# CVEs published 2024-05-21

438 CVEs were published on May 21, 2024: 17 critical, 127 high. Days are UTC.

- [CVE-2024-3518](https://cve.now/CVE-2024-3518.md): Media Library Assistant \<= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, dglingren Media Library Assistant)
- [CVE-2024-3519](https://cve.now/CVE-2024-3519.md): Media Library Assistant \<= 3.15 - Reflected Cross-Site Scripting via lang (CVSS 6.1, dglingren Media Library Assistant)
- [CVE-2024-21683](https://cve.now/CVE-2024-21683.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. (CVSS 7.2, Atlassian Confluence Data Center)
- [CVE-2024-35220](https://cve.now/CVE-2024-35220.md): @fastify/session reuses destroyed session cookie (CVSS 7.4, fastify session · @fastify/session)
- [CVE-2024-5040](https://cve.now/CVE-2024-5040.md): LCDS LAquis SCADA Path Traversal (CVSS 8.5, LCDS LAquis SCADA)
- [CVE-2024-31756](https://cve.now/CVE-2024-31756.md): An issue in MarvinTest Solutions Hardware Access Driver v.5.0.3.0 and before and fixed in v.5.0.4.0 allows a local attacker to escalate priv (CVSS 7.8)
- [CVE-2024-34274](https://cve.now/CVE-2024-34274.md): OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. (CVSS 3.9)
- [CVE-2024-31989](https://cve.now/CVE-2024-31989.md): ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache (CVSS 9.1, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-33525](https://cve.now/CVE-2024-33525.md): A Stored Cross-site Scripting (XSS) vulnerability in the "Import of organizational units and title of organizational unit" feature in ILIAS (CVSS 4.3)
- [CVE-2024-25724](https://cve.now/CVE-2024-25724.md): In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queu (CVSS 7.3)
- [CVE-2024-4154](https://cve.now/CVE-2024-4154.md): Incorrect Synchronization in lunary-ai/lunary (CVSS 7.1, lunary-ai/lunary)
- [CVE-2024-31757](https://cve.now/CVE-2024-31757.md): An issue in TeraByte Unlimited Image for Windows v.3.64.0.0 and before and fixed in v.4.0.0.0 allows a local attacker to escalate privileges (CVSS 7.8)
- [CVE-2024-34240](https://cve.now/CVE-2024-34240.md): QDOCS Smart School 7.0.0 is vulnerable to Cross Site Scripting (XSS) resulting in arbitrary code execution in admin functions related to add (CVSS 6.1)
- [CVE-2024-22275](https://cve.now/CVE-2024-22275.md): The vCenter Server contains a partial file read vulnerability. (CVSS 4.9, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2024-22274](https://cve.now/CVE-2024-22274.md): The vCenter Server contains an authenticated remote code execution vulnerability. (CVSS 7.2, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2024-22273](https://cve.now/CVE-2024-22273.md): The storage controllers on VMware ESXi, Workstation, and Fusion have out-of-bounds read/write vulnerability. (CVSS 8.1, VMware ESXi · VMware Workstation +2)
- [CVE-2024-36052](https://cve.now/CVE-2024-36052.md): RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-202 (CVSS 7.5)
- [CVE-2024-27130](https://cve.now/CVE-2024-27130.md): QTS, QuTS hero (CVSS 7.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-27129](https://cve.now/CVE-2024-27129.md): QTS, QuTS hero (CVSS 6.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-27128](https://cve.now/CVE-2024-27128.md): QTS, QuTS hero (CVSS 6.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-27127](https://cve.now/CVE-2024-27127.md): QTS, QuTS hero (CVSS 7.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-21902](https://cve.now/CVE-2024-21902.md): QTS, QuTS hero (CVSS 6.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-1721](https://cve.now/CVE-2024-1721.md): Improper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows allows Malicious Software Update.This issue a (CVSS 5.6, HYPR Passwordless)
- [CVE-2024-31847](https://cve.now/CVE-2024-31847.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 6.1)
- [CVE-2024-31845](https://cve.now/CVE-2024-31845.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 5.3)
- [CVE-2024-31844](https://cve.now/CVE-2024-31844.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 5.3)
- [CVE-2024-31840](https://cve.now/CVE-2024-31840.md): An issue was discovered in Italtel Embrace 1.6.4. (CVSS 6.5)
- [CVE-2023-52879](https://cve.now/CVE-2023-52879.md): tracing: Have trace\_event\_file have ref counters (CVSS 7.8, Linux)
- [CVE-2023-52878](https://cve.now/CVE-2023-52878.md): can: dev: can\_put\_echo\_skb(): don't crash kernel if can\_priv::echo\_skb is accessed out of bounds (no CVSS, Linux)
- [CVE-2023-52877](https://cve.now/CVE-2023-52877.md): usb: typec: tcpm: Fix NULL pointer dereference in tcpm\_pd\_svdm() (no CVSS, Linux)
- [CVE-2023-52876](https://cve.now/CVE-2023-52876.md): clk: mediatek: clk-mt7629-eth: Add check for mtk\_alloc\_clk\_data (no CVSS, Linux)
- [CVE-2023-52875](https://cve.now/CVE-2023-52875.md): clk: mediatek: clk-mt2701: Add check for mtk\_alloc\_clk\_data (no CVSS, Linux)
- [CVE-2023-52874](https://cve.now/CVE-2023-52874.md): x86/tdx: Zero out the missing RSI in TDX\_HYPERCALL macro (CVSS 7.1, Linux)
