md): Porto \<= 7.1.0 - Unauthenticated Local File Inclusion via porto\_ajax\_posts (CVSS 9.8, P-THEMES Porto)
- [CVE-2024-1230](https://cve.now/CVE-2024-1230.md): SimpleShop \<= 2.10.0 - Cross-Site Request Forgery (CVSS 4.3, redbitcz SimpleShop)
- [CVE-2024-4335](https://cve.now/CVE-2024-4335.md): Rank Math SEO with AI Best SEO Tools \<= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2024-4103](https://cve.now/CVE-2024-4103.md): ADFO – Custom data in admin dashboard \<= 1.9.0 - Cross-Site Request Forgery (CVSS 4.3, giuliopanda ADFO – Custom data in admin dashboard)
- [CVE-2024-4441](https://cve.now/CVE-2024-4441.md): XML Sitemap & Google News \<= 5.4.8 - Unauthenticated Local File Inclusion (CVSS 8.1, ravanh XML Sitemap & Google News)
- [CVE-2024-3915](https://cve.now/CVE-2024-3915.md): Swift Framework \<= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update (CVSS 5.3, Swift Ideas Swift Framework)
- [CVE-2024-2923](https://cve.now/CVE-2024-2923.md): Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) \<= 1.1.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget (CVSS 6.4, nalam-1 Magical Addons For Elementor)
- [CVE-2024-4411](https://cve.now/CVE-2024-4411.md): Mihdan: Yandex Turbo Feed \<= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Mihdan: Yandex Turbo Feed)
- [CVE-2024-4339](https://cve.now/CVE-2024-4339.md): Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) \<= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdthemes Prime Slider – Addons for Elementor)
- [CVE-2024-4314](https://cve.now/CVE-2024-4314.md): hostel \<= 1.1.5.3 - Cross-Site Request Forgery (CVSS 4.3, prasunsen Hostel)
- [CVE-2024-4446](https://cve.now/CVE-2024-4446.md): Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) \<= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagingType Parameter (CVSS 6.4, pt-guy Content Views – Post Grid & Filter, Recent Posts, Ca…)
- [CVE-2024-3831](https://cve.now/CVE-2024-3831.md): Enter Addons – Ultimate Template Builder for Elementor \<= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget (CVSS 6.4, themelooks Enter Addons – Ultimate Template Builder for Ele…)
- [CVE-2024-3595](https://cve.now/CVE-2024-3595.md): Pure Chat – Live Chat Plugin & More! \<= 2.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, pure-chat Pure Chat – Live Chat & More!)
- [CVE-2024-3722](https://cve.now/CVE-2024-3722.md): Swift Performance Lite \<= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification (CVSS 5.4, swte Swift Performance Lite)
- [CVE-2024-4312](https://cve.now/CVE-2024-4312.md): Soccer Engine – Soccer Plugin for WordPress \<= 1.12 - Cross-Site Request Forgery (CVSS 4.3, daext Soccer Engine – Soccer Plugin for WordPress)
- [CVE-2024-3916](https://cve.now/CVE-2024-3916.md): Swift Framework \<= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes (CVSS 6.4, Swift Ideas Swift Framework)
- [CVE-2024-4383](https://cve.now/CVE-2024-4383.md): Simple Membership \<= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpinsider-1 Simple Membership)
- [CVE-2024-3952](https://cve.now/CVE-2024-3952.md): Advanced Ads – Ad Manager & AdSense \<= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget (CVSS 6.4, monetizemore Advanced Ads – Ad Manager & AdSense)
- [CVE-2024-4041](https://cve.now/CVE-2024-4041.md): Yoast SEO \<= 22.5 - Reflected Cross-Site Scripting (CVSS 6.1, Yoast SEO – Advanced SEO with real-time guidance and built-…)
- [CVE-2024-1229](https://cve.now/CVE-2024-1229.md): SimpleShop \<= 2.10.2 - Missing Authorization (CVSS 5.3, redbitcz SimpleShop)
- [CVE-2024-1166](https://cve.now/CVE-2024-1166.md): Image Hover Effects - Elementor Addon \<= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget (CVSS 6.4, blocksera Image Hover Effects – Elementor Addon)
- [CVE-2024-3807](https://cve.now/CVE-2024-3807.md): Porto \<= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta (CVSS 8.8, P-THEMES Porto)
- [CVE-2024-4386](https://cve.now/CVE-2024-4386.md): Gallery Block (Meow Gallery) \<= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, tigroumeow Meow Gallery)
- [CVE-2024-3974](https://cve.now/CVE-2024-3974.md): BuddyPress \<= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, BuddyPress)
