# CVEs published 2024-05-16

227 CVEs were published on May 16, 2024: 14 critical, 75 high. Days are UTC.

- [CVE-2024-30060](https://cve.now/CVE-2024-30060.md): Azure Monitor Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Monitor)
- [CVE-2024-3134](https://cve.now/CVE-2024-3134.md): Master Addons for Elementor \<= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2021-33146](https://cve.now/CVE-2021-33146.md): Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unaut (CVSS 5.3, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2021-33142](https://cve.now/CVE-2021-33142.md): Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privil (CVSS 6.0, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2021-33158](https://cve.now/CVE-2021-33158.md): Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileg (CVSS 7.2, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2021-33145](https://cve.now/CVE-2021-33145.md): Uncaught exception in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged us (CVSS 7.2, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2022-37341](https://cve.now/CVE-2022-37341.md): Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileg (CVSS 7.2, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2021-33161](https://cve.now/CVE-2021-33161.md): Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privil (CVSS 7.2, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2021-33157](https://cve.now/CVE-2021-33157.md): Insufficient control flow management in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may all (CVSS 7.2, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2021-33162](https://cve.now/CVE-2021-33162.md): Improper access control in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an authent (CVSS 8.4, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2021-33141](https://cve.now/CVE-2021-33141.md): Improper input validation in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow an unaut (CVSS 8.6, Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller…)
- [CVE-2023-28383](https://cve.now/CVE-2023-28383.md): Improper conditions check in some Intel(R) BIOS PPAM firmware may allow a privileged user to potentially enable escalation of privilege via (CVSS 6.1, Intel(R) BIOS PPAM firmware)
- [CVE-2023-27504](https://cve.now/CVE-2023-27504.md): Improper conditions check in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via (CVSS 7.2, Intel(R) BIOS Guard firmware)
- [CVE-2023-28402](https://cve.now/CVE-2023-28402.md): Improper input validation in some Intel(R) BIOS Guard firmware may allow a privileged user to potentially enable escalation of privilege via (CVSS 7.2, Intel(R) BIOS Guard firmware)
- [CVE-2023-35192](https://cve.now/CVE-2023-35192.md): Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.3 may allow an authenticated user to potentially enable (CVSS 6.7, Intel(R) GPA Framework software)
- [CVE-2023-41961](https://cve.now/CVE-2023-41961.md): Uncontrolled search path in some Intel(R) GPA software before version 2023.3 may allow an authenticated user to potentially enable escalatio (CVSS 6.7, Intel(R) GPA software)
- [CVE-2023-40071](https://cve.now/CVE-2023-40071.md): Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable (CVSS 7.3, Intel(R) GPA software installers)
- [CVE-2023-43629](https://cve.now/CVE-2023-43629.md): Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially (CVSS 7.8, Intel(R) GPA software installers)
- [CVE-2023-43748](https://cve.now/CVE-2023-43748.md): Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentia (CVSS 7.8, Intel(R) GPA Framework software installers)
- [CVE-2023-24460](https://cve.now/CVE-2023-24460.md): Incorrect default permissions in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially (CVSS 8.2, Intel(R) GPA software installers)
- [CVE-2022-37410](https://cve.now/CVE-2022-37410.md): Improper access control for some Intel(R) Thunderbolt driver software before version 89 may allow an authenticated user to potentially enabl (CVSS 7.0, Intel(R) Thunderbolt driver software)
- [CVE-2023-47169](https://cve.now/CVE-2023-47169.md): Improper buffer restrictions in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of ser (CVSS 3.3, Intel(R) Media SDK software)
- [CVE-2023-48727](https://cve.now/CVE-2023-48727.md): NULL pointer dereference in some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentially enable inform (CVSS 3.3, Intel(R) oneVPL software)
- [CVE-2023-47282](https://cve.now/CVE-2023-47282.md): Out-of-bounds write in Intel(R) Media SDK all versions and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated us (CVSS 3.9, Intel(R) oneVPL software)
- [CVE-2023-22656](https://cve.now/CVE-2023-22656.md): Out-of-bounds read in Intel(R) Media SDK and some Intel(R) oneVPL software before version 23.3.5 may allow an authenticated user to potentia (CVSS 3.9, Intel(R) Media SDK and some Intel(R) oneVPL software)
- [CVE-2023-45221](https://cve.now/CVE-2023-45221.md): Improper buffer restrictions in Intel(R) Media SDK all versions may allow an authenticated user to potentially enable escalation of privileg (CVSS 4.8, Intel(R) Media SDK)
