# CVEs published 2024-05-17

321 CVEs were published on May 17, 2024: 30 critical, 127 high. Days are UTC.

- [CVE-2024-23556](https://cve.now/CVE-2024-23556.md): HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiation (CVSS 5.9, HCL Software BigFix Platform)
- [CVE-2024-23554](https://cve.now/CVE-2024-23554.md): HCL BigFix Platform is susceptible to Cross-Site Request Forgery (CVSS 5.7, HCL Software BigFix Platform)
- [CVE-2024-23583](https://cve.now/CVE-2024-23583.md): HCL BigFix Platform is susceptible to insufficiently protected credentials (CVSS 6.7, HCL Software BigFix Platform)
- [CVE-2024-35313](https://cve.now/CVE-2024-35313.md): In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004. (CVSS 7.3, tor-circmgr · arti)
- [CVE-2024-35312](https://cve.now/CVE-2024-35312.md): In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003. (CVSS 6.2, tor-circmgr · arti)
- [CVE-2024-25742](https://cve.now/CVE-2024-25742.md): In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handl (CVSS 6.5)
- [CVE-2024-5069](https://cve.now/CVE-2024-5069.md): SourceCodester Simple Online Mens Salon Management System view\_service.php sql injection (CVSS 5.3, SourceCodester Simple Online Mens Salon Management System)
- [CVE-2023-52424](https://cve.now/CVE-2023-52424.md): The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WE (CVSS 7.4)
- [CVE-2024-5066](https://cve.now/CVE-2024-5066.md): PHPGurukul Online Course Registration System pincode-verification.php sql injection (CVSS 5.3, PHPGurukul Online Course Registration System)
- [CVE-2024-5065](https://cve.now/CVE-2024-5065.md): PHPGurukul Online Course Registration System sql injection (CVSS 6.9, PHPGurukul Online Course Registration System)
- [CVE-2024-34959](https://cve.now/CVE-2024-34959.md): DedeCMS V5.7.113 is vulnerable to Cross Site Scripting (XSS) via sys\_data\_replace.php. (CVSS 5.5)
- [CVE-2024-5022](https://cve.now/CVE-2024-5022.md): The file scheme of URLs would be hidden, resulting in potential spoofing of a website's address in the location bar This vulnerability affec (CVSS 4.4, Mozilla Focus for iOS)
- [CVE-2021-22508](https://cve.now/CVE-2021-22508.md): Potential SQL injection in OpenText Operations Bridge Reporter (CVSS 7.2, OpenText Operations Bridge Reporter)
- [CVE-2024-5064](https://cve.now/CVE-2024-5064.md): PHPGurukul Online Course Registration System news-details.php sql injection (CVSS 6.9, PHPGurukul Online Course Registration System)
- [CVE-2024-5063](https://cve.now/CVE-2024-5063.md): PHPGurukul Online Course Registration System index.php sql injection (CVSS 6.9, PHPGurukul Online Course Registration System)
- [CVE-2024-3292](https://cve.now/CVE-2024-3292.md): Race Condition (CVSS 8.2, Tenable Nessus Agent)
- [CVE-2024-3291](https://cve.now/CVE-2024-3291.md): Privilege Escalation (CVSS 7.8, Tenable Nessus Agent)
- [CVE-2024-35190](https://cve.now/CVE-2024-35190.md): Asterisk' res\_pjsip\_endpoint\_identifier\_ip: wrongly matches ALL unauthorized SIP requests (CVSS 5.8, asterisk)
- [CVE-2023-5597](https://cve.now/CVE-2023-5597.md): Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x (CVSS 5.4, Dassault Systèmes 3DSwymer)
- [CVE-2024-3290](https://cve.now/CVE-2024-3290.md): Race Condition (CVSS 8.2, Tenable Nessus)
- [CVE-2024-3289](https://cve.now/CVE-2024-3289.md): When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce sec (CVSS 7.8, Tenable Nessus)
- [CVE-2024-31974](https://cve.now/CVE-2024-31974.md): The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute (CVSS 6.3)
- [CVE-2024-22429](https://cve.now/CVE-2024-22429.md): Dell BIOS contains an Improper Input Validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2024-5072](https://cve.now/CVE-2024-5072.md): Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with acces (CVSS 6.5, Devolutions Server)
- [CVE-2024-34241](https://cve.now/CVE-2024-34241.md): A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admi (CVSS 4.8)
- [CVE-2024-35859](https://cve.now/CVE-2024-35859.md): block: fix module reference leakage from bdev\_open\_by\_dev error path (CVSS 5.5, Linux)
- [CVE-2024-35858](https://cve.now/CVE-2024-35858.md): net: bcmasp: fix memory leak when bringing down interface (CVSS 7.8, Linux)
- [CVE-2024-35857](https://cve.now/CVE-2024-35857.md): icmp: prevent possible NULL dereferences from icmp\_build\_probe() (CVSS 7.5, Linux)
- [CVE-2024-35856](https://cve.now/CVE-2024-35856.md): Bluetooth: btusb: mediatek: Fix double free of skb in coredump (CVSS 8.8, Linux)
- [CVE-2024-35855](https://cve.now/CVE-2024-35855.md): mlxsw: spectrum\_acl\_tcam: Fix possible use-after-free during activity update (CVSS 7.8, Linux)
- [CVE-2024-35854](https://cve.now/CVE-2024-35854.md): mlxsw: spectrum\_acl\_tcam: Fix possible use-after-free during rehash (CVSS 7.8, Linux)
- [CVE-2024-35853](https://cve.now/CVE-2024-35853.md): mlxsw: spectrum\_acl\_tcam: Fix memory leak during rehash (CVSS 6.4, Linux)
- [CVE-2024-35852](https://cve.now/CVE-2024-35852.md): mlxsw: spectrum\_acl\_tcam: Fix memory leak when canceling rehash work (no CVSS, Linux)
- [CVE-2024-35851](https://cve.now/CVE-2024-35851.md): Bluetooth: qca: fix NULL-deref on non-serdev suspend (no CVSS, Linux)
- [CVE-2024-35850](https://cve.now/CVE-2024-35850.md): Bluetooth: qca: fix NULL-deref on non-serdev setup (no CVSS, Linux)
- [CVE-2024-35849](https://cve.now/CVE-2024-35849.md): btrfs: fix information leak in btrfs\_ioctl\_logical\_to\_ino() (no CVSS, Linux)
- [CVE-2024-35848](https://cve.now/CVE-2024-35848.md): eeprom: at24: fix memory corruption race condition (CVSS 7.0, Linux)
- [CVE-2024-35847](https://cve.now/CVE-2024-35847.md): irqchip/gic-v3-its: Prevent double free on error (CVSS 7.8, Linux)
- [CVE-2024-35846](https://cve.now/CVE-2024-35846.md): mm: zswap: fix shrinker NULL crash with cgroup\_disable=memory (no CVSS, Linux)
- [CVE-2024-35845](https://cve.now/CVE-2024-35845.md): wifi: iwlwifi: dbg-tlv: ensure NUL termination (CVSS 9.1, Linux)
- [CVE-2024-35844](https://cve.now/CVE-2024-35844.md): f2fs: compress: fix reserve\_cblocks counting error when out of space (no CVSS, Linux)
- [CVE-2024-35843](https://cve.now/CVE-2024-35843.md): iommu/vt-d: Use device rbtree in iopf reporting path (CVSS 8.8, Linux)
- [CVE-2024-5051](https://cve.now/CVE-2024-5051.md): SourceCodester Gas Agency Management System edituser.php sql injection (CVSS 5.3, SourceCodester Gas Agency Management System)