- [CVE-2024-4316](https://cve.now/CVE-2024-4316.md): EmbedPress Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor \<= 3.9.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2024-3680](https://cve.now/CVE-2024-3680.md): Enter Addons – Ultimate Template Builder for Elementor \<= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag (CVSS 6.4, themelooks Enter Addons – Ultimate Template Builder for Ele…)
- [CVE-2023-6327](https://cve.now/CVE-2023-6327.md): ShopLentor (formerly WooLentor) \<= 2.8.7 - Missing Authorization via purchased\_new\_products (CVSS 5.3, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-4158](https://cve.now/CVE-2024-4158.md): Blocksy \<= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, creativethemeshq Blocksy)
- [CVE-2024-4150](https://cve.now/CVE-2024-4150.md): Simple Basic Contact Form \<= 20221201 - Reflected Cross-Site Scripting (CVSS 6.1, wpkube Simple Basic Contact Form)
- [CVE-2024-1693](https://cve.now/CVE-2024-1693.md): SP Project & Document Manager \<= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update (CVSS 4.3, smartypants SP Project & Document Manager)
- [CVE-2024-3954](https://cve.now/CVE-2024-3954.md): Ditty – Responsive News Tickers, Sliders, and Lists \<= 3.1.38 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, metaphorcreations Ditty – Responsive News Tickers, Sliders,…)
- [CVE-2024-4107](https://cve.now/CVE-2024-4107.md): Elementor Website Builder Pro \<= 3.21.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, https://elementor.com/ Elementor Website Builder Pro)
- [CVE-2024-3068](https://cve.now/CVE-2024-3068.md): Custom Field Suite \<= 2.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, mgibbs189 Custom Field Suite)
- [CVE-2024-4605](https://cve.now/CVE-2024-4605.md): Breakdance \<= 1.7.1 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, Breakdance)
- [CVE-2024-3989](https://cve.now/CVE-2024-3989.md): HT Mega – Absolute Addons For Elementor \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-4685](https://cve.now/CVE-2024-4685.md): Campcodes Complete Web-Based School Management System exam\_timetable.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2022-32505](https://cve.now/CVE-2022-32505.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 7.1)
- [CVE-2022-32508](https://cve.now/CVE-2022-32508.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 7.5)
- [CVE-2022-32506](https://cve.now/CVE-2022-32506.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 6.4)
- [CVE-2022-32510](https://cve.now/CVE-2022-32510.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 7.1)
- [CVE-2022-32503](https://cve.now/CVE-2022-32503.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 7.6)
- [CVE-2022-32507](https://cve.now/CVE-2022-32507.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 8.8)
- [CVE-2022-32502](https://cve.now/CVE-2022-32502.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 6.3)
- [CVE-2022-32504](https://cve.now/CVE-2022-32504.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 9.8)
- [CVE-2024-4684](https://cve.now/CVE-2024-4684.md): Campcodes Complete Web-Based School Management System exam\_timetable\_grade\_wise.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2022-32509](https://cve.now/CVE-2022-32509.md): An issue was discovered on certain Nuki Home Solutions devices. (CVSS 8.8)
- [CVE-2024-34220](https://cve.now/CVE-2024-34220.md): Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter. (CVSS 7.5)
- [CVE-2024-4683](https://cve.now/CVE-2024-4683.md): Campcodes Complete Web-Based School Management System exam\_timetable\_insert\_form.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-22910](https://cve.now/CVE-2024-22910.md): Cross Site Scripting (XSS) vulnerability in CrushFTP v.10.6.0 and v.10.5.5 allows an attacker to execute arbitrary code via a crafted payloa (CVSS 6.1)
- [CVE-2024-24157](https://cve.now/CVE-2024-24157.md): Gnuboard g6 / https://github.com/gnuboard/g6 commit c2cc1f5069e00491ea48618d957332d90f6d40e4 is vulnerable to Cross Site Scripting (XSS) via (CVSS 6.1)
- [CVE-2024-4545](https://cve.now/CVE-2024-4545.md): EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr (CVSS 7.7, EnterpriseDB EDB Postgres Advanced Server)