- [CVE-2023-52873](https://cve.now/CVE-2023-52873.md): clk: mediatek: clk-mt6779: Add check for mtk\_alloc\_clk\_data (no CVSS, Linux)
- [CVE-2023-52872](https://cve.now/CVE-2023-52872.md): tty: n\_gsm: fix race condition in status line change on dead connections (CVSS 7.8, Linux)
- [CVE-2023-52871](https://cve.now/CVE-2023-52871.md): soc: qcom: llcc: Handle a second device without data corruption (CVSS 7.1, Linux)
- [CVE-2023-52870](https://cve.now/CVE-2023-52870.md): clk: mediatek: clk-mt6765: Add check for mtk\_alloc\_clk\_data (CVSS 4.1, Linux)
- [CVE-2023-52869](https://cve.now/CVE-2023-52869.md): pstore/platform: Add check for kstrdup (CVSS 5.5, Linux)
- [CVE-2023-52868](https://cve.now/CVE-2023-52868.md): thermal: core: prevent potential string overflow (no CVSS, Linux)
- [CVE-2023-52867](https://cve.now/CVE-2023-52867.md): drm/radeon: possible buffer overflow (CVSS 7.1, Linux)
- [CVE-2023-52866](https://cve.now/CVE-2023-52866.md): HID: uclogic: Fix user-memory-access bug in uclogic\_params\_ugee\_v2\_init\_event\_hooks() (no CVSS, Linux)
- [CVE-2023-52865](https://cve.now/CVE-2023-52865.md): clk: mediatek: clk-mt6797: Add check for mtk\_alloc\_clk\_data (no CVSS, Linux)
- [CVE-2023-52864](https://cve.now/CVE-2023-52864.md): platform/x86: wmi: Fix opening of char device (CVSS 7.0, Linux)
- [CVE-2023-52863](https://cve.now/CVE-2023-52863.md): hwmon: (axi-fan-control) Fix possible NULL pointer dereference (no CVSS, Linux)
- [CVE-2023-52862](https://cve.now/CVE-2023-52862.md): drm/amd/display: Fix null pointer dereference in error message (CVSS 4.1, Linux)
- [CVE-2023-52861](https://cve.now/CVE-2023-52861.md): drm: bridge: it66121: Fix invalid connector dereference (CVSS 6.2, Linux)
- [CVE-2023-52860](https://cve.now/CVE-2023-52860.md): drivers/perf: hisi: use cpuhp\_state\_remove\_instance\_nocalls() for hisi\_hns3\_pmu uninit process (no CVSS, Linux)
- [CVE-2023-52859](https://cve.now/CVE-2023-52859.md): perf: hisi: Fix use-after-free when register pmu fails (no CVSS, Linux)
- [CVE-2023-52858](https://cve.now/CVE-2023-52858.md): clk: mediatek: clk-mt7629: Add check for mtk\_alloc\_clk\_data (CVSS 6.2, Linux)
- [CVE-2023-52857](https://cve.now/CVE-2023-52857.md): drm/mediatek: Fix coverity issue with unintentional integer overflow (no CVSS, Linux)
- [CVE-2023-52856](https://cve.now/CVE-2023-52856.md): drm/bridge: lt8912b: Fix crash on bridge detach (no CVSS, Linux)
- [CVE-2023-52855](https://cve.now/CVE-2023-52855.md): usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency (CVSS 5.5, Linux)
- [CVE-2023-52854](https://cve.now/CVE-2023-52854.md): padata: Fix refcnt handling in padata\_free\_shell() (no CVSS, Linux)
- [CVE-2023-52853](https://cve.now/CVE-2023-52853.md): hid: cp2112: Fix duplicate workqueue initialization (no CVSS, Linux)
- [CVE-2023-52852](https://cve.now/CVE-2023-52852.md): f2fs: compress: fix to avoid use-after-free on dic (CVSS 7.8, Linux)
- [CVE-2023-52851](https://cve.now/CVE-2023-52851.md): IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF (no CVSS, Linux)
- [CVE-2023-52850](https://cve.now/CVE-2023-52850.md): media: hantro: Check whether reset op is defined before use (no CVSS, Linux)
- [CVE-2023-52849](https://cve.now/CVE-2023-52849.md): cxl/mem: Fix shutdown order (no CVSS, Linux)
- [CVE-2023-52848](https://cve.now/CVE-2023-52848.md): f2fs: fix to drop meta\_inode's page cache in f2fs\_put\_super() (no CVSS, Linux)
- [CVE-2023-52847](https://cve.now/CVE-2023-52847.md): media: bttv: fix use after free error due to btv-\>timeout timer (CVSS 7.8, Linux)
- [CVE-2023-52846](https://cve.now/CVE-2023-52846.md): hsr: Prevent use after free in prp\_create\_tagged\_frame() (CVSS 8.8, Linux)
- [CVE-2023-52845](https://cve.now/CVE-2023-52845.md): tipc: Change nla\_policy for bearer-related names to NLA\_NUL\_STRING (CVSS 7.1, Linux)
- [CVE-2023-52844](https://cve.now/CVE-2023-52844.md): media: vidtv: psi: Add check for kstrdup (CVSS 6.2, Linux)
- [CVE-2023-52843](https://cve.now/CVE-2023-52843.md): llc: verify mac len before reading mac header (no CVSS, Linux)
- [CVE-2023-52842](https://cve.now/CVE-2023-52842.md): virtio/vsock: Fix uninit-value in virtio\_transport\_recv\_pkt() (no CVSS, Linux)
- [CVE-2023-52841](https://cve.now/CVE-2023-52841.md): media: vidtv: mux: Add check and kfree for kstrdup (no CVSS, Linux)
- [CVE-2023-52840](https://cve.now/CVE-2023-52840.md): Input: synaptics-rmi4 - fix use after free in rmi\_unregister\_function() (no CVSS, Linux)
- [CVE-2023-52839](https://cve.now/CVE-2023-52839.md): drivers: perf: Do not broadcast to other cpus when starting a counter (no CVSS, Linux)
- [CVE-2023-52838](https://cve.now/CVE-2023-52838.md): fbdev: imsttfb: fix a resource leak in probe (CVSS 6.2, Linux)
- [CVE-2023-52837](https://cve.now/CVE-2023-52837.md): nbd: fix uaf in nbd\_open (CVSS 7.8, Linux)
- [CVE-2023-52836](https://cve.now/CVE-2023-52836.md): locking/ww\_mutex/test: Fix potential workqueue corruption (no CVSS, Linux)
- [CVE-2023-52835](https://cve.now/CVE-2023-52835.md): perf/core: Bail out early if the request AUX area is out of bound (no CVSS, Linux)