- [CVE-2024-35842](https://cve.now/CVE-2024-35842.md): ASoC: mediatek: sof-common: Add NULL check for normal\_link string (no CVSS, Linux)
- [CVE-2024-35841](https://cve.now/CVE-2024-35841.md): net: tls, fix WARNIING in \_\_sk\_msg\_free (no CVSS, Linux)
- [CVE-2024-35840](https://cve.now/CVE-2024-35840.md): mptcp: use OPTION\_MPTCP\_MPJ\_SYNACK in subflow\_finish\_connect() (no CVSS, Linux)
- [CVE-2024-35839](https://cve.now/CVE-2024-35839.md): netfilter: bridge: replace physindev with physinif in nf\_bridge\_info (CVSS 7.8, Linux)
- [CVE-2023-52698](https://cve.now/CVE-2023-52698.md): calipso: fix memory leak in netlbl\_calipso\_add\_pass() (no CVSS, Linux)
- [CVE-2023-52697](https://cve.now/CVE-2023-52697.md): ASoC: Intel: sof\_sdw\_rt\_sdca\_jack\_common: ctx-\>headset\_codec\_dev = NULL (no CVSS, Linux)
- [CVE-2023-52696](https://cve.now/CVE-2023-52696.md): powerpc/powernv: Add a null pointer check in opal\_powercap\_init() (CVSS 7.5, Linux)
- [CVE-2023-52695](https://cve.now/CVE-2023-52695.md): drm/amd/display: Check writeback connectors in create\_validate\_stream\_for\_sink (no CVSS, Linux)
- [CVE-2023-52694](https://cve.now/CVE-2023-52694.md): drm/bridge: tpd12s015: Drop buggy \_\_exit annotation for remove function (no CVSS, Linux)
- [CVE-2023-52693](https://cve.now/CVE-2023-52693.md): ACPI: video: check for error while searching for backlight device parent (no CVSS, Linux)
- [CVE-2023-52692](https://cve.now/CVE-2023-52692.md): ALSA: scarlett2: Add missing error check to scarlett2\_usb\_set\_config() (no CVSS, Linux)
- [CVE-2023-52691](https://cve.now/CVE-2023-52691.md): drm/amd/pm: fix a double-free in si\_dpm\_init (CVSS 7.8, Linux)
- [CVE-2023-52690](https://cve.now/CVE-2023-52690.md): powerpc/powernv: Add a null pointer check to scom\_debug\_init\_one() (no CVSS, Linux)
- [CVE-2023-52689](https://cve.now/CVE-2023-52689.md): ALSA: scarlett2: Add missing mutex lock around get meter levels (no CVSS, Linux)
- [CVE-2023-52688](https://cve.now/CVE-2023-52688.md): wifi: ath12k: fix the error handler of rfkill config (CVSS 7.8, Linux)
- [CVE-2023-52687](https://cve.now/CVE-2023-52687.md): crypto: safexcel - Add error handling for dma\_map\_sg() calls (CVSS 9.8, Linux)
- [CVE-2023-52686](https://cve.now/CVE-2023-52686.md): powerpc/powernv: Add a null pointer check in opal\_event\_init() (no CVSS, Linux)
- [CVE-2023-52684](https://cve.now/CVE-2023-52684.md): firmware: qcom: qseecom: fix memory leaks in error paths (CVSS 5.5, Linux)
- [CVE-2023-52683](https://cve.now/CVE-2023-52683.md): ACPI: LPIT: Avoid u32 multiplication overflow (no CVSS, Linux)
- [CVE-2023-52682](https://cve.now/CVE-2023-52682.md): f2fs: fix to wait on block writeback for post\_read case (no CVSS, Linux)
- [CVE-2023-52681](https://cve.now/CVE-2023-52681.md): efivarfs: Free s\_fs\_info on unmount (no CVSS, Linux)
- [CVE-2023-52680](https://cve.now/CVE-2023-52680.md): ALSA: scarlett2: Add missing error checks to \*\_ctl\_get() (no CVSS, Linux)
- [CVE-2023-52679](https://cve.now/CVE-2023-52679.md): of: Fix double free in of\_parse\_phandle\_with\_args\_map (CVSS 7.8, Linux)
- [CVE-2023-52678](https://cve.now/CVE-2023-52678.md): drm/amdkfd: Confirm list is non-empty before utilizing list\_first\_entry in kfd\_topology.c (CVSS 7.8, Linux)
- [CVE-2023-52677](https://cve.now/CVE-2023-52677.md): riscv: Check if the code to patch lies in the exit section (no CVSS, Linux)
- [CVE-2023-52676](https://cve.now/CVE-2023-52676.md): bpf: Guard stack limits against 32bit overflow (CVSS 7.8, Linux)
- [CVE-2023-52675](https://cve.now/CVE-2023-52675.md): powerpc/imc-pmu: Add a null pointer check in update\_events\_in\_group() (no CVSS, Linux)
- [CVE-2023-52674](https://cve.now/CVE-2023-52674.md): ALSA: scarlett2: Add clamp() in scarlett2\_mixer\_ctl\_put() (CVSS 5.5, Linux)
- [CVE-2024-35838](https://cve.now/CVE-2024-35838.md): wifi: mac80211: fix potential sta-link leak (no CVSS, Linux)
- [CVE-2024-35837](https://cve.now/CVE-2024-35837.md): net: mvpp2: clear BM pool before initialization (no CVSS, Linux)
- [CVE-2024-35836](https://cve.now/CVE-2024-35836.md): dpll: fix pin dump crash for rebound module (no CVSS, Linux)
- [CVE-2024-35835](https://cve.now/CVE-2024-35835.md): net/mlx5e: fix a double-free in arfs\_create\_groups (CVSS 7.8, Linux)
- [CVE-2024-35834](https://cve.now/CVE-2024-35834.md): xsk: recycle buffer in case Rx queue was full (CVSS 8.2, Linux)
- [CVE-2023-52673](https://cve.now/CVE-2023-52673.md): drm/amd/display: Fix a debugfs null pointer error (CVSS 5.5, Linux)
- [CVE-2023-52672](https://cve.now/CVE-2023-52672.md): pipe: wakeup wr\_wait after setting max\_usage (CVSS 7.0, Linux)
- [CVE-2023-52671](https://cve.now/CVE-2023-52671.md): drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 (no CVSS, Linux)
- [CVE-2023-52670](https://cve.now/CVE-2023-52670.md): rpmsg: virtio: Free driver\_override when rpmsg\_remove() (CVSS 6.6, Linux)
- [CVE-2023-52669](https://cve.now/CVE-2023-52669.md): crypto: s390/aes - Fix buffer overread in CTR mode (CVSS 8.2, Linux)
- [CVE-2023-52668](https://cve.now/CVE-2023-52668.md): btrfs: zoned: fix lock ordering in btrfs\_zone\_activate() (no CVSS, Linux)
- [CVE-2023-52667](https://cve.now/CVE-2023-52667.md): net/mlx5e: fix a potential double-free in fs\_any\_create\_groups (CVSS 7.8, Linux)
- [CVE-2024-5050](https://cve.now/CVE-2024-5050.md): Wangshen SecGate 3600 ?g=log\_import\_save unrestricted upload (CVSS 5.3, Wangshen SecGate)
- [CVE-2024-5049](https://cve.now/CVE-2024-5049.md): Codezips E-Commerce Site editproduct.php unrestricted upload (CVSS 5.3, Codezips E-Commerce Site)
- [CVE-2024-35833](https://cve.now/CVE-2024-35833.md): dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA (CVSS 5.5, Linux)
- [CVE-2024-35832](https://cve.now/CVE-2024-35832.md): bcachefs: kvfree bch\_fs::snapshots in bch2\_fs\_snapshots\_exit (no CVSS, Linux)
- [CVE-2023-52664](https://cve.now/CVE-2023-52664.md): net: atlantic: eliminate double free in error handling logic (CVSS 7.8, Linux)
- [CVE-2024-34919](https://cve.now/CVE-2024-34919.md): An arbitrary file upload vulnerability in the component \\modstudent\\controller.php of Pisay Online E-Learning System using PHP/MySQL v1.0 al (CVSS 9.8)
- [CVE-2024-34982](https://cve.now/CVE-2024-34982.md): An arbitrary file upload vulnerability in the component /include/file.php of lylme\_spage v1.9.5 allows attackers to execute arbitrary code v (CVSS 9.8)