- [CVE-2023-48368](https://cve.now/CVE-2023-48368.md): Improper input validation in Intel(R) Media SDK software all versions may allow an authenticated user to potentially enable denial of servic (CVSS 5.9, Intel(R) Media SDK software)
- [CVE-2023-43751](https://cve.now/CVE-2023-43751.md): Uncontrolled search path in Intel(R) Graphics Command Center Service bundled in some Intel(R) Graphics Windows DCH driver software before ve (CVSS 6.7, Intel(R) Graphics Windows DCH driver software)
- [CVE-2023-42668](https://cve.now/CVE-2023-42668.md): Incorrect default permissions in some onboard video driver software before version 1.14 for Intel(R) Server Boards based on Intel(R) 62X Chi (CVSS 6.7, onboard video driver software for Intel(R) Server Boards ba…)
- [CVE-2023-42433](https://cve.now/CVE-2023-42433.md): Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to (CVSS 6.7, Endurance Gaming Mode software installers)
- [CVE-2024-22384](https://cve.now/CVE-2024-22384.md): Out-of-bounds read for some Intel(R) Trace Analyzer and Collector software before version 2022.0.0 published Nov 2023 may allow an authentic (CVSS 2.8, Intel(R) Trace Analyzer and Collector software)
- [CVE-2024-21813](https://cve.now/CVE-2024-21813.md): Exposure of resource to wrong sphere in some Intel(R) DTT software installers may allow an authenticated user to potentially enable escalati (CVSS 7.9, Intel(R) DTT software installers)
- [CVE-2024-22015](https://cve.now/CVE-2024-22015.md): Improper input validation for some Intel(R) DLB driver software before version 8.5.0 may allow an authenticated user to potentially denial o (CVSS 6.5, Intel(R) DLB driver software)
- [CVE-2023-41092](https://cve.now/CVE-2023-41092.md): Unchecked return value in SDM firmware for Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs before version 23.3 may allow an authenticated us (CVSS 7.6, Intel(R) Stratix 10 and Intel(R) Agilex 7 FPGAs)
- [CVE-2023-39929](https://cve.now/CVE-2023-39929.md): Uncontrolled search path in some Libva software maintained by Intel(R) before version 2.20.0 may allow an authenticated user to potentially (CVSS 6.7, Libva software maintained by Intel)
- [CVE-2023-43745](https://cve.now/CVE-2023-43745.md): Improper input validation in some Intel(R) CBI software before version 1.1.0 may allow an authenticated user to potentially enable denial of (CVSS 2.8, Intel(R) CBI software)
- [CVE-2023-41082](https://cve.now/CVE-2023-41082.md): Null pointer dereference for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable denia (CVSS 4.4, Intel(R) CST software)
- [CVE-2023-39433](https://cve.now/CVE-2023-39433.md): Improper access control for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escala (CVSS 4.4, Intel(R) CST software)
- [CVE-2023-43487](https://cve.now/CVE-2023-43487.md): Improper access control in some Intel(R) CST before version 2.1.10300 may allow an authenticated user to potentially enable denial of servic (CVSS 4.7, Intel(R) CST)
- [CVE-2023-40155](https://cve.now/CVE-2023-40155.md): Uncontrolled search path for some Intel(R) CST software before version 2.1.10300 may allow an authenticated user to potentially enable escal (CVSS 6.7, Intel(R) CST software)
- [CVE-2023-45743](https://cve.now/CVE-2023-45743.md): Uncontrolled search path in some Intel(R) DSA software uninstallers before version 23.4.39.10 may allow an authenticated user to potentially (CVSS 6.7, Intel(R) DSA software uninstallers)
- [CVE-2024-21814](https://cve.now/CVE-2024-21814.md): Uncontrolled search path for some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potenti (CVSS 6.7, Intel(R) Chipset Device Software)
- [CVE-2023-45320](https://cve.now/CVE-2023-45320.md): Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to poten (CVSS 6.7, Intel(R) VTune(TM) Profiler software)
- [CVE-2024-21818](https://cve.now/CVE-2024-21818.md): Uncontrolled search path in some Intel(R) PCM software before version 202311 may allow an authenticated user to potentially enable escalatio (CVSS 6.7, Intel(R) PCM software)
- [CVE-2023-47855](https://cve.now/CVE-2023-47855.md): Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enabl (CVSS 6.0, Intel(R) TDX module software)
- [CVE-2023-45745](https://cve.now/CVE-2023-45745.md): Improper input validation in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enabl (CVSS 7.9, Intel(R) TDX module software)
- [CVE-2023-38420](https://cve.now/CVE-2023-38420.md): Improper conditions check in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable inf (CVSS 3.8, Intel(R) Power Gadget software for macOS)
- [CVE-2023-41234](https://cve.now/CVE-2023-41234.md): NULL pointer dereference in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable de (CVSS 5.0, Intel(R) Power Gadget software for Windows)
- [CVE-2023-45315](https://cve.now/CVE-2023-45315.md): Improper initialization in some Intel(R) Power Gadget software for Windwos all versions may allow an authenticated user to potentially enabl (CVSS 5.5, Intel(R) Power Gadget software for Windwos)
- [CVE-2023-45846](https://cve.now/CVE-2023-45846.md): Incomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of (CVSS 5.5, Intel(R) Power Gadget software for macOS)
- [CVE-2023-45736](https://cve.now/CVE-2023-45736.md): Insecure inherited permissions in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially ena (CVSS 6.7, Intel(R) Power Gadget software for Windows)