- [CVE-2023-52834](https://cve.now/CVE-2023-52834.md): atl1c: Work around the DMA RX overflow issue (CVSS 7.5, Linux)
- [CVE-2023-52833](https://cve.now/CVE-2023-52833.md): Bluetooth: btusb: Add date-\>evt\_skb is NULL check (no CVSS, Linux)
- [CVE-2023-52832](https://cve.now/CVE-2023-52832.md): wifi: mac80211: don't return unset power in ieee80211\_get\_tx\_power() (CVSS 9.1, Linux)
- [CVE-2023-52831](https://cve.now/CVE-2023-52831.md): cpu/hotplug: Don't offline the last non-isolated CPU (no CVSS, Linux)
- [CVE-2023-52829](https://cve.now/CVE-2023-52829.md): wifi: ath12k: fix possible out-of-bound write in ath12k\_wmi\_ext\_hal\_reg\_caps() (CVSS 8.4, Linux)
- [CVE-2023-52828](https://cve.now/CVE-2023-52828.md): bpf: Detect IP == ksym.end as part of BPF program (CVSS 6.6, Linux)
- [CVE-2023-52827](https://cve.now/CVE-2023-52827.md): wifi: ath12k: fix possible out-of-bound read in ath12k\_htt\_pull\_ppdu\_stats() (CVSS 7.7, Linux)
- [CVE-2023-52826](https://cve.now/CVE-2023-52826.md): drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference (no CVSS, Linux)
- [CVE-2023-52825](https://cve.now/CVE-2023-52825.md): drm/amdkfd: Fix a race condition of vram buffer unref in svm code (CVSS 7.8, Linux)
- [CVE-2023-52821](https://cve.now/CVE-2023-52821.md): drm/panel: fix a possible null pointer dereference (no CVSS, Linux)
- [CVE-2023-52819](https://cve.now/CVE-2023-52819.md): drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (CVSS 6.6, Linux)
- [CVE-2023-52818](https://cve.now/CVE-2023-52818.md): drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (no CVSS, Linux)
- [CVE-2023-52817](https://cve.now/CVE-2023-52817.md): drm/amdgpu: Fix a null pointer access when the smc\_rreg pointer is NULL (CVSS 5.5, Linux)
- [CVE-2023-52816](https://cve.now/CVE-2023-52816.md): drm/amdkfd: Fix shift out-of-bounds issue (no CVSS, Linux)
- [CVE-2023-52815](https://cve.now/CVE-2023-52815.md): drm/amdgpu/vkms: fix a possible null pointer dereference (no CVSS, Linux)
- [CVE-2023-52814](https://cve.now/CVE-2023-52814.md): drm/amdgpu: Fix potential null pointer derefernce (CVSS 5.5, Linux)
- [CVE-2023-52813](https://cve.now/CVE-2023-52813.md): crypto: pcrypt - Fix hungtask for PADATA\_RESET (no CVSS, Linux)
- [CVE-2023-52812](https://cve.now/CVE-2023-52812.md): drm/amd: check num of link levels when update pcie param (no CVSS, Linux)
- [CVE-2023-52811](https://cve.now/CVE-2023-52811.md): scsi: ibmvfc: Remove BUG\_ON in the case of an empty event pool (CVSS 5.5, Linux)
- [CVE-2023-52810](https://cve.now/CVE-2023-52810.md): fs/jfs: Add check for negative db\_l2nbperpage (CVSS 7.8, Linux)
- [CVE-2023-52809](https://cve.now/CVE-2023-52809.md): scsi: libfc: Fix potential NULL pointer dereference in fc\_lport\_ptp\_setup() (no CVSS, Linux)
- [CVE-2023-52808](https://cve.now/CVE-2023-52808.md): scsi: hisi\_sas: Set debugfs\_dir pointer to NULL after removing debugfs (no CVSS, Linux)
- [CVE-2023-52807](https://cve.now/CVE-2023-52807.md): net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs (no CVSS, Linux)
- [CVE-2023-52806](https://cve.now/CVE-2023-52806.md): ALSA: hda: Fix possible null-ptr-deref when assigning a stream (no CVSS, Linux)
- [CVE-2023-52805](https://cve.now/CVE-2023-52805.md): jfs: fix array-index-out-of-bounds in diAlloc (CVSS 7.8, Linux)
- [CVE-2023-52804](https://cve.now/CVE-2023-52804.md): fs/jfs: Add validity check for db\_maxag and db\_agpref (CVSS 7.8, Linux)
- [CVE-2023-52803](https://cve.now/CVE-2023-52803.md): SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (no CVSS, Linux)
- [CVE-2023-52801](https://cve.now/CVE-2023-52801.md): iommufd: Fix missing update of domains\_itree after splitting iopt\_area (CVSS 8.8, Linux)
- [CVE-2023-52800](https://cve.now/CVE-2023-52800.md): wifi: ath11k: fix htt pktlog locking (CVSS 4.4, Linux)
- [CVE-2023-52799](https://cve.now/CVE-2023-52799.md): jfs: fix array-index-out-of-bounds in dbFindLeaf (CVSS 7.8, Linux)
- [CVE-2023-52798](https://cve.now/CVE-2023-52798.md): wifi: ath11k: fix dfs radar event locking (CVSS 8.8, Linux)
- [CVE-2023-52797](https://cve.now/CVE-2023-52797.md): drivers: perf: Check find\_first\_bit() return value (no CVSS, Linux)
- [CVE-2023-52796](https://cve.now/CVE-2023-52796.md): ipvlan: add ipvlan\_route\_v6\_outbound() helper (no CVSS, Linux)
- [CVE-2023-52795](https://cve.now/CVE-2023-52795.md): vhost-vdpa: fix use after free in vhost\_vdpa\_probe() (no CVSS, Linux)
- [CVE-2023-52794](https://cve.now/CVE-2023-52794.md): thermal: intel: powerclamp: fix mismatch in get function for max\_idle (no CVSS, Linux)
- [CVE-2023-52792](https://cve.now/CVE-2023-52792.md): cxl/region: Do not try to cleanup after cxl\_region\_setup\_targets() fails (no CVSS, Linux)
- [CVE-2023-52791](https://cve.now/CVE-2023-52791.md): i2c: core: Run atomic i2c xfer when !preemptible (no CVSS, Linux)
- [CVE-2023-52790](https://cve.now/CVE-2023-52790.md): swiotlb: fix out-of-bounds TLB allocations with CONFIG\_SWIOTLB\_DYNAMIC (CVSS 8.8, Linux)