- [CVE-2023-29881](https://cve.now/CVE-2023-29881.md): phpok 6.4.003 is vulnerable to SQL injection in the function index\_f() in phpok64/framework/api/call\_control.php. (CVSS 6.5)
- [CVE-2024-34338](https://cve.now/CVE-2024-34338.md): Tenda O3V2 with firmware versions V1.0.0.10 and V1.0.0.12 was discovered to contain a Blind Command Injection via dest parameter in /goform/ (CVSS 7.2)
- [CVE-2024-31954](https://cve.now/CVE-2024-31954.md): An issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows. (CVSS 7.3)
- [CVE-2024-31953](https://cve.now/CVE-2024-31953.md): An issue was discovered in Samsung Magician 8.0.0 on macOS. (CVSS 6.7)
- [CVE-2024-31952](https://cve.now/CVE-2024-31952.md): An issue was discovered in Samsung Magician 8.0.0 on macOS. (CVSS 6.7)
- [CVE-2024-4682](https://cve.now/CVE-2024-4682.md): Campcodes Complete Web-Based School Management System exam\_timetable\_update\_form.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4681](https://cve.now/CVE-2024-4681.md): Campcodes Legal Case Management System Setting general-setting unrestricted upload (CVSS 5.1, Campcodes Legal Case Management System)
- [CVE-2024-33877](https://cve.now/CVE-2024-33877.md): HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5T\_\_conv\_struct\_opt in H5Tconv.c. (CVSS 8.8)
- [CVE-2024-33876](https://cve.now/CVE-2024-33876.md): HDF5 Library through 1.14.3 has a heap buffer overflow in H5S\_\_point\_deserialize in H5Spoint.c. (CVSS 5.7)
- [CVE-2024-33875](https://cve.now/CVE-2024-33875.md): HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5O\_\_layout\_encode in H5Olayout.c, resulting in the corruption of the instru (CVSS 5.7)
- [CVE-2024-33874](https://cve.now/CVE-2024-33874.md): HDF5 Library through 1.14.3 has a heap buffer overflow in H5O\_\_mtime\_new\_encode in H5Omtime.c. (CVSS 9.8)
- [CVE-2024-33873](https://cve.now/CVE-2024-33873.md): HDF5 Library through 1.14.3 has a heap-based buffer overflow in H5D\_\_scatter\_mem in H5Dscatgath.c. (CVSS 8.8)
- [CVE-2024-32624](https://cve.now/CVE-2024-32624.md): HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T\_\_ref\_mem\_setnull in H5Tref.c (called from H5T\_\_conv\_ref in H5Tconv. (CVSS 7.4)
- [CVE-2024-32623](https://cve.now/CVE-2024-32623.md): HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5VM\_array\_fill in H5VM.c (called from H5S\_select\_elements in H5Spoint. (CVSS 8.8)
- [CVE-2024-32622](https://cve.now/CVE-2024-32622.md): HDF5 Library through 1.14.3 contains a out-of-bounds read operation in H5FL\_arr\_malloc in H5FL.c (called from H5S\_set\_extent\_simple in H5S.c (CVSS 9.1)
- [CVE-2024-32621](https://cve.now/CVE-2024-32621.md): HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5HG\_read in H5HG.c (called from H5VL\_\_native\_blob\_get in H5VLnative\_bl (CVSS 9.8)
- [CVE-2024-32620](https://cve.now/CVE-2024-32620.md): HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5F\_addr\_decode\_len in H5Fint.c, resulting in the corruption of the in (CVSS 7.4)
- [CVE-2024-32619](https://cve.now/CVE-2024-32619.md): HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T\_copy\_reopen in H5T.c, resulting in the corruption of the instructio (CVSS 7.4)
- [CVE-2024-32618](https://cve.now/CVE-2024-32618.md): HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5T\_\_get\_native\_type in H5Tnative.c, resulting in the corruption of the (CVSS 7.4)
- [CVE-2024-32617](https://cve.now/CVE-2024-32617.md): HDF5 Library through 1.14.3 contains a heap-based buffer over-read caused by the unsafe use of strdup in H5MM\_xstrdup in H5MM.c (called from (CVSS 8.8)
- [CVE-2024-32616](https://cve.now/CVE-2024-32616.md): HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5O\_\_dtype\_encode\_helper in H5Odtype.c. (CVSS 7.4)
- [CVE-2024-32615](https://cve.now/CVE-2024-32615.md): HDF5 Library through 1.14.3 contains a heap-based buffer overflow in H5Z\_\_nbit\_decompress\_one\_byte in H5Znbit.c, caused by the earlier use o (CVSS 9.8)
- [CVE-2024-32614](https://cve.now/CVE-2024-32614.md): HDF5 Library through 1.14.3 has a SEGV in H5VM\_memcpyvv in H5VM.c. (CVSS 8.8)
- [CVE-2024-34209](https://cve.now/CVE-2024-34209.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpPortFilterRules function. (CVSS 9.8)