- [CVE-2023-46691](https://cve.now/CVE-2023-46691.md): Use after free in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation o (CVSS 7.9, Intel(R) Power Gadget software for Windows)
- [CVE-2023-42773](https://cve.now/CVE-2023-42773.md): Improper neutralization in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable esc (CVSS 8.8, Intel(R) Power Gadget software for Windows)
- [CVE-2023-38581](https://cve.now/CVE-2023-38581.md): Buffer overflow in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation (CVSS 8.8, Intel(R) Power Gadget software for Windows)
- [CVE-2023-46689](https://cve.now/CVE-2023-46689.md): Improper neutralization in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escal (CVSS 8.8, Intel(R) Power Gadget software for macOS)
- [CVE-2023-40070](https://cve.now/CVE-2023-40070.md): Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable (CVSS 8.8, Intel(R) Power Gadget software for macOS)
- [CVE-2023-45217](https://cve.now/CVE-2023-45217.md): Improper access control in Intel(R) Power Gadget software for Windows all versions may allow an authenticated user to potentially enable esc (CVSS 8.8, Intel(R) Power Gadget software for Windows)
- [CVE-2023-40536](https://cve.now/CVE-2023-40536.md): Race condition for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated user to po (CVSS 4.3, Intel(R) PROSet/Wireless WiFi software for Windows)
- [CVE-2023-38417](https://cve.now/CVE-2023-38417.md): Improper input validation for some Intel(R) PROSet/Wireless WiFi software before version 23.20 may allow an unauthenticated user to potentia (CVSS 4.3, Intel(R) PROSet/Wireless WiFi software)
- [CVE-2023-45845](https://cve.now/CVE-2023-45845.md): Improper conditions check for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.20 may allow a privileged user to p (CVSS 4.4, Intel(R) Wireless Bluetooth(R) products for Windows)
- [CVE-2023-47210](https://cve.now/CVE-2023-47210.md): Improper input validation for some Intel(R) PROSet/Wireless WiFi software for linux before version 23.20 may allow an unauthenticated user t (CVSS 4.7, Intel(R) PROSet/Wireless WiFi software for linux)
- [CVE-2023-47859](https://cve.now/CVE-2023-47859.md): Improper access control for some Intel(R) Wireless Bluetooth products for Windows before version 23.20 may allow an authenticated user to po (CVSS 5.5, Intel(R) Wireless Bluetooth products for Windows)
- [CVE-2023-38654](https://cve.now/CVE-2023-38654.md): Improper input validation for some some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.20 may allow an unauthenticated (CVSS 8.2, some Intel(R) PROSet/Wireless WiFi software for Windows)
- [CVE-2023-47165](https://cve.now/CVE-2023-47165.md): Improper conditions check in the Intel(R) Data Center GPU Max Series 1100 and 1550 products may allow an privileged user to potentially enab (CVSS 6.0, Intel(R) Data Center GPU Max Series 1100 and 1550 products)
- [CVE-2024-21841](https://cve.now/CVE-2024-21841.md): Uncontrolled search path for some Intel(R) Distribution for GDB software before version 2024.0 may allow an authenticated user to potentiall (CVSS 6.7, Intel(R) Distribution for GDB software)
- [CVE-2024-22379](https://cve.now/CVE-2024-22379.md): Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable esc (CVSS 6.7, Intel(R) Inspector software)
- [CVE-2024-21772](https://cve.now/CVE-2024-21772.md): Uncontrolled search path in some Intel(R) Advisor software before version 2024.0 may allow an authenticated user to potentially enable escal (CVSS 6.7, Intel(R) Advisor software)
- [CVE-2024-22390](https://cve.now/CVE-2024-22390.md): Improper input validation in firmware for some Intel(R) FPGA products before version 2.9.1 may allow denial of service. (CVSS 4.4, Intel(R) FPGA products)
- [CVE-2023-49614](https://cve.now/CVE-2023-49614.md): Out of bounds write in firmware for some Intel(R) FPGA products before version 2.9.0 may allow escalation of privilege and information discl (CVSS 5.7, Intel(R) FPGA products)
- [CVE-2023-45733](https://cve.now/CVE-2023-45733.md): Hardware logic contains race conditions in some Intel(R) Processors may allow an authenticated user to potentially enable partial informatio (CVSS 2.8, Intel(R) Processors)
- [CVE-2023-46103](https://cve.now/CVE-2023-46103.md): Sequence of processor instructions leads to unexpected behavior in Intel(R) Core(TM) Ultra Processors may allow an authenticated user to pot (CVSS 4.7, Intel(R) Core(TM) Ultra Processors)
- [CVE-2024-21864](https://cve.now/CVE-2024-21864.md): Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated us (CVSS 7.8, Intel(R) Arc(TM) & Iris(R) Xe Graphics software)
- [CVE-2024-21774](https://cve.now/CVE-2024-21774.md): Uncontrolled search path in some Intel(R) Processor Identification Utility software before versions 6.10.34.1129, 7.1.6 may allow an authent (CVSS 6.7, Intel(R) Processor Identification Utility software)
- [CVE-2024-21862](https://cve.now/CVE-2024-21862.md): Uncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may allow an authenticated u (CVSS 6.7, Intel(R) Quartus(R) Prime Standard Edition Design software)