- [CVE-2023-52789](https://cve.now/CVE-2023-52789.md): tty: vcc: Add check for kstrdup() in vcc\_probe() (no CVSS, Linux)
- [CVE-2023-52788](https://cve.now/CVE-2023-52788.md): i915/perf: Fix NULL deref bugs with drm\_dbg() calls (no CVSS, Linux)
- [CVE-2023-52787](https://cve.now/CVE-2023-52787.md): blk-mq: make sure active queue usage is held for bio\_integrity\_prep() (no CVSS, Linux)
- [CVE-2023-52786](https://cve.now/CVE-2023-52786.md): ext4: fix racy may inline data check in dio write (no CVSS, Linux)
- [CVE-2023-52785](https://cve.now/CVE-2023-52785.md): scsi: ufs: core: Fix racing issue between ufshcd\_mcq\_abort() and ISR (no CVSS, Linux)
- [CVE-2023-52784](https://cve.now/CVE-2023-52784.md): bonding: stop the device in bond\_setup\_by\_slave() (no CVSS, Linux)
- [CVE-2023-52783](https://cve.now/CVE-2023-52783.md): net: wangxun: fix kernel panic due to null pointer (no CVSS, Linux)
- [CVE-2023-52782](https://cve.now/CVE-2023-52782.md): net/mlx5e: Track xmit submission to PTP WQ after populating metadata map (no CVSS, Linux)
- [CVE-2023-52781](https://cve.now/CVE-2023-52781.md): usb: config: fix iteration issue in 'usb\_get\_bos\_descriptor()' (no CVSS, Linux)
- [CVE-2023-52780](https://cve.now/CVE-2023-52780.md): net: mvneta: fix calls to page\_pool\_get\_stats (no CVSS, Linux)
- [CVE-2023-52779](https://cve.now/CVE-2023-52779.md): fs: Pass AT\_GETATTR\_NOSEC flag to getattr interface function (CVSS 5.5, Linux)
- [CVE-2023-52778](https://cve.now/CVE-2023-52778.md): mptcp: deal with large GSO size (no CVSS, Linux)
- [CVE-2023-52777](https://cve.now/CVE-2023-52777.md): wifi: ath11k: fix gtk offload status event locking (CVSS 7.8, Linux)
- [CVE-2023-52776](https://cve.now/CVE-2023-52776.md): wifi: ath12k: fix dfs-radar and temperature event locking (CVSS 8.8, Linux)
- [CVE-2023-52775](https://cve.now/CVE-2023-52775.md): net/smc: avoid data corruption caused by decline (CVSS 8.2, Linux)
- [CVE-2023-52774](https://cve.now/CVE-2023-52774.md): s390/dasd: protect device queue against concurrent access (no CVSS, Linux)
- [CVE-2023-52773](https://cve.now/CVE-2023-52773.md): drm/amd/display: fix a NULL pointer dereference in amdgpu\_dm\_i2c\_xfer() (no CVSS, Linux)
- [CVE-2023-52772](https://cve.now/CVE-2023-52772.md): af\_unix: fix use-after-free in unix\_stream\_read\_actor() (CVSS 7.8, Linux)
- [CVE-2023-52771](https://cve.now/CVE-2023-52771.md): cxl/port: Fix delete\_endpoint() vs parent unregistration race (CVSS 4.4, Linux)
- [CVE-2023-52770](https://cve.now/CVE-2023-52770.md): f2fs: split initial and dynamic conditions for extent\_cache (no CVSS, Linux)
- [CVE-2023-52769](https://cve.now/CVE-2023-52769.md): wifi: ath12k: fix htt mlo-offset event locking (CVSS 8.8, Linux)
- [CVE-2023-52768](https://cve.now/CVE-2023-52768.md): wifi: wilc1000: use vmm\_table as array in wilc struct (CVSS 7.8, Linux)
- [CVE-2023-52767](https://cve.now/CVE-2023-52767.md): tls: fix NULL deref on tls\_sw\_splice\_eof() with empty record (no CVSS, Linux)
- [CVE-2023-52766](https://cve.now/CVE-2023-52766.md): i3c: mipi-i3c-hci: Fix out of bounds access in hci\_dma\_irq\_handler (CVSS 7.8, Linux)
- [CVE-2023-52765](https://cve.now/CVE-2023-52765.md): mfd: qcom-spmi-pmic: Fix revid implementation (CVSS 6.2, Linux)
- [CVE-2023-52764](https://cve.now/CVE-2023-52764.md): media: gspca: cpia1: shift-out-of-bounds in set\_flicker (no CVSS, Linux)
- [CVE-2023-52763](https://cve.now/CVE-2023-52763.md): i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT\_data. (no CVSS, Linux)
- [CVE-2023-52762](https://cve.now/CVE-2023-52762.md): virtio-blk: fix implicit overflow on virtio\_max\_dma\_size (no CVSS, Linux)
- [CVE-2023-52761](https://cve.now/CVE-2023-52761.md): riscv: VMAP\_STACK overflow detection thread-safe (CVSS 7.8, Linux)
- [CVE-2023-52760](https://cve.now/CVE-2023-52760.md): gfs2: Fix slab-use-after-free in gfs2\_qd\_dealloc (CVSS 7.8, Linux)
- [CVE-2023-52757](https://cve.now/CVE-2023-52757.md): smb: client: fix potential deadlock when releasing mids (no CVSS, Linux)
- [CVE-2023-52755](https://cve.now/CVE-2023-52755.md): ksmbd: fix slab out of bounds write in smb\_inherit\_dacl() (CVSS 9.8, Linux)
- [CVE-2023-52754](https://cve.now/CVE-2023-52754.md): media: imon: fix access to invalid resource for the second interface (no CVSS, Linux)
- [CVE-2023-52753](https://cve.now/CVE-2023-52753.md): drm/amd/display: Avoid NULL dereference of timing generator (no CVSS, Linux)
- [CVE-2023-52752](https://cve.now/CVE-2023-52752.md): smb: client: fix use-after-free bug in cifs\_debug\_data\_proc\_show() (CVSS 7.8, Linux)
- [CVE-2023-52751](https://cve.now/CVE-2023-52751.md): smb: client: fix use-after-free in smb2\_query\_info\_compound() (CVSS 7.8, Linux)
- [CVE-2023-52750](https://cve.now/CVE-2023-52750.md): arm64: Restrict CPU\_BIG\_ENDIAN to GNU as or LLVM IAS 15.x or newer (no CVSS, Linux)
- [CVE-2023-52749](https://cve.now/CVE-2023-52749.md): spi: Fix null dereference on suspend (no CVSS, Linux)