- [CVE-2024-35831](https://cve.now/CVE-2024-35831.md): io\_uring: Fix release of pinned pages when \_\_io\_uaddr\_map fails (no CVSS, Linux)
- [CVE-2024-35830](https://cve.now/CVE-2024-35830.md): media: tc358743: register v4l2 async device only after successful setup (CVSS 7.8, Linux)
- [CVE-2024-35829](https://cve.now/CVE-2024-35829.md): drm/lima: fix a memleak in lima\_heap\_alloc (CVSS 5.5, Linux)
- [CVE-2024-35828](https://cve.now/CVE-2024-35828.md): wifi: libertas: fix some memleaks in lbs\_allocate\_cmd\_buffer() (no CVSS, Linux)
- [CVE-2024-35827](https://cve.now/CVE-2024-35827.md): io\_uring/net: fix overflow check in io\_recvmsg\_mshot\_prep() (CVSS 7.8, Linux)
- [CVE-2023-52663](https://cve.now/CVE-2023-52663.md): ASoC: SOF: amd: Fix memory leak in amd\_sof\_acp\_probe() (no CVSS, Linux)
- [CVE-2023-52662](https://cve.now/CVE-2023-52662.md): drm/vmwgfx: fix a memleak in vmw\_gmrid\_man\_get\_node (CVSS 7.8, Linux)
- [CVE-2023-52661](https://cve.now/CVE-2023-52661.md): drm/tegra: rgb: Fix missing clk\_put() in the error handling paths of tegra\_dc\_rgb\_probe() (no CVSS, Linux)
- [CVE-2024-5048](https://cve.now/CVE-2024-5048.md): code-projects Budget Management index.php sql injection (CVSS 5.3, code-projects Budget Management)
- [CVE-2024-5047](https://cve.now/CVE-2024-5047.md): SourceCodester Student Management System controller.php unrestricted upload (CVSS 6.9, SourceCodester Student Management System)
- [CVE-2024-35826](https://cve.now/CVE-2024-35826.md): block: Fix page refcounts for unaligned buffers in \_\_bio\_release\_pages() (no CVSS, Linux)
- [CVE-2024-35825](https://cve.now/CVE-2024-35825.md): usb: gadget: ncm: Fix handling of zero block length packets (no CVSS, Linux)
- [CVE-2024-35824](https://cve.now/CVE-2024-35824.md): misc: lis3lv02d\_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (CVSS 5.5, Linux)
- [CVE-2024-35823](https://cve.now/CVE-2024-35823.md): vt: fix unicode buffer corruption when deleting characters (CVSS 5.3, Linux)
- [CVE-2024-35822](https://cve.now/CVE-2024-35822.md): usb: udc: remove warning when queue disabled ep (no CVSS, Linux)
- [CVE-2024-35821](https://cve.now/CVE-2024-35821.md): ubifs: Set page uptodate in the correct place (CVSS 7.5, Linux)
- [CVE-2024-35819](https://cve.now/CVE-2024-35819.md): soc: fsl: qbman: Use raw spinlock for cgr\_lock (no CVSS, Linux)
- [CVE-2024-35818](https://cve.now/CVE-2024-35818.md): LoongArch: Define the \_\_io\_aw() hook as mmiowb() (no CVSS, Linux)
- [CVE-2024-35817](https://cve.now/CVE-2024-35817.md): drm/amdgpu: amdgpu\_ttm\_gart\_bind set gtt bound flag (CVSS 7.8, Linux)
- [CVE-2024-35816](https://cve.now/CVE-2024-35816.md): firewire: ohci: prevent leak of left-over IRQ on unbind (no CVSS, Linux)
- [CVE-2024-35815](https://cve.now/CVE-2024-35815.md): fs/aio: Check IOCB\_AIO\_RW before the struct aio\_kiocb conversion (no CVSS, Linux)
- [CVE-2024-35814](https://cve.now/CVE-2024-35814.md): swiotlb: Fix double-allocation of slots due to broken alignment handling (CVSS 7.8, Linux)
- [CVE-2024-35813](https://cve.now/CVE-2024-35813.md): mmc: core: Avoid negative index with array access (CVSS 7.8, Linux)
- [CVE-2024-35811](https://cve.now/CVE-2024-35811.md): wifi: brcmfmac: Fix use-after-free bug in brcmf\_cfg80211\_detach (CVSS 8.8, Linux)
- [CVE-2024-35810](https://cve.now/CVE-2024-35810.md): drm/vmwgfx: Fix the lifetime of the bo cursor memory (CVSS 7.8, Linux)
- [CVE-2024-35809](https://cve.now/CVE-2024-35809.md): PCI/PM: Drain runtime-idle callbacks before driver removal (CVSS 5.5, Linux)
- [CVE-2024-35808](https://cve.now/CVE-2024-35808.md): md/dm-raid: don't call md\_reap\_sync\_thread() directly (CVSS 7.8, Linux)
- [CVE-2024-35807](https://cve.now/CVE-2024-35807.md): ext4: fix corruption during on-line resize (no CVSS, Linux)
- [CVE-2024-35806](https://cve.now/CVE-2024-35806.md): soc: fsl: qbman: Always disable interrupts when taking cgr\_lock (no CVSS, Linux)
- [CVE-2024-35805](https://cve.now/CVE-2024-35805.md): dm snapshot: fix lockup in dm\_exception\_table\_exit (no CVSS, Linux)
- [CVE-2024-35804](https://cve.now/CVE-2024-35804.md): KVM: x86: Mark target gfn of emulated atomic instruction as dirty (CVSS 8.8, Linux)
- [CVE-2024-35803](https://cve.now/CVE-2024-35803.md): x86/efistub: Call mixed mode boot services on the firmware's stack (no CVSS, Linux)
- [CVE-2024-35801](https://cve.now/CVE-2024-35801.md): x86/fpu: Keep xfd\_state in sync with MSR\_IA32\_XFD (CVSS 7.8, Linux)
- [CVE-2024-35800](https://cve.now/CVE-2024-35800.md): efi: fix panic in kdump kernel (no CVSS, Linux)
- [CVE-2024-35799](https://cve.now/CVE-2024-35799.md): drm/amd/display: Prevent crash when disable stream (CVSS 6.2, Linux)
- [CVE-2024-35798](https://cve.now/CVE-2024-35798.md): btrfs: fix race in read\_extent\_buffer\_pages() (CVSS 7.8, Linux)
- [CVE-2024-35797](https://cve.now/CVE-2024-35797.md): mm: cachestat: fix two shmem bugs (CVSS 7.1, Linux)
- [CVE-2024-35796](https://cve.now/CVE-2024-35796.md): net: ll\_temac: platform\_get\_resource replaced by wrong function (CVSS 5.5, Linux)
- [CVE-2024-35795](https://cve.now/CVE-2024-35795.md): drm/amdgpu: fix deadlock while reading mqd from debugfs (no CVSS, Linux)
- [CVE-2024-5042](https://cve.now/CVE-2024-5042.md): Submariner-operator: rbac permissions can allow for the spread of node compromises (CVSS 6.6, submariner-operator · Red Hat RHODF-4.16-RHEL-9 +3)
- [CVE-2024-5046](https://cve.now/CVE-2024-5046.md): SourceCodester Online Examination System registeracc.php sql injection (CVSS 6.9, SourceCodester Online Examination System)
- [CVE-2024-5045](https://cve.now/CVE-2024-5045.md): SourceCodester Online Birth Certificate Management System admin file access (CVSS 6.9, SourceCodester Online Birth Certificate Management System)
- [CVE-2024-35794](https://cve.now/CVE-2024-35794.md): dm-raid: really frozen sync\_thread during suspend (no CVSS, Linux)
- [CVE-2024-35793](https://cve.now/CVE-2024-35793.md): debugfs: fix wait/cancellation handling during remove (CVSS 7.8, Linux)
- [CVE-2024-35792](https://cve.now/CVE-2024-35792.md): crypto: rk3288 - Fix use after free in unprepare (CVSS 7.8, Linux)
- [CVE-2024-35791](https://cve.now/CVE-2024-35791.md): KVM: SVM: Flush pages under kvm-\>lock to fix UAF in svm\_register\_enc\_region() (CVSS 7.8, Linux)
- [CVE-2024-35790](https://cve.now/CVE-2024-35790.md): usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (no CVSS, Linux)