- [CVE-2024-21777](https://cve.now/CVE-2024-21777.md): Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro Edition Design software before version 23.4 may allow an authenticated user t (CVSS 6.7, Intel(R) Quartus(R) Prime Pro Edition Design software)
- [CVE-2024-21809](https://cve.now/CVE-2024-21809.md): Improper conditions check for some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated use (CVSS 6.7, Intel(R) Quartus(R) Prime Lite Edition Design software)
- [CVE-2024-21837](https://cve.now/CVE-2024-21837.md): Uncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user (CVSS 6.7, Intel(R) Quartus(R) Prime Lite Edition Design software)
- [CVE-2024-21828](https://cve.now/CVE-2024-21828.md): Improper access control in some Intel(R) Ethernet Controller Administrative Tools software before version 28.3 may allow an authenticated us (CVSS 6.7, Intel(R) Ethernet Controller Administrative Tools software)
- [CVE-2024-21843](https://cve.now/CVE-2024-21843.md): Uncontrolled search path for some Intel(R) Computing Improvement Program software before version 2.4.0.10654 may allow an authenticated user (CVSS 6.7, Intel(R) Computing Improvement Program software)
- [CVE-2024-21835](https://cve.now/CVE-2024-21835.md): Insecure inherited permissions in some Intel(R) XTU software before version 7.14.0.15 may allow an authenticated user to potentially enable (CVSS 6.7, Intel(R) XTU software)
- [CVE-2024-21788](https://cve.now/CVE-2024-21788.md): Uncontrolled search path in some Intel(R) GPA software before version 2023.4 may allow an authenticated user to potentially enable escalatio (CVSS 6.7, Intel(R) GPA software)
- [CVE-2024-21861](https://cve.now/CVE-2024-21861.md): Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user to potentially enable (CVSS 6.7, Intel(R) GPA Framework software)
- [CVE-2024-21831](https://cve.now/CVE-2024-21831.md): Uncontrolled search path in some Intel(R) Processor Diagnostic Tool software before version 4.1.9.41 may allow an authenticated user to pote (CVSS 6.7, Intel(R) Processor Diagnostic Tool software)
- [CVE-2023-22662](https://cve.now/CVE-2023-22662.md): Improper input validation of EpsdSrMgmtConfig in UEFI firmware for some Intel(R) Server Board S2600BP products may allow a privileged user t (CVSS 5.8, UEFI firmware for some Intel(R) Server Board S2600BP produc…)
- [CVE-2024-22095](https://cve.now/CVE-2024-22095.md): Improper input validation in PlatformVariableInitDxe driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a pri (CVSS 7.2, UEFI firmware for some Intel(R) Server D50DNP Family produc…)
- [CVE-2024-23980](https://cve.now/CVE-2024-23980.md): Improper buffer restrictions in PlatformPfrDxe driver in UEFI firmware for some Intel(R) Server D50FCP Family products may allow a privilege (CVSS 7.5, UEFI firmware for some Intel(R) Server D50FCP Family produc…)
- [CVE-2024-24981](https://cve.now/CVE-2024-24981.md): Improper input validation in PfrSmiUpdateFw driver in UEFI firmware for some Intel(R) Server M50FCP Family products may allow a privileged u (CVSS 7.5, UEFI firmware for some Intel(R) Server M50FCP Family produc…)
- [CVE-2024-23487](https://cve.now/CVE-2024-23487.md): Improper input validation in UserAuthenticationSmm driver in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privi (CVSS 7.5, UEFI firmware for some Intel(R) Server D50DNP Family produc…)
- [CVE-2024-22382](https://cve.now/CVE-2024-22382.md): Improper input validation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products may allow a privileged us (CVSS 7.5, PprRequestLog module in UEFI firmware for some Intel(R) Ser…)
- [CVE-2024-21823](https://cve.now/CVE-2024-21823.md): Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors (CVSS 7.5, Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th…)
- [CVE-2024-21792](https://cve.now/CVE-2024-21792.md): Time-of-check Time-of-use race condition in Intel(R) Neural Compressor software before version 2.5.0 may allow an authenticated user to pote (CVSS 4.7, Intel(R) Neural Compressor software)
- [CVE-2024-22476](https://cve.now/CVE-2024-22476.md): Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially (CVSS 10.0, Intel(R) Neural Compressor software)
- [CVE-2024-3609](https://cve.now/CVE-2024-3609.md): ReviewX – Multi-criteria Rating & Reviews for WooCommerce \<= 1.6.27 - Missing Authorization (CVSS 4.3, ReviewX – Multi-Criteria Reviews for WooCommerce with Googl…)
- [CVE-2024-2619](https://cve.now/CVE-2024-2619.md): Elementor Header & Footer Builder \<= 1.6.26 - Authenticated (Author+) HTML Injection (CVSS 5.0, brainstormforce Ultimate Addons for Elementor)
- [CVE-2024-4204](https://cve.now/CVE-2024-4204.md): Bulk Posts Editing For WordPress \<= 4.2.3 - Cross-Site Request Forgery (CVSS 4.3, ithemelandco WPBULKiT – Bulk Edit WordPress Posts & Pages)
- [CVE-2024-4733](https://cve.now/CVE-2024-4733.md): ShiftController Employee Shift Scheduling \<= 4.9.57 - Authenticated (Contributor+) PHP Object Injection (CVSS 7.5, plainware ShiftController Employee Shift Scheduling)
- [CVE-2024-31226](https://cve.now/CVE-2024-31226.md): Sunshine's unquoted executable path could lead to hijacked execution flow (CVSS 4.9, LizardByte Sunshine)
- [CVE-2024-5023](https://cve.now/CVE-2024-5023.md): Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCE (CVSS 9.3, Netflix ConsoleMe · consoleme)