- [CVE-2023-52748](https://cve.now/CVE-2023-52748.md): f2fs: avoid format-overflow warning (no CVSS, Linux)
- [CVE-2022-48710](https://cve.now/CVE-2022-48710.md): drm/radeon: fix a possible null pointer dereference (no CVSS, Linux)
- [CVE-2021-47432](https://cve.now/CVE-2021-47432.md): lib/generic-radix-tree.c: Don't overflow in peek() (CVSS 5.5, Linux)
- [CVE-2023-52747](https://cve.now/CVE-2023-52747.md): IB/hfi1: Restore allocated resources on failed copyout (no CVSS, Linux)
- [CVE-2023-52746](https://cve.now/CVE-2023-52746.md): xfrm/compat: prevent potential spectre v1 gadget in xfrm\_xlate32\_attr() (CVSS 2.5, Linux)
- [CVE-2023-52745](https://cve.now/CVE-2023-52745.md): IB/IPoIB: Fix legacy IPoIB due to wrong number of queues (CVSS 7.8, Linux)
- [CVE-2023-52744](https://cve.now/CVE-2023-52744.md): RDMA/irdma: Fix potential NULL-ptr-dereference (no CVSS, Linux)
- [CVE-2023-52743](https://cve.now/CVE-2023-52743.md): ice: Do not use WQ\_MEM\_RECLAIM flag for workqueue (no CVSS, Linux)
- [CVE-2023-52742](https://cve.now/CVE-2023-52742.md): net: USB: Fix wrong-direction WARNING in plusb.c (no CVSS, Linux)
- [CVE-2023-52741](https://cve.now/CVE-2023-52741.md): cifs: Fix use-after-free in rdata-\>read\_into\_pages() (CVSS 9.8, Linux)
- [CVE-2023-52740](https://cve.now/CVE-2023-52740.md): powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch (no CVSS, Linux)
- [CVE-2023-52739](https://cve.now/CVE-2023-52739.md): Fix page corruption caused by racy check in \_\_free\_pages (CVSS 7.8, Linux)
- [CVE-2023-52738](https://cve.now/CVE-2023-52738.md): drm/amdgpu/fence: Fix oops due to non-matching drm\_sched init/fini (CVSS 5.3, Linux)
- [CVE-2023-52737](https://cve.now/CVE-2023-52737.md): btrfs: lock the inode in shared mode before starting fiemap (no CVSS, Linux)
- [CVE-2023-52736](https://cve.now/CVE-2023-52736.md): ALSA: hda: Do not unset preset when cleaning up codec (no CVSS, Linux)
- [CVE-2023-52735](https://cve.now/CVE-2023-52735.md): bpf, sockmap: Don't let sock\_map\_{close,destroy,unhash} call itself (CVSS 9.1, Linux)
- [CVE-2023-52732](https://cve.now/CVE-2023-52732.md): ceph: blocklist the kclient when receiving corrupted snap trace (CVSS 9.8, Linux)
- [CVE-2023-52731](https://cve.now/CVE-2023-52731.md): fbdev: Fix invalid page access after closing deferred I/O devices (CVSS 7.8, Linux)
- [CVE-2023-52730](https://cve.now/CVE-2023-52730.md): mmc: sdio: fix possible resource leaks in some error paths (no CVSS, Linux)
- [CVE-2023-52708](https://cve.now/CVE-2023-52708.md): mmc: mmc\_spi: fix error handling in mmc\_spi\_probe() (no CVSS, Linux)
- [CVE-2023-52707](https://cve.now/CVE-2023-52707.md): sched/psi: Fix use-after-free in ep\_remove\_wait\_queue() (CVSS 7.8, Linux)
- [CVE-2023-52706](https://cve.now/CVE-2023-52706.md): gpio: sim: fix a memory leak (no CVSS, Linux)
- [CVE-2023-52705](https://cve.now/CVE-2023-52705.md): nilfs2: fix underflow in second superblock position calculations (no CVSS, Linux)
- [CVE-2023-52704](https://cve.now/CVE-2023-52704.md): freezer,umh: Fix call\_usermode\_helper\_exec() vs SIGKILL (CVSS 7.8, Linux)
- [CVE-2023-52703](https://cve.now/CVE-2023-52703.md): net/usb: kalmia: Don't pass act\_len in usb\_bulk\_msg error path (CVSS 3.3, Linux)
- [CVE-2023-52702](https://cve.now/CVE-2023-52702.md): net: openvswitch: fix possible memory leak in ovs\_meter\_cmd\_set() (no CVSS, Linux)
- [CVE-2023-52701](https://cve.now/CVE-2023-52701.md): net: use a bounce buffer for copying skb-\>mark (no CVSS, Linux)
- [CVE-2023-52700](https://cve.now/CVE-2023-52700.md): tipc: fix kernel warning when sending SYN message (CVSS 5.5, Linux)
- [CVE-2022-48709](https://cve.now/CVE-2022-48709.md): ice: switch: fix potential memleak in ice\_add\_adv\_recipe() (no CVSS, Linux)
- [CVE-2022-48708](https://cve.now/CVE-2022-48708.md): pinctrl: single: fix potential NULL dereference (no CVSS, Linux)
- [CVE-2022-48707](https://cve.now/CVE-2022-48707.md): cxl/region: Fix null pointer dereference for resetting decoder (no CVSS, Linux)
- [CVE-2022-48706](https://cve.now/CVE-2022-48706.md): vdpa: ifcvf: Do proper cleanup if IFCVF init fails (no CVSS, Linux)
- [CVE-2021-47431](https://cve.now/CVE-2021-47431.md): drm/amdgpu: fix gart.bo pin\_count leak (no CVSS, Linux)
- [CVE-2021-47430](https://cve.now/CVE-2021-47430.md): x86/entry: Clear X86\_FEATURE\_SMAP when CONFIG\_X86\_SMAP=n (no CVSS, Linux)
- [CVE-2021-47429](https://cve.now/CVE-2021-47429.md): powerpc/64s: Fix unrecoverable MCE calling async handler from NMI (no CVSS, Linux)
- [CVE-2021-47428](https://cve.now/CVE-2021-47428.md): powerpc/64s: fix program check interrupt emergency stack path (no CVSS, Linux)
- [CVE-2021-47427](https://cve.now/CVE-2021-47427.md): scsi: iscsi: Fix iscsi\_task use after free (CVSS 9.8, Linux)
- [CVE-2021-47426](https://cve.now/CVE-2021-47426.md): bpf, s390: Fix potential memory leak about jit\_data (no CVSS, Linux)
- [CVE-2021-47425](https://cve.now/CVE-2021-47425.md): i2c: acpi: fix resource leak in reconfiguration device addition (no CVSS, Linux)