- [CVE-2024-35789](https://cve.now/CVE-2024-35789.md): wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (CVSS 8.0, Linux)
- [CVE-2024-35787](https://cve.now/CVE-2024-35787.md): md/md-bitmap: fix incorrect usage for sb\_index (CVSS 7.8, Linux)
- [CVE-2024-35786](https://cve.now/CVE-2024-35786.md): drm/nouveau: fix stale locked mutex in nouveau\_gem\_ioctl\_pushbuf (no CVSS, Linux)
- [CVE-2024-35785](https://cve.now/CVE-2024-35785.md): tee: optee: Fix kernel panic caused by incorrect error handling (CVSS 7.8, Linux)
- [CVE-2024-35784](https://cve.now/CVE-2024-35784.md): btrfs: fix deadlock with fiemap and extent locking (no CVSS, Linux)
- [CVE-2024-27436](https://cve.now/CVE-2024-27436.md): ALSA: usb-audio: Stop parsing channels bits when all channels are found. (CVSS 5.3, Linux)
- [CVE-2024-27435](https://cve.now/CVE-2024-27435.md): nvme: fix reconnection fail due to reserved tag allocation (CVSS 7.5, Linux)
- [CVE-2024-27434](https://cve.now/CVE-2024-27434.md): wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (CVSS 7.1, Linux)
- [CVE-2024-27433](https://cve.now/CVE-2024-27433.md): clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clk\_mt8135\_apmixed\_probe() (no CVSS, Linux)
- [CVE-2024-27432](https://cve.now/CVE-2024-27432.md): net: ethernet: mtk\_eth\_soc: fix PPE hanging issue (no CVSS, Linux)
- [CVE-2023-52660](https://cve.now/CVE-2023-52660.md): media: rkisp1: Fix IRQ handling due to shared interrupts (no CVSS, Linux)
- [CVE-2023-52659](https://cve.now/CVE-2023-52659.md): x86/mm: Ensure input to pfn\_to\_kaddr() is treated as a 64-bit type (no CVSS, Linux)
- [CVE-2024-5055](https://cve.now/CVE-2024-5055.md): Vulnerability of uncontrolled resource consumption in XAMPP (CVSS 7.5, Apache Friends XAMPP)
- [CVE-2024-27431](https://cve.now/CVE-2024-27431.md): cpumap: Zero-initialise xdp\_rxq\_info struct before running XDP program (CVSS 7.8, Linux)
- [CVE-2024-27419](https://cve.now/CVE-2024-27419.md): netrom: Fix data-races around sysctl\_net\_busy\_read (no CVSS, Linux)
- [CVE-2023-52658](https://cve.now/CVE-2023-52658.md): Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (no CVSS, Linux)
- [CVE-2024-27418](https://cve.now/CVE-2024-27418.md): net: mctp: take ownership of skb in mctp\_local\_output (no CVSS, Linux)
- [CVE-2024-27417](https://cve.now/CVE-2024-27417.md): ipv6: fix potential "struct net" leak in inet6\_rtm\_getaddr() (no CVSS, Linux)
- [CVE-2024-27416](https://cve.now/CVE-2024-27416.md): Bluetooth: hci\_event: Fix handling of HCI\_EV\_IO\_CAPA\_REQUEST (CVSS 8.8, Linux)
- [CVE-2024-27415](https://cve.now/CVE-2024-27415.md): netfilter: bridge: confirm multicast packets before passing them up the stack (CVSS 8.8, Linux)
- [CVE-2024-27414](https://cve.now/CVE-2024-27414.md): rtnetlink: fix error logic of IFLA\_BRIDGE\_FLAGS writing back (CVSS 7.8, Linux)
- [CVE-2024-27413](https://cve.now/CVE-2024-27413.md): efi/capsule-loader: fix incorrect allocation size (no CVSS, Linux)
- [CVE-2024-27412](https://cve.now/CVE-2024-27412.md): power: supply: bq27xxx-i2c: Do not free non existing IRQ (CVSS 5.5, Linux)
- [CVE-2024-27411](https://cve.now/CVE-2024-27411.md): drm/nouveau: keep DMA buffers required for suspend/resume (CVSS 7.8, Linux)
- [CVE-2024-27410](https://cve.now/CVE-2024-27410.md): wifi: nl80211: reject iftype change with mesh ID change (CVSS 7.8, Linux)
- [CVE-2024-27409](https://cve.now/CVE-2024-27409.md): dmaengine: dw-edma: HDMA: Add sync read before starting the DMA transfer in remote setup (CVSS 7.8, Linux)
- [CVE-2024-27408](https://cve.now/CVE-2024-27408.md): dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup (CVSS 7.8, Linux)
- [CVE-2023-52657](https://cve.now/CVE-2023-52657.md): Revert "drm/amd/pm: resolve reboot exception for si oland" (no CVSS, Linux)
- [CVE-2024-27407](https://cve.now/CVE-2024-27407.md): fs/ntfs3: Fixed overflow check in mi\_enum\_attr() (CVSS 7.8, Linux)
- [CVE-2024-27406](https://cve.now/CVE-2024-27406.md): lib/Kconfig.debug: TEST\_IOV\_ITER depends on MMU (no CVSS, Linux)
- [CVE-2024-27405](https://cve.now/CVE-2024-27405.md): usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs (CVSS 7.5, Linux)
- [CVE-2024-27404](https://cve.now/CVE-2024-27404.md): mptcp: fix data races on remote\_id (CVSS 8.2, Linux)
- [CVE-2024-27403](https://cve.now/CVE-2024-27403.md): netfilter: nft\_flow\_offload: reset dst in route object after setting up flow (CVSS 7.8, Linux)
- [CVE-2024-27402](https://cve.now/CVE-2024-27402.md): phonet/pep: fix racy skb\_queue\_empty() use (CVSS 5.8, Linux)
- [CVE-2024-5044](https://cve.now/CVE-2024-5044.md): Emlog Pro Cookie improper authentication (CVSS 6.3, Emlog Pro)
- [CVE-2024-5043](https://cve.now/CVE-2024-5043.md): Emlog Pro setting.php unrestricted upload (CVSS 5.1, Emlog Pro)
- [CVE-2024-35174](https://cve.now/CVE-2024-35174.md): WordPress Flo Forms plugin \<= 1.0.42 - Broken Access Control vulnerability (CVSS 5.3, Flothemes Flo Forms)
- [CVE-2024-22120](https://cve.now/CVE-2024-22120.md): Time Based SQL Injection in Zabbix Server Audit Log (CVSS 9.1, Zabbix)
- [CVE-2024-34755](https://cve.now/CVE-2024-34755.md): WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin \<= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CRM Perks Integration for Contact Form 7 and Salesforce)
- [CVE-2024-34756](https://cve.now/CVE-2024-34756.md): WordPress Integration for HubSpot and Contact Form 7 plugin \<= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CRM Perks Integration for Contact Form 7 HubSpot)
- [CVE-2024-34806](https://cve.now/CVE-2024-34806.md): WordPress Clearfy Cache plugin \<= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Creative Motion Clearfy Cache)
- [CVE-2024-34807](https://cve.now/CVE-2024-34807.md): WordPress Fast Custom Social Share by CodeBard plugin \<= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Fast Custom Social Share by CodeBard)
- [CVE-2024-34809](https://cve.now/CVE-2024-34809.md): WordPress EmpowerWP theme \<= 1.0.21 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Extend Themes EmpowerWP)
- [CVE-2024-32960](https://cve.now/CVE-2024-32960.md): WordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerability (CVSS 8.8, Booking Ultra Pro)
- [CVE-2024-32959](https://cve.now/CVE-2024-32959.md): WordPress Sirv plugin \<= 7.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8, Sirv CDN and Image Hosting Sirv)