- [CVE-2024-1417](https://cve.now/CVE-2024-1417.md): Local Code Injection Vulnerability in AuthPoint Password Manager App for macOS Safari (CVSS 7.8, WatchGuard AuthPoint Password Manager)
- [CVE-2023-47717](https://cve.now/CVE-2023-47717.md): IBM Security Guardium denial of service (CVSS 4.4, IBM Security Guardium)
- [CVE-2024-3286](https://cve.now/CVE-2024-3286.md): A buffer overflow vulnerability was identified in some Lenovo printers that could allow an unauthenticated user to trigger a device restart (CVSS 7.5, Lenovo Printers)
- [CVE-2024-27260](https://cve.now/CVE-2024-27260.md): IBM AIX command execution (CVSS 8.4, IBM AIX)
- [CVE-2023-48643](https://cve.now/CVE-2023-48643.md): Shrubbery tac\_plus 2.x, 3.x. (CVSS 9.8)
- [CVE-2024-34760](https://cve.now/CVE-2024-34760.md): WordPress Magazine Blocks plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPBlockart Magazine Blocks)
- [CVE-2024-34805](https://cve.now/CVE-2024-34805.md): WordPress iframe plugin \<= 5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Webvitaly iFrame)
- [CVE-2024-34751](https://cve.now/CVE-2024-34751.md): WordPress Order Export & Order Import for WooCommerce plugin \<= 2.4.9 - PHP Object Injection vulnerability (CVSS 4.4, WebToffee Order Export & Order Import for WooCommerce)
- [CVE-2024-34808](https://cve.now/CVE-2024-34808.md): WordPress JCH Optimize plugin \<= 4.2.0 - Path Traversal vulnerability (CVSS 4.3, Samuel Marshall JCH Optimize)
- [CVE-2024-4956](https://cve.now/CVE-2024-4956.md): Nexus Repository 3 - Path Traversal (CVSS 7.5, Sonatype Nexus Repository)
- [CVE-2024-3640](https://cve.now/CVE-2024-3640.md): Rockwell Automation FactoryTalk® Remote Access™ has Unquoted Executables (CVSS 7.0, Rockwell Automation FactoryTalk® Remote Access™)
- [CVE-2024-4603](https://cve.now/CVE-2024-4603.md): Excessive time spent checking DSA keys and parameters (CVSS 5.3, OpenSSL)
- [CVE-2024-35187](https://cve.now/CVE-2024-35187.md): Stalwart Mail Server has privilege escalation by design (CVSS 9.1, stalwartlabs mail-server)
- [CVE-2024-34273](https://cve.now/CVE-2024-34273.md): njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method. (CVSS 5.9, njwt)
- [CVE-2024-35185](https://cve.now/CVE-2024-35185.md): Denial of service of Minder Server with attacker-controlled REST endpoint (CVSS 5.3, stacklok minder · github.com/stacklok/minder)
- [CVE-2024-4609](https://cve.now/CVE-2024-4609.md): Rockwell Automation Datalog Function within in FactoryTalk® View SE contains SQL Injection Vulnerability (CVSS 8.8, Rockwell Automation FactoryTalk® View SE)
- [CVE-2024-35176](https://cve.now/CVE-2024-35176.md): REXML contains a denial of service vulnerability (CVSS 5.3, ruby rexml · rexml)
- [CVE-2024-34957](https://cve.now/CVE-2024-34957.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages\_deal.php?mudi=infoSet. (CVSS 5.4)
- [CVE-2024-34958](https://cve.now/CVE-2024-34958.md): idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner\_deal.php?mudi=add (CVSS 6.5)
- [CVE-2024-35039](https://cve.now/CVE-2024-35039.md): idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/tplSys\_deal.php?mudi=area. (CVSS 3.8)
- [CVE-2024-34582](https://cve.now/CVE-2024-34582.md): Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid\_change XSS within the Forgot Password feature. (CVSS 6.1)
- [CVE-2024-34905](https://cve.now/CVE-2024-34905.md): FlyFish v3.0.0 was discovered to contain a buffer overflow via the password parameter on the login page. (CVSS 7.5)
- [CVE-2024-20389](https://cve.now/CVE-2024-20389.md): A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, lo (CVSS 7.8, Cisco ConfD · Cisco Network Services Orchestrator)
- [CVE-2024-20326](https://cve.now/CVE-2024-20326.md): A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, lo (CVSS 7.8, Cisco ConfD · Cisco Network Services Orchestrator)
- [CVE-2024-31142](https://cve.now/CVE-2024-31142.md): x86: Incorrect logic for BTC/SRSO mitigations (CVSS 7.5, Xen)
- [CVE-2023-46842](https://cve.now/CVE-2023-46842.md): x86 HVM hypercalls may trigger Xen bug check (CVSS 6.5, Xen)
- [CVE-2024-4760](https://cve.now/CVE-2024-4760.md): Voltage glitch during startup of the EEFC NVM controller can bypass the security bit (CVSS 6.3, Microchip SAME70 · Microchip SAMS70 +10)
- [CVE-2024-4999](https://cve.now/CVE-2024-4999.md): Ligowave Unity/Pro/Mimo/APC Arbitrary Command Injection (CVSS 9.4, Ligowave UNITY · Ligowave PRO +2)
- [CVE-2024-4826](https://cve.now/CVE-2024-4826.md): SQL injection vulnerability in Simple PHP Shopping Cart (CVSS 9.3, Asaancart Simple PHP Shopping Cart)
- [CVE-2024-4993](https://cve.now/CVE-2024-4993.md): SQL injection vulnerability in SiAdmin (CVSS 6.3, SiAdmin)
- [CVE-2024-4992](https://cve.now/CVE-2024-4992.md): SQL injection vulnerability in SiAdmin (CVSS 9.8, SiAdmin)
- [CVE-2024-4991](https://cve.now/CVE-2024-4991.md): SQL injection vulnerability in SiAdmin (CVSS 9.8, SiAdmin)
- [CVE-2024-30314](https://cve.now/CVE-2024-30314.md): Dreamweaver Desktop | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 7.8, Adobe Dreamweaver Desktop)