- [CVE-2021-47424](https://cve.now/CVE-2021-47424.md): i40e: Fix freeing of uninitialized misc IRQ vector (no CVSS, Linux)
- [CVE-2021-47423](https://cve.now/CVE-2021-47423.md): drm/nouveau/debugfs: fix file release memory leak (no CVSS, Linux)
- [CVE-2021-47422](https://cve.now/CVE-2021-47422.md): drm/nouveau/kms/nv50-: fix file release memory leak (no CVSS, Linux)
- [CVE-2021-47421](https://cve.now/CVE-2021-47421.md): drm/amdgpu: handle the case of pci\_channel\_io\_frozen only in amdgpu\_pci\_resume (CVSS 7.8, Linux)
- [CVE-2021-47420](https://cve.now/CVE-2021-47420.md): drm/amdkfd: fix a potential ttm-\>sg memory leak (no CVSS, Linux)
- [CVE-2021-47419](https://cve.now/CVE-2021-47419.md): net/sched: sch\_taprio: properly cancel timer from taprio\_destroy() (CVSS 7.8, Linux)
- [CVE-2021-47418](https://cve.now/CVE-2021-47418.md): net\_sched: fix NULL deref in fifo\_set\_limit() (no CVSS, Linux)
- [CVE-2021-47417](https://cve.now/CVE-2021-47417.md): libbpf: Fix memory leak in strset (no CVSS, Linux)
- [CVE-2021-47416](https://cve.now/CVE-2021-47416.md): phy: mdio: fix memory leak (no CVSS, Linux)
- [CVE-2021-47415](https://cve.now/CVE-2021-47415.md): iwlwifi: mvm: Fix possible NULL dereference (no CVSS, Linux)
- [CVE-2021-47414](https://cve.now/CVE-2021-47414.md): riscv: Flush current cpu icache before other cpus (no CVSS, Linux)
- [CVE-2021-47413](https://cve.now/CVE-2021-47413.md): usb: chipidea: ci\_hdrc\_imx: Also search for 'phys' phandle (no CVSS, Linux)
- [CVE-2021-47412](https://cve.now/CVE-2021-47412.md): block: don't call rq\_qos\_ops-\>done\_bio if the bio isn't tracked (CVSS 7.8, Linux)
- [CVE-2021-47410](https://cve.now/CVE-2021-47410.md): drm/amdkfd: fix svm\_migrate\_fini warning (no CVSS, Linux)
- [CVE-2021-47409](https://cve.now/CVE-2021-47409.md): usb: dwc2: check return value after calling platform\_get\_resource() (no CVSS, Linux)
- [CVE-2021-47408](https://cve.now/CVE-2021-47408.md): netfilter: conntrack: serialize hash resizes and cleanups (CVSS 4.7, Linux)
- [CVE-2021-47407](https://cve.now/CVE-2021-47407.md): KVM: x86: Handle SRCU initialization failure during page track init (no CVSS, Linux)
- [CVE-2021-47406](https://cve.now/CVE-2021-47406.md): ext4: add error checking to ext4\_ext\_replay\_set\_iblocks() (CVSS 5.5, Linux)
- [CVE-2021-47405](https://cve.now/CVE-2021-47405.md): HID: usbhid: free raw\_report buffers in usbhid\_stop (no CVSS, Linux)
- [CVE-2021-47404](https://cve.now/CVE-2021-47404.md): HID: betop: fix slab-out-of-bounds Write in betop\_probe (no CVSS, Linux)
- [CVE-2021-47403](https://cve.now/CVE-2021-47403.md): ipack: ipoctal: fix module reference leak (CVSS 7.1, Linux)
- [CVE-2021-47402](https://cve.now/CVE-2021-47402.md): net: sched: flower: protect fl\_walk() with rcu (CVSS 7.8, Linux)
- [CVE-2021-47401](https://cve.now/CVE-2021-47401.md): ipack: ipoctal: fix stack information leak (CVSS 7.1, Linux)
- [CVE-2021-47400](https://cve.now/CVE-2021-47400.md): net: hns3: do not allow call hns3\_nic\_net\_open repeatedly (CVSS 7.8, Linux)
- [CVE-2021-47399](https://cve.now/CVE-2021-47399.md): ixgbe: Fix NULL pointer dereference in ixgbe\_xdp\_setup (no CVSS, Linux)
- [CVE-2021-47398](https://cve.now/CVE-2021-47398.md): RDMA/hfi1: Fix kernel pointer leak (no CVSS, Linux)
- [CVE-2021-47397](https://cve.now/CVE-2021-47397.md): sctp: break out if skb\_header\_pointer returns NULL in sctp\_rcv\_ootb (CVSS 7.5, Linux)
- [CVE-2021-47396](https://cve.now/CVE-2021-47396.md): mac80211-hwsim: fix late beacon hrtimer handling (no CVSS, Linux)
- [CVE-2021-47395](https://cve.now/CVE-2021-47395.md): mac80211: limit injected vht mcs/nss in ieee80211\_parse\_tx\_radiotap (no CVSS, Linux)
- [CVE-2021-47394](https://cve.now/CVE-2021-47394.md): netfilter: nf\_tables: unlink table before deleting it (CVSS 7.8, Linux)
- [CVE-2021-47393](https://cve.now/CVE-2021-47393.md): hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (no CVSS, Linux)
- [CVE-2021-47392](https://cve.now/CVE-2021-47392.md): RDMA/cma: Fix listener leak in rdma\_cma\_listen\_on\_all() failure (no CVSS, Linux)
- [CVE-2021-47391](https://cve.now/CVE-2021-47391.md): RDMA/cma: Ensure rdma\_addr\_cancel() happens before issuing more requests (CVSS 7.8, Linux)
- [CVE-2021-47390](https://cve.now/CVE-2021-47390.md): KVM: x86: Fix stack-out-of-bounds memory access from ioapic\_write\_indirect() (CVSS 8.8, Linux)
- [CVE-2021-47389](https://cve.now/CVE-2021-47389.md): KVM: SVM: fix missing sev\_decommission in sev\_receive\_start (CVSS 5.1, Linux)
- [CVE-2021-47388](https://cve.now/CVE-2021-47388.md): mac80211: fix use-after-free in CCMP/GCMP RX (CVSS 8.8, Linux)
- [CVE-2021-47387](https://cve.now/CVE-2021-47387.md): cpufreq: schedutil: Use kobject release() method to free sugov\_tunables (no CVSS, Linux)
- [CVE-2021-47386](https://cve.now/CVE-2021-47386.md): hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (CVSS 7.8, Linux)
- [CVE-2021-47385](https://cve.now/CVE-2021-47385.md): hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (no CVSS, Linux)