- [CVE-2024-32613](https://cve.now/CVE-2024-32613.md): HDF5 Library through 1.14.3 contains a heap-based buffer over-read in the function H5HL\_\_fl\_deserialize in H5HLcache.c, a different vulnerab (CVSS 7.4)
- [CVE-2024-34213](https://cve.now/CVE-2024-34213.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the SetPortForwardRules function. (CVSS 9.8)
- [CVE-2024-34200](https://cve.now/CVE-2024-34200.md): TOTOLINK CPE CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpQosRules function. (CVSS 8.8)
- [CVE-2024-34201](https://cve.now/CVE-2024-34201.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function. (CVSS 7.3)
- [CVE-2024-32612](https://cve.now/CVE-2024-32612.md): HDF5 Library through 1.14.3 contains a heap-based buffer over-read in H5HL\_\_fl\_deserialize in H5HLcache.c, resulting in the corruption of th (CVSS 7.4)
- [CVE-2024-32611](https://cve.now/CVE-2024-32611.md): HDF5 Library through 1.14.3 may use an uninitialized value in H5A\_\_attr\_release\_table in H5Aint.c. (CVSS 9.8)
- [CVE-2024-34202](https://cve.now/CVE-2024-34202.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setMacFilterRules function. (CVSS 6.5)
- [CVE-2024-27397](https://cve.now/CVE-2024-27397.md): netfilter: nf\_tables: use timestamp to check for set element timeout (CVSS 7.8, Linux)
- [CVE-2024-27396](https://cve.now/CVE-2024-27396.md): net: gtp: Fix Use-After-Free in gtp\_dellink (CVSS 7.8, Linux)
- [CVE-2024-27395](https://cve.now/CVE-2024-27395.md): net: openvswitch: Fix Use-After-Free in ovs\_ct\_exit (CVSS 7.8, Linux)
- [CVE-2024-27394](https://cve.now/CVE-2024-27394.md): tcp: Fix Use-After-Free in tcp\_ao\_connect\_init (CVSS 7.8, Linux)
- [CVE-2024-27393](https://cve.now/CVE-2024-27393.md): xen-netfront: Add missing skb\_mark\_for\_recycle (CVSS 7.5, Linux)
- [CVE-2023-52654](https://cve.now/CVE-2023-52654.md): io\_uring/af\_unix: disable sending io\_uring over sockets (CVSS 7.8, Linux)
- [CVE-2024-34203](https://cve.now/CVE-2024-34203.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setLanguageCfg function. (CVSS 3.8)
- [CVE-2024-34204](https://cve.now/CVE-2024-34204.md): TOTOLINK outdoor CPE CP450 v4.1.0cu.747\_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function v (CVSS 9.8)
- [CVE-2024-34205](https://cve.now/CVE-2024-34205.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a command injection vulnerability in the download\_firmware function. (CVSS 7.3)
- [CVE-2024-32610](https://cve.now/CVE-2024-32610.md): HDF5 Library through 1.14.3 has a SEGV in H5T\_close\_real in H5T.c, resulting in a corrupted instruction pointer. (CVSS 5.7)
- [CVE-2024-34206](https://cve.now/CVE-2024-34206.md): TOTOLINK outdoor CPE CP450 v4.1.0cu.747\_B20191224 was discovered to contain a command injection vulnerability in the setWebWlanIdx function (CVSS 6.5)
- [CVE-2024-32609](https://cve.now/CVE-2024-32609.md): HDF5 Library through 1.14.3 allows stack consumption in the function H5E\_printf\_stack in H5Eint.c. (CVSS 7.5)
- [CVE-2024-32607](https://cve.now/CVE-2024-32607.md): HDF5 Library through 1.14.3 has a SEGV in H5A\_\_close in H5Aint.c, resulting in the corruption of the instruction pointer. (CVSS 5.7)
- [CVE-2024-32606](https://cve.now/CVE-2024-32606.md): HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools\_str\_sprint in tools/lib/h5tools\_str.c (called from h5 (CVSS 5.7)
- [CVE-2024-32605](https://cve.now/CVE-2024-32605.md): HDF5 Library through 1.14.3 has a heap-based buffer over-read in H5VM\_memcpyvv in H5VM.c (called from H5D\_\_compact\_readvv in H5Dcompact.c). (CVSS 8.8)
- [CVE-2024-34207](https://cve.now/CVE-2024-34207.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setStaticDhcpConfig function. (CVSS 8.8)
- [CVE-2024-29166](https://cve.now/CVE-2024-29166.md): HDF5 through 1.14.3 contains a buffer overflow in H5O\_\_linfo\_decode, resulting in the corruption of the instruction pointer and causing deni (CVSS 5.7)
- [CVE-2024-34217](https://cve.now/CVE-2024-34217.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the addWlProfileClientMode function (CVSS 7.7)
- [CVE-2024-29165](https://cve.now/CVE-2024-29165.md): HDF5 through 1.14.3 contains a buffer overflow in H5Z\_\_filter\_fletcher32, resulting in the corruption of the instruction pointer and causing (CVSS 7.4)