- [CVE-2024-4580](https://cve.now/CVE-2024-4580.md): Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor \<= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, litonice13 Master Addons For Elementor – Widgets, Extension…)
- [CVE-2024-30291](https://cve.now/CVE-2024-30291.md): Adobe FrameMaker TIF File parsing Out Of Bound Write (CVSS 7.8, Adobe Framemaker)
- [CVE-2024-30292](https://cve.now/CVE-2024-30292.md): Adobe FrameMaker GIF File parsing Out Of Bound Write (CVSS 7.8, Adobe Framemaker)
- [CVE-2024-30283](https://cve.now/CVE-2024-30283.md): Adobe FrameMaker ICO File Parsing Heap Memory Corruption (CVSS 5.5, Adobe Framemaker)
- [CVE-2024-30290](https://cve.now/CVE-2024-30290.md): Adobe FrameMaker WEBP File Parsing Out Of Bound Write (CVSS 7.8, Adobe Framemaker)
- [CVE-2024-30286](https://cve.now/CVE-2024-30286.md): Adobe FrameMaker DOC File Parsing Memory Corruption (CVSS 5.5, Adobe Framemaker)
- [CVE-2024-30288](https://cve.now/CVE-2024-30288.md): Adobe FrameMaker 3DS File Parsing Heap Memory Corruption (CVSS 7.8, Adobe Framemaker)
- [CVE-2024-30289](https://cve.now/CVE-2024-30289.md): Adobe FrameMaker XLS File Parsing Buffer Overflow (CVSS 7.8, Adobe Framemaker)
- [CVE-2024-30287](https://cve.now/CVE-2024-30287.md): Adobe FrameMaker PDF File Pparsing Out of Bound Read (CVSS 5.5, Adobe Framemaker)
- [CVE-2024-4634](https://cve.now/CVE-2024-4634.md): Elementor Header & Footer Builder \<= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, brainstormforce Ultimate Addons for Elementor)
- [CVE-2024-4400](https://cve.now/CVE-2024-4400.md): Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \<= 1.26.4 - Authenticated (Contributer+) Stored Cross-Site Scripting (CVSS 6.4, Post and Page Builder by BoldGrid – Visual Drag and Drop Ed…)
- [CVE-2024-4288](https://cve.now/CVE-2024-4288.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2024-4385](https://cve.now/CVE-2024-4385.md): Envo Extra \<= 1.8.16 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4, envothemes Envo Extra)
- [CVE-2024-4617](https://cve.now/CVE-2024-4617.md): Rank Math SEO with AI Best SEO Tools \<= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rankmath Rank Math SEO – AI SEO Tools to Dominate SEO Ranki…)
- [CVE-2024-4838](https://cve.now/CVE-2024-4838.md): ConvertPlus \<= 3.5.26 - Authenticated (Contributor+) PHP Object Injection (CVSS 7.5, Brainstorm Force ConvertPlus)
- [CVE-2024-35302](https://cve.now/CVE-2024-35302.md): In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible (CVSS 5.4, JetBrains TeamCity)
- [CVE-2024-35301](https://cve.now/CVE-2024-35301.md): In JetBrains TeamCity before 2024.03.1 commit status publisher didn't check project scope of the GitHub App token (CVSS 5.5, JetBrains TeamCity)
- [CVE-2024-35300](https://cve.now/CVE-2024-35300.md): In JetBrains TeamCity between 2024.03 and 2024.03.1 several stored XSS in the available updates page were possible (CVSS 3.5, JetBrains TeamCity)
- [CVE-2024-35299](https://cve.now/CVE-2024-35299.md): In JetBrains YouTrack before 2024.1.29548 the SMTPS protocol communication lacked proper certificate hostname validation (CVSS 5.9, JetBrains YouTrack)
- [CVE-2024-4975](https://cve.now/CVE-2024-4975.md): code-projects Simple Chat System Message cross site scripting (CVSS 5.3, code-projects Simple Chat System)
- [CVE-2024-4352](https://cve.now/CVE-2024-4352.md): Tutor LMS Pro \<= 2.7.0 - Missing Authorization to SQL Injection (CVSS 8.8, themeum Tutor LMS Pro)
- [CVE-2024-4222](https://cve.now/CVE-2024-4222.md): Tutor LMS Pro \<= 2.7.0 - Missing Authorization (CVSS 7.3, themeum Tutor LMS Pro)
- [CVE-2024-4351](https://cve.now/CVE-2024-4351.md): Tutor LMS Pro \<= 2.7.0 - Missing Authorization to Privilege Escalation (CVSS 8.8, themeum Tutor LMS Pro)
- [CVE-2024-4974](https://cve.now/CVE-2024-4974.md): code-projects Simple Chat System register.php cross site scripting (CVSS 5.3, code-projects Simple Chat System)
- [CVE-2024-4973](https://cve.now/CVE-2024-4973.md): code-projects Simple Chat System register.php sql injection (CVSS 5.3, code-projects Simple Chat System)
- [CVE-2024-2361](https://cve.now/CVE-2024-2361.md): Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui (CVSS 9.6, parisneo/lollms-webui)
- [CVE-2024-2366](https://cve.now/CVE-2024-2366.md): Remote Code Execution in parisneo/lollms-webui (CVSS 9.0, parisneo/lollms-webui)
- [CVE-2024-4078](https://cve.now/CVE-2024-4078.md): Arbitrary Code Execution in parisneo/lollms (CVSS 9.8, parisneo/lollms · lollms)
- [CVE-2024-3435](https://cve.now/CVE-2024-3435.md): Path Traversal in parisneo/lollms-webui (CVSS 8.4, parisneo/lollms-webui)
- [CVE-2024-4263](https://cve.now/CVE-2024-4263.md): Improper Access Control in mlflow/mlflow (CVSS 5.4, mlflow/mlflow · mlflow)
- [CVE-2024-3126](https://cve.now/CVE-2024-3126.md): Command Injection in parisneo/lollms-webui (CVSS 8.4, parisneo/lollms-webui)
- [CVE-2024-3403](https://cve.now/CVE-2024-3403.md): Local File Inclusion in imartinez/privategpt (CVSS 7.5, imartinez/privategpt)
- [CVE-2024-4181](https://cve.now/CVE-2024-4181.md): Command Injection in run-llama/llama\_index (CVSS 8.8, run-llama/llama\_index · llama-index +1)
- [CVE-2024-4326](https://cve.now/CVE-2024-4326.md): Remote Code Execution via \`/apply\_settings\` and \`/execute\_code\` in parisneo/lollms-webui (CVSS 9.8, parisneo/lollms-webui)