- [CVE-2021-47384](https://cve.now/CVE-2021-47384.md): hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (CVSS 5.3, Linux)
- [CVE-2021-47383](https://cve.now/CVE-2021-47383.md): tty: Fix out-of-bound vmalloc access in imageblit (CVSS 7.8, Linux)
- [CVE-2021-47382](https://cve.now/CVE-2021-47382.md): s390/qeth: fix deadlock during failing recovery (no CVSS, Linux)
- [CVE-2021-47381](https://cve.now/CVE-2021-47381.md): ASoC: SOF: Fix DSP oops stack dump output contents (no CVSS, Linux)
- [CVE-2021-47380](https://cve.now/CVE-2021-47380.md): HID: amd\_sfh: Fix potential NULL pointer dereference (CVSS 7.8, Linux)
- [CVE-2021-47379](https://cve.now/CVE-2021-47379.md): blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd (no CVSS, Linux)
- [CVE-2021-47378](https://cve.now/CVE-2021-47378.md): nvme-rdma: destroy cm id before destroy qp to avoid use after free (CVSS 9.8, Linux)
- [CVE-2021-47376](https://cve.now/CVE-2021-47376.md): bpf: Add oversize check before call kvcalloc() (no CVSS, Linux)
- [CVE-2021-47375](https://cve.now/CVE-2021-47375.md): blktrace: Fix uaf in blk\_trace access after removing by sysfs (CVSS 6.2, Linux)
- [CVE-2021-47374](https://cve.now/CVE-2021-47374.md): dma-debug: prevent an error message from causing runtime problems (CVSS 7.5, Linux)
- [CVE-2021-47373](https://cve.now/CVE-2021-47373.md): irqchip/gic-v3-its: Fix potential VPE leak on error (no CVSS, Linux)
- [CVE-2021-47372](https://cve.now/CVE-2021-47372.md): net: macb: fix use after free on rmmod (no CVSS, Linux)
- [CVE-2021-47371](https://cve.now/CVE-2021-47371.md): nexthop: Fix memory leaks in nexthop notification chain listeners (CVSS 7.1, Linux)
- [CVE-2021-47370](https://cve.now/CVE-2021-47370.md): mptcp: ensure tx skbs always have the MPTCP ext (no CVSS, Linux)
- [CVE-2021-47369](https://cve.now/CVE-2021-47369.md): s390/qeth: fix NULL deref in qeth\_clear\_working\_pool\_list() (CVSS 5.5, Linux)
- [CVE-2021-47368](https://cve.now/CVE-2021-47368.md): enetc: Fix illegal access when reading affinity\_hint (CVSS 7.1, Linux)
- [CVE-2021-47367](https://cve.now/CVE-2021-47367.md): virtio-net: fix pages leaking when building skb in big mode (CVSS 5.5, Linux)
- [CVE-2021-47366](https://cve.now/CVE-2021-47366.md): afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server (CVSS 7.1, Linux)
- [CVE-2021-47365](https://cve.now/CVE-2021-47365.md): afs: Fix page leak (no CVSS, Linux)
- [CVE-2021-47364](https://cve.now/CVE-2021-47364.md): comedi: Fix memory leak in compat\_insnlist() (no CVSS, Linux)
- [CVE-2021-47363](https://cve.now/CVE-2021-47363.md): nexthop: Fix division by zero while replacing a resilient group (no CVSS, Linux)
- [CVE-2021-47362](https://cve.now/CVE-2021-47362.md): drm/amd/pm: Update intermediate power state for SI (no CVSS, Linux)
- [CVE-2021-47361](https://cve.now/CVE-2021-47361.md): mcb: fix error handling in mcb\_alloc\_bus() (no CVSS, Linux)
- [CVE-2021-47360](https://cve.now/CVE-2021-47360.md): binder: make sure fd closes complete (no CVSS, Linux)
- [CVE-2021-47359](https://cve.now/CVE-2021-47359.md): cifs: Fix soft lockup during fsstress (no CVSS, Linux)
- [CVE-2020-36788](https://cve.now/CVE-2020-36788.md): drm/nouveau: avoid a use-after-free when BO init fails (CVSS 7.8, Linux)
- [CVE-2024-33527](https://cve.now/CVE-2024-33527.md): A Stored Cross-site Scripting (XSS) vulnerability in the "Import of Users and login name of user" feature in ILIAS 7 before 7.30 and ILIAS 8 (CVSS 5.4)
- [CVE-2024-33526](https://cve.now/CVE-2024-33526.md): A Stored Cross-site Scripting (XSS) vulnerability in the "Import of user role and title of user role" feature in ILIAS 7 before 7.30 and ILI (CVSS 7.1)
- [CVE-2024-33529](https://cve.now/CVE-2024-33529.md): ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to exec (CVSS 7.2)
- [CVE-2021-47358](https://cve.now/CVE-2021-47358.md): staging: greybus: uart: fix tty use after free (CVSS 7.8, Linux)
- [CVE-2024-33528](https://cve.now/CVE-2024-33528.md): A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with (CVSS 4.7)
- [CVE-2021-47357](https://cve.now/CVE-2021-47357.md): atm: iphase: fix possible use-after-free in ia\_module\_exit() (no CVSS, Linux)
- [CVE-2021-47356](https://cve.now/CVE-2021-47356.md): mISDN: fix possible use-after-free in HFC\_cleanup() (CVSS 7.7, Linux)
- [CVE-2021-47355](https://cve.now/CVE-2021-47355.md): atm: nicstar: Fix possible use-after-free in nicstar\_cleanup() (no CVSS, Linux)
- [CVE-2021-47354](https://cve.now/CVE-2021-47354.md): drm/sched: Avoid data corruptions (CVSS 7.1, Linux)
- [CVE-2021-47353](https://cve.now/CVE-2021-47353.md): udf: Fix NULL pointer dereference in udf\_symlink function (no CVSS, Linux)
- [CVE-2021-47352](https://cve.now/CVE-2021-47352.md): virtio-net: Add validation for used length (CVSS 8.4, Linux)
- [CVE-2021-47351](https://cve.now/CVE-2021-47351.md): ubifs: Fix races between xattr\_{set|get} and listxattr operations (CVSS 7.8, Linux)
- [CVE-2021-47350](https://cve.now/CVE-2021-47350.md): powerpc/mm: Fix lockup on kernel exec fault (CVSS 5.5, Linux)