- [CVE-2024-29164](https://cve.now/CVE-2024-29164.md): HDF5 through 1.14.3 contains a stack buffer overflow in H5R\_\_decode\_heap, resulting in the corruption of the instruction pointer and causing (CVSS 9.8)
- [CVE-2024-29163](https://cve.now/CVE-2024-29163.md): HDF5 through 1.14.3 contains a heap buffer overflow in H5T\_\_bit\_find, resulting in the corruption of the instruction pointer and causing den (CVSS 7.4)
- [CVE-2024-34215](https://cve.now/CVE-2024-34215.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function. (CVSS 7.3)
- [CVE-2024-29162](https://cve.now/CVE-2024-29162.md): HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow in H5HG\_read, resulting in denial of service or potential code execution. (CVSS 7.4)
- [CVE-2024-29161](https://cve.now/CVE-2024-29161.md): HDF5 through 1.14.3 contains a heap buffer overflow in H5A\_\_attr\_release\_table, resulting in the corruption of the instruction pointer and c (CVSS 8.8)
- [CVE-2024-29160](https://cve.now/CVE-2024-29160.md): HDF5 through 1.14.3 contains a heap buffer overflow in H5HG\_\_cache\_heap\_deserialize, resulting in the corruption of the instruction pointer (CVSS 7.4)
- [CVE-2024-29159](https://cve.now/CVE-2024-29159.md): HDF5 through 1.14.3 contains a buffer overflow in H5Z\_\_filter\_scaleoffset, resulting in the corruption of the instruction pointer and causin (CVSS 9.8)
- [CVE-2024-29158](https://cve.now/CVE-2024-29158.md): HDF5 through 1.14.3 contains a stack buffer overflow in H5FL\_arr\_malloc, resulting in the corruption of the instruction pointer and causing (CVSS 7.4)
- [CVE-2024-29157](https://cve.now/CVE-2024-29157.md): HDF5 through 1.14.3 contains a heap buffer overflow in H5HG\_read, resulting in the corruption of the instruction pointer and causing denial (CVSS 9.8)
- [CVE-2024-34351](https://cve.now/CVE-2024-34351.md): Next.js Server-Side Request Forgery in Server Actions (CVSS 7.5, vercel next.js · next)
- [CVE-2024-34350](https://cve.now/CVE-2024-34350.md): Next.js Vulnerable to HTTP Request Smuggling (CVSS 7.5, vercel next.js · next)
- [CVE-2024-33454](https://cve.now/CVE-2024-33454.md): Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute arbitrary code via a crafted script to the Bluetooth stac (CVSS 6.5)
- [CVE-2024-32739](https://cve.now/CVE-2024-32739.md): CyberPower PowerPanel Enterprise SQL Injection (CVSS 7.5, CyberPower PowerPanel Enterprise)
- [CVE-2024-32738](https://cve.now/CVE-2024-32738.md): CyberPower PowerPanel Enterprise SQL Injection (CVSS 7.5, CyberPower PowerPanel Enterprise)
- [CVE-2024-32737](https://cve.now/CVE-2024-32737.md): CyberPower PowerPanel Enterprise SQL Injection (CVSS 7.5, CyberPower PowerPanel Enterprise)
- [CVE-2024-32736](https://cve.now/CVE-2024-32736.md): CyberPower PowerPanel Enterprise SQL Injection (CVSS 7.5, CyberPower PowerPanel Enterprise)
- [CVE-2024-3727](https://cve.now/CVE-2024-3727.md): Containers/image: digest type does not guarantee valid type (CVSS 8.3, image · Red Hat OADP-1.3-RHEL-9 +18)
- [CVE-2024-34345](https://cve.now/CVE-2024-34345.md): @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability (CVSS 8.1, cyclonedx-javascript-library · @cyclonedx/cyclonedx-library)
- [CVE-2024-32735](https://cve.now/CVE-2024-32735.md): CyberPower PowerPanel Enterprise Missing Authentication (CVSS 9.8, CyberPower PowerPanel Enterprise)
- [CVE-2024-34354](https://cve.now/CVE-2024-34354.md): CMSaasStarter: JWT Token Not Verified on Server Session (CVSS 6.5, CriticalMoments CMSaasStarter)
- [CVE-2024-34352](https://cve.now/CVE-2024-34352.md): Arbitrary file write vulnerability in 1Panel (CVSS 6.5, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2024-4678](https://cve.now/CVE-2024-4678.md): Campcodes Complete Web-Based School Management System find\_friends.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-32655](https://cve.now/CVE-2024-32655.md): Npgsql Vulnerable to SQL Injection via Protocol Message Size Overflow (CVSS 8.1, npgsql)
- [CVE-2024-34074](https://cve.now/CVE-2024-34074.md): Frappe vuilnerable to an open redirect on login page (CVSS 6.1, frappe)