- [CVE-2024-32830](https://cve.now/CVE-2024-32830.md): WordPress buddyforms plugin \<= 2.8.8- Arbitrary File Read and SSRF vulnerability (CVSS 8.6, ThemeKraft BuddyForms)
- [CVE-2024-5052](https://cve.now/CVE-2024-5052.md): Resource consumption vulnerability in Cerberus FTP Enterprise (CVSS 7.5, Cerberus FTP Enterprise)
- [CVE-2024-32827](https://cve.now/CVE-2024-32827.md): WordPress Giveaways and Contests by RafflePress plugin \<= 1.12.7 - IP Restriction Bypass vulnerability (CVSS 5.3, RafflePress Giveaways and Contests)
- [CVE-2024-32809](https://cve.now/CVE-2024-32809.md): WordPress ActiveDEMAND plugin \<= 0.2.41 - Arbitrary File Upload vulnerability (CVSS 10.0, JumpDEMAND ActiveDEMAND)
- [CVE-2024-32802](https://cve.now/CVE-2024-32802.md): WordPress Better Messages plugin \<= 2.4.32 - Broken Authentication vulnerability (CVSS 5.3, WordPlus BP Better Messages)
- [CVE-2024-32786](https://cve.now/CVE-2024-32786.md): WordPress Royal Elementor Addons and Templates plugin \<= 1.3.93 - IP Bypass vulnerability (CVSS 5.3, WP Royal Royal Elementor Addons)
- [CVE-2024-32774](https://cve.now/CVE-2024-32774.md): WordPress ProfileGrid plugin \<= 5.8.2 - Group Members Limit Bypass vulnerability (CVSS 4.3, Metagauss ProfileGrid)
- [CVE-2024-32720](https://cve.now/CVE-2024-32720.md): WordPress Appointment Hour Booking plugin \<= 1.4.56 - Captcha Bypass vulnerability (CVSS 5.3, CodePeople Appointment Hour Booking)
- [CVE-2024-32708](https://cve.now/CVE-2024-32708.md): WordPress Maintenance Mode plugin \<= 3.0.1 - IP Bypass vulnerability (CVSS 3.7, helderk Maintenance Mode)
- [CVE-2024-32692](https://cve.now/CVE-2024-32692.md): WordPress Chauffeur Taxi Booking System for WordPress plugin \<= 6.9 - Broken Authentication vulnerability (CVSS 8.2, QuanticaLabs Chauffeur Taxi Booking System for WordPress)
- [CVE-2024-32685](https://cve.now/CVE-2024-32685.md): WordPress WP Ultimate Review plugin \<= 2.2.5 - Review Score Manipulation vulnerability (CVSS 5.3, Wpmet Wp Ultimate Review)
- [CVE-2024-32680](https://cve.now/CVE-2024-32680.md): WordPress HUSKY plugin \<= 1.3.5.2 - Remote Code Execution (RCE) vulnerability (CVSS 8.8, PluginUS HUSKY – Products Filter for WooCommerce)
- [CVE-2024-32523](https://cve.now/CVE-2024-32523.md): WordPress Mailster plugin \<= 4.0.6 - Unauthenticated Local File Inclusion vulnerability (CVSS 8.1, EverPress Mailster)
- [CVE-2024-32521](https://cve.now/CVE-2024-32521.md): WordPress Zero Spam for WordPress plugin \<= 5.5.6 - Bypass Spam Protection vulnerability (CVSS 5.3, Highfivery Zero Spam)
- [CVE-2024-32512](https://cve.now/CVE-2024-32512.md): WordPress weForms plugin \<= 1.6.20 - Form Submission Restriction Bypass vulnerability (CVSS 5.3, weForms)
- [CVE-2024-32511](https://cve.now/CVE-2024-32511.md): WordPress Simple Registration for WooCommerce plugin \<= 1.5.6 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, Astoundify Simple Registration for WooCommerce)
- [CVE-2024-32507](https://cve.now/CVE-2024-32507.md): WordPress Login with phone number plugin \<= 1.7.16 - Privilege Escalation vulnerability (CVSS 8.8, Hamid Alinia Login with phone number)
- [CVE-2024-31300](https://cve.now/CVE-2024-31300.md): WordPress Easy Social Share Buttons plugin \<= 9.4 - Local File Inclusion vulnerability (CVSS 8.5, appscreo Easy Social Share Buttons)
- [CVE-2024-31290](https://cve.now/CVE-2024-31290.md): WordPress Demo My WordPress plugin \<= 1.0.9.1 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, CodeRevolution Demo My WordPress)
- [CVE-2024-31281](https://cve.now/CVE-2024-31281.md): WordPress Church Admin plugin \<= 4.1.6 - Broken Access Control vulnerability (CVSS 6.3, andy\_moyle Church Admin)
- [CVE-2024-31237](https://cve.now/CVE-2024-31237.md): WordPress s2Member plugin \<= 240315 - Privilege Escalation vulnerability (CVSS 7.5, WP Sharks s2Member Pro)
- [CVE-2024-31232](https://cve.now/CVE-2024-31232.md): WordPress Rehub theme \<= 19.6.1 - Local File Inclusion vulnerability (CVSS 8.0, Sizam Design Rehub)
- [CVE-2024-31231](https://cve.now/CVE-2024-31231.md): WordPress Rehub theme \<= 19.6.1 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, Sizam Design Rehub)
- [CVE-2024-30542](https://cve.now/CVE-2024-30542.md): WordPress WholesaleX plugin \<= 1.3.2 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, WholesaleX)
- [CVE-2024-30509](https://cve.now/CVE-2024-30509.md): WordPress SellKit plugin \<= 1.8.1 - Arbitrary File Download vulnerability (CVSS 6.5, Artbees SellKit)
- [CVE-2024-27971](https://cve.now/CVE-2024-27971.md): WordPress Premmerce Permalink Manager for WooCommerce plugin \<= 2.3.10 - Local File Inclusion vulnerability (CVSS 8.3, Premmerce Permalink Manager for WooCommerce)
- [CVE-2024-27955](https://cve.now/CVE-2024-27955.md): WordPress Automatic plugin \<= 3.92.0 - CSRF to Privilege Escalation vulnerability (CVSS 8.8, WP Automatic Automatic)
- [CVE-2024-27954](https://cve.now/CVE-2024-27954.md): WordPress Automatic plugin \<= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability (CVSS 9.3, WP Automatic Automatic)
- [CVE-2024-24934](https://cve.now/CVE-2024-24934.md): WordPress Elementor plugin \<= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability (CVSS 8.5, Elementor Website Builder)
- [CVE-2024-24882](https://cve.now/CVE-2024-24882.md): WordPress LMS by Masteriyo plugin \<= 1.7.2 - Privilege Escalation vulnerability (CVSS 9.8, Masteriyo - LMS)
- [CVE-2024-24869](https://cve.now/CVE-2024-24869.md): WordPress Total Upkeep plugin \<= 1.15.8 - Arbitrary File Download vulnerability (CVSS 7.5, BoldGrid Total Upkeep)
- [CVE-2024-24715](https://cve.now/CVE-2024-24715.md): WordPress WordPress BookIt Plugin plugin \<= 2.4.0 - Price Bypass Vulnerability vulnerability (CVSS 6.5, The Events Calendar BookIt)
- [CVE-2024-23522](https://cve.now/CVE-2024-23522.md): WordPress Formidable Forms plugin \<= 6.7 - Content Injection vulnerability (CVSS 5.3, Strategy11 Form Builder Team Formidable Forms)
- [CVE-2024-22157](https://cve.now/CVE-2024-22157.md): WordPress SalesKing plugin \<= 1.6.15 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, WebWizards SalesKing)
- [CVE-2024-22145](https://cve.now/CVE-2024-22145.md): WordPress InstaWP Connect plugin \<= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8, InstaWP Connect)