- [CVE-2024-3848](https://cve.now/CVE-2024-3848.md): Path Traversal Bypass in mlflow/mlflow (CVSS 7.5, mlflow/mlflow · mlflow)
- [CVE-2024-4321](https://cve.now/CVE-2024-4321.md): Local File Inclusion (LFI) in gaizhenbiao/chuanhuchatgpt (CVSS 7.5, gaizhenbiao/chuanhuchatgpt · chuanhuchatgpt)
- [CVE-2024-4322](https://cve.now/CVE-2024-4322.md): Path Traversal in parisneo/lollms-webui (CVSS 7.5, parisneo/lollms-webui)
- [CVE-2024-2358](https://cve.now/CVE-2024-2358.md): Path Traversal leading to Remote Code Execution in parisneo/lollms-webui (CVSS 9.8, parisneo/lollms-webui)
- [CVE-2024-3851](https://cve.now/CVE-2024-3851.md): Unrestricted File Upload Leading to XSS in imartinez/privategpt (CVSS 6.8, imartinez/privategpt)
- [CVE-2024-4972](https://cve.now/CVE-2024-4972.md): code-projects Simple Chat System login.php sql injection (CVSS 5.3, code-projects Simple Chat System)
- [CVE-2024-30295](https://cve.now/CVE-2024-30295.md): When Animate parses FLA files, there is a UAF vulnerability caused by referencing uninitialized memory at Animate.exe+0x1149dcf (CVSS 7.8, Adobe Animate)
- [CVE-2024-30296](https://cve.now/CVE-2024-30296.md): When Animate parses FLA files, there is an out-of-bounds write vulnerability at animate+0x123df28 (CVSS 7.8, Adobe Animate)
- [CVE-2024-30294](https://cve.now/CVE-2024-30294.md): Adobe Animate OGG File Parsing Heap Memory Corruption remote code execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2024-30298](https://cve.now/CVE-2024-30298.md): Adobe Animate SWF File Parsing Memory corruption (CVSS 5.5, Adobe Animate)
- [CVE-2024-30297](https://cve.now/CVE-2024-30297.md): When Adobe Animate parses FLA files, there is a heap out-of-bounds write vulnerability at Animate.exe+0x125D391 (CVSS 7.8, Adobe Animate)
- [CVE-2024-30293](https://cve.now/CVE-2024-30293.md): Adobe Animate 2024 AI File parsing Stack base buffer overflow Remote Code execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2024-30282](https://cve.now/CVE-2024-30282.md): Adobe Animate 2024 Out of Bound Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2024-30281](https://cve.now/CVE-2024-30281.md): Substance3D - Designer | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Designer)
- [CVE-2024-30275](https://cve.now/CVE-2024-30275.md): Adobe Aero Beta has an arbitrary code execution vulnerability when parsing svg files (CVSS 7.8, Adobe Aero Desktop)
- [CVE-2024-4391](https://cve.now/CVE-2024-4391.md): Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS \<= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-4223](https://cve.now/CVE-2024-4223.md): Tutor LMS \<= 2.7.0 - Missing Authorization (CVSS 9.8, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-3887](https://cve.now/CVE-2024-3887.md): Royal Elementor Addons and Templates \<= 1.3.974 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget (CVSS 5.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-4968](https://cve.now/CVE-2024-4968.md): SourceCodester Interactive Map with Marker Add Marker Marker Name cross site scripting (CVSS 5.3, SourceCodester Interactive Map with Marker)
- [CVE-2024-4967](https://cve.now/CVE-2024-4967.md): SourceCodester Interactive Map with Marker delete-mark.php sql injection (CVSS 5.3, SourceCodester Interactive Map with Marker)
- [CVE-2024-30307](https://cve.now/CVE-2024-30307.md): Adobe Substance 3D Painter BMP File Parsing Out Of Bounds Write Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-30308](https://cve.now/CVE-2024-30308.md): Adobe Substance 3D Painter PSD File Parsing Acces Violation Read Vulnerability (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-30274](https://cve.now/CVE-2024-30274.md): Adobe Substance 3D Painter ABC File Parsing An Out-Of-Bounds Write Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-30309](https://cve.now/CVE-2024-30309.md): Adobe Substance 3D Painter TGA File Parsing Acces Violation Read Vulnerability (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-20791](https://cve.now/CVE-2024-20791.md): Illustrator 2024 BMP File Parsing Memory Corruption (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-20793](https://cve.now/CVE-2024-20793.md): Illustrator 2024 TIF file parsing Out Of Bound Read Information disclosure vulnerability (CVSS 5.5, Adobe Illustrator)
- [CVE-2024-20792](https://cve.now/CVE-2024-20792.md): Adobe Illustrator TIF File Parsing Use-After-Free Remote memory corruption (CVSS 7.8, Adobe Illustrator)
- [CVE-2024-4966](https://cve.now/CVE-2024-4966.md): SourceCodester SchoolWebTech home.php unrestricted upload (CVSS 6.9, SourceCodester SchoolWebTech)
- [CVE-2024-4546](https://cve.now/CVE-2024-4546.md): Custom Post Type Attachment \<= 3.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pdf\_attachment Shortcode (CVSS 6.4, avimegladon Custom Post Type Attachment)
- [CVE-2024-4478](https://cve.now/CVE-2024-4478.md): Happy Addons for Elementor \<= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget (CVSS 6.4, thehappymonster Happy Addons for Elementor)
- [CVE-2024-4965](https://cve.now/CVE-2024-4965.md): D-Link DAR-7000-40 resmanage.php os command injection (CVSS 5.3, D-Link DAR-7000-40)