- [CVE-2024-34210](https://cve.now/CVE-2024-34210.md): TOTOLINK outdoor CPE CP450 v4.1.0cu.747\_B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate fun (CVSS 7.3)
- [CVE-2024-34211](https://cve.now/CVE-2024-34211.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attac (CVSS 8.8)
- [CVE-2024-32874](https://cve.now/CVE-2024-32874.md): In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service (CVSS 6.8, blakeblackshear frigate · frigate)
- [CVE-2024-34212](https://cve.now/CVE-2024-34212.md): TOTOLINK CP450 v4.1.0cu.747\_B20191224 was discovered to contain a stack buffer overflow vulnerability in the CloudACMunualUpdate function. (CVSS 7.3)
- [CVE-2024-34219](https://cve.now/CVE-2024-34219.md): TOTOLINK CP450 V4.1.0cu.747\_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log (CVSS 8.6)
- [CVE-2024-31803](https://cve.now/CVE-2024-31803.md): Buffer Overflow vulnerability in emp-ot v.0.2.4 allows a remote attacker to execute arbitrary code via the FerretCOT\<T\>::read\_pre\_data128\_fr (CVSS 6.2)
- [CVE-2024-34218](https://cve.now/CVE-2024-34218.md): TOTOLINK outdoor CPE CP450 v4.1.0cu.747\_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost functio (CVSS 3.8)
- [CVE-2024-4677](https://cve.now/CVE-2024-4677.md): Campcodes Complete Web-Based School Management System my\_student\_exam\_marks1.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4676](https://cve.now/CVE-2024-4676.md): Campcodes Complete Web-Based School Management System range\_grade\_text.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4317](https://cve.now/CVE-2024-4317.md): PostgreSQL pg\_stats\_ext and pg\_stats\_ext\_exprs lack authorization checks (CVSS 3.1, PostgreSQL)
- [CVE-2024-23473](https://cve.now/CVE-2024-23473.md): SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability (CVSS 8.6, SolarWinds Access Rights Manager)
- [CVE-2024-28075](https://cve.now/CVE-2024-28075.md): SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution (CVSS 9.0, SolarWinds Access Rights Manager)
- [CVE-2024-32712](https://cve.now/CVE-2024-32712.md): WordPress Podlove Podcast Publisher plugin \<= 4.0.14 - Broken Access Control vulnerability (CVSS 7.5, Podlove Podcast Publisher)
- [CVE-2024-32717](https://cve.now/CVE-2024-32717.md): WordPress SchedulePress plugin \<= 5.0.8 - Broken Access Control vulnerability (CVSS 6.5, WPDeveloper SchedulePress)
- [CVE-2024-32719](https://cve.now/CVE-2024-32719.md): WordPress WP Club Manager plugin \<= 2.2.11 - Broken Access Control vulnerability (CVSS 5.3, WP Club Manager)
- [CVE-2024-32724](https://cve.now/CVE-2024-32724.md): WordPress SharkDropship and Affiliate for AliExpress, eBay, Amazon, Etsy plugin \<= 2.1.1 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Woo product importer Sharkdropship dropshipping for Aliexpr…)
- [CVE-2024-34549](https://cve.now/CVE-2024-34549.md): WordPress WP Job Manager plugin \<= 2.2.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Automattic WP Job Manager)
- [CVE-2024-34550](https://cve.now/CVE-2024-34550.md): WordPress Dynamics 365 Integration plugin \<= 1.3.17 - Sensitive Data Exposure vulnerability (CVSS 5.3, AlexaCRM Dynamics 365 Integration)
- [CVE-2024-34556](https://cve.now/CVE-2024-34556.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.5.4 - Sensitive Data Exposure via Exported File vulnerability (CVSS 5.3, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2024-34559](https://cve.now/CVE-2024-34559.md): WordPress Ghost plugin \<= 1.4.0 - Sensitive Data Exposure via Log File vulnerability (CVSS 7.5, Ghost Foundation Ghost)
- [CVE-2024-34433](https://cve.now/CVE-2024-34433.md): WordPress One Click Demo Import plugin \<=3.2.0 - PHP Object Injection vulnerability (CVSS 4.4, OCDI One Click Demo Import)
- [CVE-2024-4606](https://cve.now/CVE-2024-4606.md): WordPress Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder plugin \<= 2.0.3 - PHP Object Injection vulnerability (CVSS 5.4, BdThemes Ultimate Store Kit Elementor Addons)
- [CVE-2024-34439](https://cve.now/CVE-2024-34439.md): WordPress DS Site Message plugin \<= 1.14.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, divSpot DS Site Message)