- [CVE-2024-22139](https://cve.now/CVE-2024-22139.md): WordPress WordPress Manutenção plugin \<= 1.0.6 - Bypass vulnerability (CVSS 3.7, Filipe Seabra WordPress Manutenção)
- [CVE-2024-21746](https://cve.now/CVE-2024-21746.md): WordPress Wp Ultimate Review plugin \<= 2.3.6 - IP limit Bypass vulnerability (CVSS 5.3, Roxnor Wp Ultimate Review)
- [CVE-2024-4214](https://cve.now/CVE-2024-4214.md): WordPress cardealer plugin \<= 4.15 - Content Injection vulnerability (CVSS 2.7, Bill Minozzi Car Dealer)
- [CVE-2023-51546](https://cve.now/CVE-2023-51546.md): WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin \<= 4.2.1 - Privilege Escalation vulnerability (CVSS 7.2, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2023-51483](https://cve.now/CVE-2023-51483.md): WordPress WP Frontend Profile plugin \<= 1.3.1 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, Glowlogix WP Frontend Profile)
- [CVE-2023-51481](https://cve.now/CVE-2023-51481.md): WordPress Local Delivery Drivers for WooCommerce plugin \<= 1.9.0 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, powerfulwp Local Delivery Drivers for WooCommerce)
- [CVE-2023-51479](https://cve.now/CVE-2023-51479.md): WordPress Build App Online plugin \<= 1.0.19 - Authenticated Privilege Escalation vulnerability (CVSS 8.8, Abdul Hakeem Build App Online)
- [CVE-2023-51476](https://cve.now/CVE-2023-51476.md): WordPress WP MLM Unilevel plugin \<= 4.0 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, IOSS WP MLM Unilevel)
- [CVE-2023-51424](https://cve.now/CVE-2023-51424.md): WordPress WebinarIgnition plugin \<= 3.05.0 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, Saleswonder Team WebinarIgnition)
- [CVE-2023-51401](https://cve.now/CVE-2023-51401.md): WordPress Ultimate Addons for Beaver Builder Premium plugin \<= 1.35.13 - Limited Arbitrary File Download vulnerability (CVSS 6.3, Brainstorm Force Ultimate Addons for Beaver Builder)
- [CVE-2023-51398](https://cve.now/CVE-2023-51398.md): WordPress Ultimate Addons for Beaver Builder Premium plugin \<= 1.35.14 - Privilege Escalation vulnerability (CVSS 8.8, Brainstorm Force Ultimate Addons for Beaver Builder)
- [CVE-2023-51356](https://cve.now/CVE-2023-51356.md): WordPress ARMember plugin \<= 4.0.10 - Privilege Escalation vulnerability (CVSS 8.8, Repute Infosystems ARMember)
- [CVE-2023-50890](https://cve.now/CVE-2023-50890.md): WordPress Ultimate Addons for Elementor plugin \<= 1.36.20 - Privilege Escalation vulnerability (CVSS 8.8, Brainstorm Force Ultimate Addons for Elementor)
- [CVE-2023-49753](https://cve.now/CVE-2023-49753.md): WordPress Adifier System plugin \< 3.1.4 - Local File Inclusion vulnerability (CVSS 7.5, spoonthemes Adifier System)
- [CVE-2023-48757](https://cve.now/CVE-2023-48757.md): WordPress JetEngine plugin \<= 3.2.4 - Privilege Escalation vulnerability (CVSS 8.8, Crocoblock JetEngine)
- [CVE-2023-48319](https://cve.now/CVE-2023-48319.md): WordPress Salon booking system plugin \< 8.7 - Editor+ Privilege Escalation vulnerability (CVSS 6.8, Salon booking system)
- [CVE-2023-47868](https://cve.now/CVE-2023-47868.md): WordPress wpForo plugin \<= 2.2.3 - Privilege Escalation vulnerability (CVSS 7.3, wpForo Forum)
- [CVE-2023-47782](https://cve.now/CVE-2023-47782.md): WordPress Thrive Theme Builder theme \< 3.24.0 - Authenticated Privilege Escalation vulnerability (CVSS 8.8, Thrive Themes Thrive Theme Builder)
- [CVE-2023-47683](https://cve.now/CVE-2023-47683.md): WordPress Social Login, Social Sharing by miniOrange plugin \<= 7.6.6 - Authenticated Privilege Escalation vulnerability (CVSS 8.0, miniOrange WordPress Social Login and Register)
- [CVE-2023-47682](https://cve.now/CVE-2023-47682.md): WordPress WP User Frontend plugin \<= 3.6.5 - Authenticated Privilege Escalation vulnerability (CVSS 7.2, weDevs WP User Frontend)
- [CVE-2023-47679](https://cve.now/CVE-2023-47679.md): WordPress Qi Addons For Elementor plugin \<= 1.6.3 - Local File Inclusion vulnerability (CVSS 6.4, QODE Interactive Qi Addons For Elementor)
- [CVE-2023-47178](https://cve.now/CVE-2023-47178.md): WordPress The Plus Addons for Elementor Pro plugin \<= 5.2.8 - Unauthenticated Local File Inclusion vulnerability (CVSS 8.6, POSIMYTH Innovation The Plus Addons for Elementor Pro)
- [CVE-2023-46784](https://cve.now/CVE-2023-46784.md): WordPress ICS Calendar plugin \<= 10.12.0.3 - SSRF and Arbitrary File Read vulnerability (CVSS 8.2, Room 34 Creative Services ICS Calendar)
- [CVE-2023-46205](https://cve.now/CVE-2023-46205.md): WordPress Ultimate Addons for WPBakery Page Builder plugin \<= 3.19.14 - Local File Inclusion vulnerability (CVSS 7.1, Brainstorm Force Ultimate Addons for WPBakery Page Builder)
- [CVE-2023-46197](https://cve.now/CVE-2023-46197.md): WordPress Popup by Supsystic plugin \<= 1.10.19 - Unauthenticated Subscriber Email Addresses Disclosure (CVSS 5.3, supsystic.com Popup by Supsystic)
- [CVE-2023-46145](https://cve.now/CVE-2023-46145.md): WordPress Themify Ultra theme \<= 7.3.5 - Authenticated Privilege Escalation vulnerability (CVSS 8.8, Themify Ultra)
- [CVE-2023-45652](https://cve.now/CVE-2023-45652.md): WordPress Remote Content Shortcode plugin \<= 1.5 - Local File Inclusion vulnerability (CVSS 6.5, Justin Silver Remote Content Shortcode)
- [CVE-2024-4789](https://cve.now/CVE-2024-4789.md): Cost Calculator Builder Pro \<= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4, StylemixThemes Cost Calculator Builder PRO)
- [CVE-2023-44478](https://cve.now/CVE-2023-44478.md): WordPress Events Rich Snippets for Google plugin \<= 1.8 - CSRF Leading to Privilege Escalation vulnerability (CVSS 7.1, WP Hive Events Rich Snippets for Google)
- [CVE-2024-24873](https://cve.now/CVE-2024-24873.md): WordPress Polls CP plugin \<= 1.0.71 - Polls Limitation Bypass vulnerability (CVSS 5.3, CodePeople CP Polls)
- [CVE-2024-24874](https://cve.now/CVE-2024-24874.md): WordPress Polls CP plugin \<= 1.0.71 - Content Injection vulnerability (CVSS 5.3, CodePeople CP Polls)
- [CVE-2024-25595](https://cve.now/CVE-2024-25595.md): WordPress Defender Security plugin \<= 4.4.1 - IP Restriction Bypass vulnerability (CVSS 5.3, WPMU DEV Defender Security)
- [CVE-2024-25906](https://cve.now/CVE-2024-25906.md): WordPress Comments Like Dislike plugin \<= 1.2.2 - IP Restriction Bypass Vulnerability vulnerability (CVSS 4.3, WP Happy Coders Comments Like Dislike)