- [CVE-2024-4964](https://cve.now/CVE-2024-4964.md): D-Link DAR-7000-40 urlblist.php unrestricted upload (CVSS 5.3, D-Link DAR-7000-40)
- [CVE-2024-4963](https://cve.now/CVE-2024-4963.md): D-Link DAR-7000-40 url.php unrestricted upload (CVSS 5.3, D-Link DAR-7000-40)
- [CVE-2024-4962](https://cve.now/CVE-2024-4962.md): D-Link DAR-7000-40 resmanage.php unrestricted upload (CVSS 5.3, D-Link DAR-7000-40)
- [CVE-2024-4844](https://cve.now/CVE-2024-4844.md): Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacke (CVSS 7.5, Trellix ePolicy Orchestrator)
- [CVE-2024-4843](https://cve.now/CVE-2024-4843.md): ePO doesn't allow a regular privileged user to delete tasks or assignments. (CVSS 4.3, Trellix ePolicy Orchestrator)
- [CVE-2024-4961](https://cve.now/CVE-2024-4961.md): D-Link DAR-7000-40 onlineuser.php unrestricted upload (CVSS 5.3, D-Link DAR-7000-40)
- [CVE-2024-3644](https://cve.now/CVE-2024-3644.md): Newsletter Popup \<= 1.2 - Admin+ Stored XSS (CVSS 4.8, Newsletter Popup)
- [CVE-2024-3643](https://cve.now/CVE-2024-3643.md): Newsletter Popup \<= 1.2 - List Deletion via CSRF (CVSS 8.8, Newsletter Popup)
- [CVE-2024-3642](https://cve.now/CVE-2024-3642.md): Newsletter Popup \<= 1.2 - Subscriber Deletion via CSRF (CVSS 6.9, Newsletter Popup)
- [CVE-2024-3641](https://cve.now/CVE-2024-3641.md): Newsletter Popup \<= 1.2 - Unauthenticated Stored XSS (CVSS 6.1, Newsletter Popup)
- [CVE-2024-4318](https://cve.now/CVE-2024-4318.md): Tutor LMS \<= 2.7.0 - Authenticated (Instructor+) SQL Injection (CVSS 8.8, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-4635](https://cve.now/CVE-2024-4635.md): Menu Icons by ThemeIsle \<= 0.13.13 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (CVSS 6.4, Menu Icons by ThemeIsle)
- [CVE-2024-4279](https://cve.now/CVE-2024-4279.md): Tutor LMS – eLearning and online course solution \<= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion (CVSS 6.5, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-4960](https://cve.now/CVE-2024-4960.md): D-Link DAR-7000-40 licenseauthorization.php unrestricted upload (CVSS 5.3, D-Link DAR-7000-40)
- [CVE-2024-4946](https://cve.now/CVE-2024-4946.md): SourceCodester Online Art Gallery Management System adminHome.php unrestricted upload (CVSS 5.3, SourceCodester Online Art Gallery Management System)
- [CVE-2024-4945](https://cve.now/CVE-2024-4945.md): SourceCodester Best Courier Management System view\_parcel.php unrestricted upload (CVSS 5.3, SourceCodester Best Courier Management System)
- [CVE-2024-4933](https://cve.now/CVE-2024-4933.md): SourceCodester Simple Online Bidding System sql injection (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-4932](https://cve.now/CVE-2024-4932.md): SourceCodester Simple Online Bidding System sql injection (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-4931](https://cve.now/CVE-2024-4931.md): SourceCodester Simple Online Bidding System sql injection (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-4930](https://cve.now/CVE-2024-4930.md): SourceCodester Simple Online Bidding System sql injection (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-4929](https://cve.now/CVE-2024-4929.md): SourceCodester Simple Online Bidding System cross-site request forgery (CVSS 6.9, SourceCodester Simple Online Bidding System)
- [CVE-2024-4928](https://cve.now/CVE-2024-4928.md): SourceCodester Simple Online Bidding System sql injection (CVSS 5.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-3750](https://cve.now/CVE-2024-3750.md): Visualizer: Tables and Charts Manager for WordPress \<= 3.10.15 - Missing Authorization to Arbitrary SQL Execution (CVSS 8.8, themeisle Visualizer: Tables and Charts Manager for WordPre…)
- [CVE-2024-4927](https://cve.now/CVE-2024-4927.md): SourceCodester Simple Online Bidding System unrestricted upload (CVSS 6.9, SourceCodester Simple Online Bidding System)
- [CVE-2024-4984](https://cve.now/CVE-2024-4984.md): Yoast SEO \<= 22.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Yoast SEO – Advanced SEO with real-time guidance and built-…)
- [CVE-2024-4926](https://cve.now/CVE-2024-4926.md): SourceCodester School Intramurals Student Attendance Management System manage\_student.php sql injection (CVSS 5.3, SourceCodester School Intramurals Student Attendance Manage…)
- [CVE-2024-4925](https://cve.now/CVE-2024-4925.md): SourceCodester School Intramurals Student Attendance Management System manage\_course.php sql injection (CVSS 5.3, SourceCodester School Intramurals Student Attendance Manage…)
- [CVE-2024-4923](https://cve.now/CVE-2024-4923.md): Codezips E-Commerce Site addproduct.php unrestricted upload (CVSS 5.3, Codezips E-Commerce Site)
- [CVE-2024-4922](https://cve.now/CVE-2024-4922.md): SourceCodester Simple Image Stack Website cross site scripting (CVSS 5.3, SourceCodester Simple Image Stack Website)
- [CVE-2024-4921](https://cve.now/CVE-2024-4921.md): SourceCodester Employee and Visitor Gate Pass Logging System unrestricted upload (CVSS 5.3, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2024-4920](https://cve.now/CVE-2024-4920.md): SourceCodester Online Discussion Forum Site registerH.php unrestricted upload (CVSS 6.9, SourceCodester Online Discussion Forum Site)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.