- [CVE-2024-34427](https://cve.now/CVE-2024-34427.md): WordPress WP Favorite Posts plugin \<= 1.6.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Huseyin Berberoglu WP Favorite Posts)
- [CVE-2024-34557](https://cve.now/CVE-2024-34557.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.5.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2024-29800](https://cve.now/CVE-2024-29800.md): WordPress Timber plugin \<= 1.23.0 - Deserialization of untrusted data vulnerability (CVSS 8.0, Timber Team & Contributors Timber · timber/timber)
- [CVE-2024-34415](https://cve.now/CVE-2024-34415.md): WordPress Thim Elementor Kit plugin \<= 1.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ThimPress Thim Elementor Kit)
- [CVE-2024-34417](https://cve.now/CVE-2024-34417.md): WordPress Viet Nam Affiliate plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Toidicode.com (thanhtaivtt) Viet Nam Affiliate)
- [CVE-2024-34418](https://cve.now/CVE-2024-34418.md): WordPress WPCS ( WordPress Custom Search ) plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Tech9logy Creators WPCS)
- [CVE-2024-34419](https://cve.now/CVE-2024-34419.md): WordPress Configure Login Timeout plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Nathan Vonnahme Configure Login Timeout)
- [CVE-2024-4675](https://cve.now/CVE-2024-4675.md): Campcodes Complete Web-Based School Management System show\_events.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-34420](https://cve.now/CVE-2024-34420.md): WordPress Comments Evolved for WordPress plugin \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, talspotim Comments Evolved for WordPress)
- [CVE-2024-34421](https://cve.now/CVE-2024-34421.md): WordPress BlogLentor – Blog Designer Pack for Elementor plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpsurface BlogLentor)
- [CVE-2024-34422](https://cve.now/CVE-2024-34422.md): WordPress Viet Affiliate Link plugin \<= 1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, trinhtuantai Viet Affiliate Link)
- [CVE-2024-34423](https://cve.now/CVE-2024-34423.md): WordPress Forty Four – 404 Plugin for WordPress plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, phpbits Forty Four – 404 Plugin for WordPress)
- [CVE-2024-34424](https://cve.now/CVE-2024-34424.md): WordPress Featured Content Gallery plugin \<= 3.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, iePlexus Featured Content Gallery)
- [CVE-2024-34425](https://cve.now/CVE-2024-34425.md): WordPress QuickieBar plugin \<= 1.8.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Phil Baylog QuickieBar)
- [CVE-2024-34426](https://cve.now/CVE-2024-34426.md): WordPress Brozzme Scroll Top plugin \<= 1.8.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Benoti Brozzme Scroll Top)
- [CVE-2024-34428](https://cve.now/CVE-2024-34428.md): WordPress AWSOM News Announcement plugin \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Harknell AWSOM News Announcement)
- [CVE-2024-34429](https://cve.now/CVE-2024-34429.md): WordPress Simple Website Banner plugin \<= 1.8.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Orchestrated Corona Virus (COVID-19) Banner & Live Data)
- [CVE-2024-34430](https://cve.now/CVE-2024-34430.md): WordPress TT Custom Post Type Creator plugin \<=1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Rashed Latif TT Custom Post Type Creator)
- [CVE-2024-34431](https://cve.now/CVE-2024-34431.md): WordPress WP etracker plugin \<= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WP-etracker WP etracker)
- [CVE-2024-34432](https://cve.now/CVE-2024-34432.md): WordPress Better Elementor Addons plugin \<= 1.4.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BetterAddons Better Elementor Addons)
- [CVE-2024-34436](https://cve.now/CVE-2024-34436.md): WordPress SKT Addons for Elementor plugin \<= 1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SKT Themes SKT Addons for Elementor)
- [CVE-2024-34437](https://cve.now/CVE-2024-34437.md): WordPress Form Maker by 10Web plugin \<= 1.15.24 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, 10Web Form Builder Team Form Maker by 10Web)
- [CVE-2024-34441](https://cve.now/CVE-2024-34441.md): WordPress Easy Affiliate Links plugin \<= 3.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Bootstrapped Ventures Easy Affiliate Links)