- [CVE-2024-30479](https://cve.now/CVE-2024-30479.md): WordPress LionScripts: IP Blocker Lite plugin \<= 11.1.1 - Bypass vulnerability (CVSS 5.3, LionScripts IP Blocker Lite)
- [CVE-2024-30480](https://cve.now/CVE-2024-30480.md): WordPress CGC Maintenance Mode plugin \<= 1.2 - IP Filtering Bypass vulnerability (CVSS 3.7, Pippin Williamson CGC Maintenance Mode)
- [CVE-2024-30522](https://cve.now/CVE-2024-30522.md): WordPress Newsletter plugin \<= 8.2.0 - IP Blacklist Bypass vulnerability (CVSS 5.3, Stefano Lissa & The Newsletter Team Newsletter)
- [CVE-2024-30527](https://cve.now/CVE-2024-30527.md): WordPress WP Express Checkout plugin \<= 2.3.7 - Price Manipulation vulnerability (CVSS 7.5, Tips and Tricks HQ WP Express Checkout)
- [CVE-2024-30540](https://cve.now/CVE-2024-30540.md): WordPress VS Contact Form plugin \<= 14.7 - Sum Captcha Bypass vulnerability (CVSS 5.3, Guido VS Contact Form)
- [CVE-2024-31295](https://cve.now/CVE-2024-31295.md): WordPress Captcha by BestWebSoft plugin \<= 5.2.0 - Captcha Bypass vulnerability (CVSS 5.3, Captcha by BestWebSoft)
- [CVE-2024-31341](https://cve.now/CVE-2024-31341.md): WordPress User Profile Builder plugin \<= 3.11.2 - Bypass Vulnerability vulnerability (CVSS 5.3, Cozmoslabs Profile Builder)
- [CVE-2024-32131](https://cve.now/CVE-2024-32131.md): WordPress Download Manager plugin \<= 3.2.82 - File Password Lock Bypass vulnerability (CVSS 5.3, W3 Eden Download Manager)
- [CVE-2024-32790](https://cve.now/CVE-2024-32790.md): WordPress Pricing Table by Supsystic plugin \<= 1.9.12 - Content Injection vulnerability (CVSS 4.3, Pricing Table by Supsystic)
- [CVE-2024-33549](https://cve.now/CVE-2024-33549.md): WordPress WZone plugin \<= 14.0.10 - Privilege Escalation vulnerability (CVSS 8.8, AA-Team WZone)
- [CVE-2024-33550](https://cve.now/CVE-2024-33550.md): WordPress WP Masquerade plugin \<= 1.1.0 - Authenticated Account Takeover vulnerability (CVSS 8.8, JR King/Eran Schoellhorn WP Masquerade)
- [CVE-2024-33552](https://cve.now/CVE-2024-33552.md): WordPress XStore Core plugin \<= 5.3.8 - Unauthenticated Account Takeover vulnerability (CVSS 9.8, 8theme XStore Core)
- [CVE-2024-33567](https://cve.now/CVE-2024-33567.md): WordPress Barcode Scanner with Inventory & Order Manager plugin \<= 1.5.3 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, UkrSolution Barcode Scanner with Inventory & Order Manager)
- [CVE-2024-33569](https://cve.now/CVE-2024-33569.md): WordPress Instant Images plugin \<= 6.1.0 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 7.2, Darren Cooney Instant Images)
- [CVE-2024-33644](https://cve.now/CVE-2024-33644.md): WordPress Customify Site Library plugin \<= 0.0.9 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, WPCustomify Customify Site Library)
- [CVE-2024-33917](https://cve.now/CVE-2024-33917.md): WordPress WTI Like Post plugin \<= 1.4.6 - IP Restriction Bypass Vulnerability vulnerability (CVSS 5.3, webtechideas WTI Like Post)
- [CVE-2024-34370](https://cve.now/CVE-2024-34370.md): WordPress EAN for WooCommerce plugin \<= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 7.2, WPFactory EAN for WooCommerce)
- [CVE-2024-34434](https://cve.now/CVE-2024-34434.md): WordPress MDTF – Meta Data and Taxonomies Filter plugin \<= 1.3.3.2 - Arbitrary Shortcode Execution vulnerability (CVSS 6.5, realmag777 WordPress Meta Data and Taxonomies Filter)
- [CVE-2024-35110](https://cve.now/CVE-2024-35110.md): A reflected XSS vulnerability has been found in YzmCMS 7.1. (CVSS 5.5)
- [CVE-2023-41957](https://cve.now/CVE-2023-41957.md): WordPress Simple Membership plugin \<= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerability (CVSS 8.6, smp7, wp.insider Simple Membership)
- [CVE-2023-41956](https://cve.now/CVE-2023-41956.md): WordPress Simple Membership plugin \<= 4.3.4 - Authenticated Account Takeover vulnerability (CVSS 8.8, smp7, wp.insider Simple Membership)
- [CVE-2023-41955](https://cve.now/CVE-2023-41955.md): WordPress Essential Addons for Elementor plugin \<= 5.8.8 - Contributor+ Privilege Escalation vulnerability (CVSS 8.8, WPDeveloper Essential Addons for Elementor)
- [CVE-2023-41954](https://cve.now/CVE-2023-41954.md): WordPress ProfilePress plugin \<= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability (CVSS 8.6, ProfilePress Membership Team ProfilePress)
- [CVE-2023-41665](https://cve.now/CVE-2023-41665.md): WordPress GiveWP plugin \<= 2.33.0 - GiveWP Manager+ Privilege Escalation vulnerability (CVSS 8.8, GiveWP)
- [CVE-2023-41243](https://cve.now/CVE-2023-41243.md): WordPress WPvivid Backup Plugin plugin \<= 0.9.90 - Privilege Escalation on Staging Environment vulnerability (CVSS 8.8, WPvivid Team WPvivid Backup and Migration)
- [CVE-2023-39163](https://cve.now/CVE-2023-39163.md): WordPress Phlox Shop plugin \<= 2.0.0 - Unauthenticated Local File Inclusion vulnerability (CVSS 8.6, Averta Phlox Shop)
- [CVE-2023-38399](https://cve.now/CVE-2023-38399.md): WordPress Phlox Portfolio plugin \<= 2.3.1 - Unauthenticated Local File Inclusion vulnerability (CVSS 8.6, Averta Phlox Portfolio)
- [CVE-2023-37999](https://cve.now/CVE-2023-37999.md): WordPress HT Mega Absolute Addons for Elementor plugin \<= 2.2.0 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, HasThemes HT Mega)
- [CVE-2023-37888](https://cve.now/CVE-2023-37888.md): WordPress Phlox Core Elements plugin \<= 2.14.0 - Unauthenticated Local File Inclusion vulnerability (CVSS 7.6, By Averta Shortcodes and extra features for Phlox theme)
- [CVE-2023-37866](https://cve.now/CVE-2023-37866.md): WordPress JetFormBuilder plugin \<= 3.0.8 - Authenticated Privilege Escalation vulnerability (CVSS 7.2, Crocoblock JetFormBuilder)
- [CVE-2023-37389](https://cve.now/CVE-2023-37389.md): WordPress Booking Package SAASPROJECT plugin \<= 1.5.98 - Unauthenticated Privilege Escalation vulnerability (CVSS 8.8, SAASPROJECT Booking Package Booking Package)
- [CVE-2023-37385](https://cve.now/CVE-2023-37385.md): WordPress Consulting theme \<= 6.5.6 - Local File Inclusion (CVSS 7.3, StylemixThemes Consulting)
- [CVE-2023-35881](https://cve.now/CVE-2023-35881.md): WordPress WooCommerce One Page Checkout plugin \<= 2.3.0 - Local File Inclusion vulnerability (CVSS 7.6, WooCommerce One Page Checkout)
- [CVE-2023-34186](https://cve.now/CVE-2023-34186.md): WordPress Headless CMS plugin \<= 2.0.3 - Broken Authentication vulnerability (CVSS 5.3, Imran Sayed Headless CMS)
- [CVE-2023-33321](https://cve.now/CVE-2023-33321.md): WordPress EventPrime plugin \<= 2.8.6 - Sensitive Data Exposure (CVSS 5.3, Metagauss EventPrime)
- [CVE-2023-33310](https://cve.now/CVE-2023-33310.md): WordPress Unite Gallery Lite plugin \<= 1.7.59 - Local File Inclusion vulnerability (CVSS 6.0, Valiano Unite Gallery Lite)
- [CVE-2023-32297](https://cve.now/CVE-2023-32297.md): WordPress LWS Affiliation plugin \<= 2.2.6 - Local File Inclusion vulnerability (CVSS 9.0, LWS Affiliation)
- [CVE-2023-32244](https://cve.now/CVE-2023-32244.md): WordPress Woodmart Core plugin \<= 1.0.36 - Privilege Escalation (CVSS 9.8, xtemos Woodmart Core)
- [CVE-2023-32129](https://cve.now/CVE-2023-32129.md): WordPress Editorialmag theme \<= 1.1.9 - Authenticated Arbitrary Plugin Activation (CVSS 4.3, Sparkle WP Editorialmag)
- [CVE-2023-32110](https://cve.now/CVE-2023-32110.md): WordPress JupiterX theme \<= 3.0.0 - Auth. Local File Inclusion vulnerability (CVSS 7.6, artbees JupiterX)
- [CVE-2023-26540](https://cve.now/CVE-2023-26540.md): WordPress Houzez theme \<= 2.7.1 - Privilege Escalation (CVSS 9.8, Favethemes Houzez)
- [CVE-2023-26526](https://cve.now/CVE-2023-26526.md): WordPress Bookly plugin \<= 21.7.1 - Authenticated Arbitrary File Deletion vulnerability (CVSS 7.7, Nota-Info Bookly)
- [CVE-2023-26009](https://cve.now/CVE-2023-26009.md): WordPress Houzez Login Register plugin \<= 2.6.3 - Privilege Escalation (CVSS 9.8, Favethemes Houzez Login Register)
- [CVE-2023-25701](https://cve.now/CVE-2023-25701.md): WordPress WatchTowerHQ plugin \<= 3.6.16 - Privilege Escalation (CVSS 9.8, WhatArmy WatchTowerHQ)
- [CVE-2023-25444](https://cve.now/CVE-2023-25444.md): WordPress JS Help Desk – Best Help Desk & Support Plugin plugin \<= 2.7.7 - Arbitrary File Upload vulnerability (CVSS 9.1, JS Help Desk – Best Help Desk & Support Plugin)
- [CVE-2023-25050](https://cve.now/CVE-2023-25050.md): WordPress Shortcodes Ultimate plugin \<= 5.12.6 - Arbitrary File Download vulnerability (CVSS 7.1, Vova Anokhin Shortcodes Ultimate)
- [CVE-2023-24379](https://cve.now/CVE-2023-24379.md): WordPress Landing Page Builder – Free Landing Page Templates plugin \<= 3.1.9.9 - Local File Inclusion vulnerability (CVSS 6.8, Web-Settler Landing Page Builder – Free Landing Page Templa…)
- [CVE-2023-23990](https://cve.now/CVE-2023-23990.md): WordPress Redirection for Contact Form 7 plugin \<= 2.7.0 - Privilege Escalation vulnerability (CVSS 7.6, Qube One Redirection for Contact Form)
- [CVE-2023-23988](https://cve.now/CVE-2023-23988.md): WordPress My Tickets plugin \<= 1.9.11 - Payment Bypass Vulnerability (CVSS 7.5, Joseph C Dolson My Tickets)
- [CVE-2023-23888](https://cve.now/CVE-2023-23888.md): WordPress Rank Math SEO plugin \<= 1.0.107.2 - Local File Inclusion vulnerability (CVSS 7.6, Rank Math SEO)
- [CVE-2023-23872](https://cve.now/CVE-2023-23872.md): WordPress GMAce plugin \<= 1.5.2 - Arbitrary File Download vulnerability (CVSS 4.9, German Mesky GMAce)
- [CVE-2023-23700](https://cve.now/CVE-2023-23700.md): WordPress OceanWP theme \<= 3.4.1 - Authenticated Local File Inclusion vulnerability (CVSS 7.6, OceanWP)
- [CVE-2023-23645](https://cve.now/CVE-2023-23645.md): WordPress MainWP Code Snippets Extension Plugin \<= 4.0.2 - Subscriber+ Arbitrary PHP Code Injection/Execution Vulnerability (CVSS 9.9, MainWP Code Snippets Extension)
- [CVE-2022-45374](https://cve.now/CVE-2022-45374.md): WordPress Yet Another Related Posts Plugin (YARPP) plugin \<= 5.30.4 - Local File Inclusion (CVSS 7.7, YARPP)
- [CVE-2022-45368](https://cve.now/CVE-2022-45368.md): WordPress 1003 Mortgage Application plugin \<= 1.75 - Local File Inclusion (CVSS 7.7, Lenderd 1003 Mortgage Application)
- [CVE-2022-45070](https://cve.now/CVE-2022-45070.md): WordPress Conditional Checkout Fields for WooCommerce plugin \<= 1.2.3 - Broken Authentication vulnerability (CVSS 5.3, FmeAddons Conditional Checkout Fields for WooCommerce)
- [CVE-2022-44581](https://cve.now/CVE-2022-44581.md): WordPress Defender Security plugin \<= 3.3.2 - Broken Authentication vulnerability (CVSS 5.0, WPMU DEV Defender Security)
- [CVE-2024-31351](https://cve.now/CVE-2024-31351.md): WordPress Copymatic plugin \<= 1.6 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, Copymatic – AI Content Writer & Generator)
- [CVE-2024-33556](https://cve.now/CVE-2024-33556.md): WordPress XStore Core plugin \<= 5.3.8 - Limited Arbitrary File Upload vulnerability (CVSS 8.2, 8theme XStore Core)
- [CVE-2024-32800](https://cve.now/CVE-2024-32800.md): WordPress Popup – Popup More Popups plugin \<= 2.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Felix Moira Popup More Popups)
- [CVE-2024-34567](https://cve.now/CVE-2024-34567.md): WordPress Easy Notify Lite plugin \<= 1.1.29 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Popup Builder)
- [CVE-2024-34575](https://cve.now/CVE-2024-34575.md): WordPress DethemeKit For Elementor plugin \<= 2.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, DethemeKit For Elementor)
- [CVE-2024-34752](https://cve.now/CVE-2024-34752.md): WordPress Landing Page Builder \<= 1.5.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PluginOps Landing Page Builder)
- [CVE-2024-3580](https://cve.now/CVE-2024-3580.md): Popup4Phone \<= 1.3.2 - Editor+ Stored XSS (CVSS 6.1, Popup4Phone)
- [CVE-2024-3231](https://cve.now/CVE-2024-3231.md): Popup4Phone \<= 1.3.2 - Unauthenticated Stored XSS (CVSS 6.1, Popup4Phone)
- [CVE-2024-2744](https://cve.now/CVE-2024-2744.md): Nextgen Gallery \< 3.59.1 - Admin+ Stored XSS (CVSS 4.3, NextGEN Gallery)
- [CVE-2024-2697](https://cve.now/CVE-2024-2697.md): Swift Framework \< 2024.0.0 - Contributor+ Stored XSS via Shortcode (CVSS 6.5, socialdriver-framework)
- [CVE-2024-34757](https://cve.now/CVE-2024-34757.md): WordPress Borderless plugin \<= 1.7.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Visualmodo Borderless)
- [CVE-2024-3551](https://cve.now/CVE-2024-3551.md): Penci Soledad Data Migrator \<= 1.3.0 - Unauthenticated Local File Inclusion (CVSS 9.8, pencidesign Penci Soledad Data Migrator)
- [CVE-2024-34058](https://cve.now/CVE-2024-34058.md): The WebTop package for NethServer 7 and 8 allows stored XSS (for example, via the Subject field if an e-mail message). (CVSS 8.8)
- [CVE-2024-34997](https://cve.now/CVE-2024-34997.md): joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy\_pickle::NumpyArrayWrapper().read\_arra (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.