- [CVE-2024-34445](https://cve.now/CVE-2024-34445.md): WordPress SKT Addons for Elementor plugin \<= 1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SKT Themes SKT Addons for Elementor)
- [CVE-2024-4674](https://cve.now/CVE-2024-4674.md): Campcodes Complete Web-Based School Management System show\_friend\_request.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-3461](https://cve.now/CVE-2024-3461.md): KioWare for Windows (versions all through 8.35) allows to brute force the PIN number, which protects the application from being closed, as t (CVSS 6.2, Kioware)
- [CVE-2024-3460](https://cve.now/CVE-2024-3460.md): In KioWare for Windows (versions all through 8.34) it is possible to exit this software and use other already opened applications utilizing (CVSS 7.4, Kioware)
- [CVE-2024-3459](https://cve.now/CVE-2024-3459.md): KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened (CVSS 8.4, Kioware)
- [CVE-2024-4673](https://cve.now/CVE-2024-4673.md): Campcodes Complete Web-Based School Management System show\_student\_grade\_subject.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2024-4425](https://cve.now/CVE-2024-4425.md): Storing credentials in plaintext in CemiPark (CVSS 5.4, CEMI Tomasz Pawełek CemiPark)
- [CVE-2024-4424](https://cve.now/CVE-2024-4424.md): Stored XSS in CemiPark (CVSS 6.1, CEMI Tomasz Pawełek CemiPark)
- [CVE-2024-4423](https://cve.now/CVE-2024-4423.md): Authentication bypass in CemiPark (CVSS 7.2, CEMI Tomasz Pawełek CemiPark)
- [CVE-2024-32672](https://cve.now/CVE-2024-32672.md): A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of ser (CVSS 5.3, Samsung Open Source Escargot)
- [CVE-2024-34365](https://cve.now/CVE-2024-34365.md): Apache Karaf Cave: Cave SSRF and arbitrary file access (CVSS 9.1, Apache Software Foundation Apache Karaf Cave · org.apache.k…)
- [CVE-2024-3016](https://cve.now/CVE-2024-3016.md): NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system sett (CVSS 9.1, NEC Platforms ITK-6DGS-1(BK) TEL · NEC Platforms ITK-32… +20)
- [CVE-2024-32669](https://cve.now/CVE-2024-32669.md): Possible stack overflow due to a string encoding processing error (CVSS 5.3, Samsung Open Source Escargot)
- [CVE-2024-3903](https://cve.now/CVE-2024-3903.md): Add Custom CSS and JS \<= 1.20 - Stored XSS via CSRF (CVSS 7.1, Add Custom CSS and JS)
- [CVE-2024-3590](https://cve.now/CVE-2024-3590.md): LetterPress \<= 1.2.2 - Subscriber Deletion via CSRF (CVSS 6.1, LetterPress)
- [CVE-2024-3582](https://cve.now/CVE-2024-3582.md): Ungallery \<= 2.2.4 - Stored XSS via CSRF (CVSS 4.8, UnGallery)
- [CVE-2023-5971](https://cve.now/CVE-2023-5971.md): Save as PDF \< 3.2.0 - Admin+ Stored XSS (CVSS 4.8, Save as PDF Plugin by Pdfcrowd)
- [CVE-2024-29857](https://cve.now/CVE-2024-29857.md): An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java (BC Java) before 1.78, BC Java LTS before 2.73.6, BC-FJA before (CVSS 7.5, org.bouncycastle:bcprov-jdk18on · org.bouncycastle:bcpro… +8)
- [CVE-2024-4672](https://cve.now/CVE-2024-4672.md): Campcodes Complete Web-Based School Management System show\_student\_subject.php cross site scripting (CVSS 5.3, Campcodes Complete Web-Based School Management System)
- [CVE-2023-6682](https://cve.now/CVE-2023-6682.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2023-6688](https://cve.now/CVE-2023-6688.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-2454](https://cve.now/CVE-2024-2454.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-2651](https://cve.now/CVE-2024-2651.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-4539](https://cve.now/CVE-2024-4539.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-4597](https://cve.now/CVE-2024-4597.md): Cross-Site Request Forgery (CSRF) in GitLab (CVSS 5.7, GitLab)
- [CVE-2024-30171](https://cve.now/CVE-2024-30171.md): An issue was discovered in Bouncy Castle Java TLS API and JSSE Provider before 1.78. (CVSS 5.9, org.bouncycastle:bctls-fips · org.bouncycastle:bcprov-jd… +8)
- [CVE-2024-30172](https://cve.now/CVE-2024-30172.md): An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. (CVSS 7.5, org.bouncycastle:bcprov-jdk18on · org.bouncycastle:bcpro… +6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.