- [CVE-2021-47349](https://cve.now/CVE-2021-47349.md): mwifiex: bring down link before deleting interface (no CVSS, Linux)
- [CVE-2021-47348](https://cve.now/CVE-2021-47348.md): drm/amd/display: Avoid HDCP over-read and corruption (CVSS 9.1, Linux)
- [CVE-2021-47347](https://cve.now/CVE-2021-47347.md): wl1251: Fix possible buffer overflow in wl1251\_cmd\_scan (CVSS 7.8, Linux)
- [CVE-2021-47346](https://cve.now/CVE-2021-47346.md): coresight: tmc-etf: Fix global-out-of-bounds in tmc\_update\_etf\_buffer() (CVSS 7.1, Linux)
- [CVE-2021-47345](https://cve.now/CVE-2021-47345.md): RDMA/cma: Fix rdma\_resolve\_route() memory leak (no CVSS, Linux)
- [CVE-2021-47344](https://cve.now/CVE-2021-47344.md): media: zr364xx: fix memory leak in zr364xx\_start\_readpipe (no CVSS, Linux)
- [CVE-2021-47343](https://cve.now/CVE-2021-47343.md): dm btree remove: assign new\_root only when removal succeeds (CVSS 7.8, Linux)
- [CVE-2021-47342](https://cve.now/CVE-2021-47342.md): ext4: fix possible UAF when remounting r/o a mmp-protected file system (no CVSS, Linux)
- [CVE-2021-47341](https://cve.now/CVE-2021-47341.md): KVM: mmio: Fix use-after-free Read in kvm\_vm\_ioctl\_unregister\_coalesced\_mmio (CVSS 7.8, Linux)
- [CVE-2021-47340](https://cve.now/CVE-2021-47340.md): jfs: fix GPF in diFree (no CVSS, Linux)
- [CVE-2021-47339](https://cve.now/CVE-2021-47339.md): media: v4l2-core: explicitly clear ioctl input data (no CVSS, Linux)
- [CVE-2021-47338](https://cve.now/CVE-2021-47338.md): fbmem: Do not delete the mode that is still in use (CVSS 7.8, Linux)
- [CVE-2021-47337](https://cve.now/CVE-2021-47337.md): scsi: core: Fix bad pointer dereference when ehandler kthread is invalid (no CVSS, Linux)
- [CVE-2021-47336](https://cve.now/CVE-2021-47336.md): smackfs: restrict bytes count in smk\_set\_cipso() (no CVSS, Linux)
- [CVE-2021-47335](https://cve.now/CVE-2021-47335.md): f2fs: fix to avoid racing on fsync\_entry\_slab by multi filesystem instances (no CVSS, Linux)
- [CVE-2021-47334](https://cve.now/CVE-2021-47334.md): misc/libmasm/module: Fix two use after free in ibmasm\_init\_one (no CVSS, Linux)
- [CVE-2021-47333](https://cve.now/CVE-2021-47333.md): misc: alcor\_pci: fix null-ptr-deref when there is no PCI bridge (CVSS 5.5, Linux)
- [CVE-2021-47332](https://cve.now/CVE-2021-47332.md): ALSA: usx2y: Don't call free\_pages\_exact() with NULL address (no CVSS, Linux)
- [CVE-2021-47331](https://cve.now/CVE-2021-47331.md): usb: common: usb-conn-gpio: fix NULL pointer dereference of charger (no CVSS, Linux)
- [CVE-2021-47330](https://cve.now/CVE-2021-47330.md): tty: serial: 8250: serial\_cs: Fix a memory leak in error handling path (no CVSS, Linux)
- [CVE-2021-47329](https://cve.now/CVE-2021-47329.md): scsi: megaraid\_sas: Fix resource leak in case of probe failure (CVSS 6.2, Linux)
- [CVE-2021-47328](https://cve.now/CVE-2021-47328.md): scsi: iscsi: Fix conn use after free during resets (CVSS 9.8, Linux)
- [CVE-2021-47327](https://cve.now/CVE-2021-47327.md): iommu/arm-smmu: Fix arm\_smmu\_device refcount leak when arm\_smmu\_rpm\_get fails (CVSS 7.1, Linux)
- [CVE-2021-47325](https://cve.now/CVE-2021-47325.md): iommu/arm-smmu: Fix arm\_smmu\_device refcount leak in address translation (no CVSS, Linux)
- [CVE-2021-47324](https://cve.now/CVE-2021-47324.md): watchdog: Fix possible use-after-free in wdt\_startup() (CVSS 8.8, Linux)
- [CVE-2021-47323](https://cve.now/CVE-2021-47323.md): watchdog: sc520\_wdt: Fix possible use-after-free in wdt\_turnoff() (CVSS 8.8, Linux)
- [CVE-2021-47322](https://cve.now/CVE-2021-47322.md): NFSv4: Fix an Oops in pnfs\_mark\_request\_commit() when doing O\_DIRECT (no CVSS, Linux)
- [CVE-2021-47321](https://cve.now/CVE-2021-47321.md): watchdog: Fix possible use-after-free by calling del\_timer\_sync() (no CVSS, Linux)
- [CVE-2021-47320](https://cve.now/CVE-2021-47320.md): nfs: fix acl memory leak of posix\_acl\_create() (no CVSS, Linux)
- [CVE-2021-47319](https://cve.now/CVE-2021-47319.md): virtio-blk: Fix memory leak among suspend/resume procedure (no CVSS, Linux)
- [CVE-2021-47318](https://cve.now/CVE-2021-47318.md): arch\_topology: Avoid use-after-free for scale\_freq\_data (no CVSS, Linux)
- [CVE-2021-47317](https://cve.now/CVE-2021-47317.md): powerpc/bpf: Fix detecting BPF atomic instructions (CVSS 7.8, Linux)
- [CVE-2021-47316](https://cve.now/CVE-2021-47316.md): nfsd: fix NULL dereference in nfs3svc\_encode\_getaclres (CVSS 7.5, Linux)
- [CVE-2021-47315](https://cve.now/CVE-2021-47315.md): memory: fsl\_ifc: fix leak of IO mapping on probe failure (no CVSS, Linux)
- [CVE-2021-47314](https://cve.now/CVE-2021-47314.md): memory: fsl\_ifc: fix leak of private memory on probe failure (no CVSS, Linux)
- [CVE-2021-47313](https://cve.now/CVE-2021-47313.md): cpufreq: CPPC: Fix potential memleak in cppc\_cpufreq\_cpu\_init (CVSS 8.4, Linux)
- [CVE-2021-47312](https://cve.now/CVE-2021-47312.md): netfilter: nf\_tables: Fix dereference of null pointer flow (CVSS 5.5, Linux)
- [CVE-2021-47311](https://cve.now/CVE-2021-47311.md): net: qcom/emac: fix UAF in emac\_remove (no CVSS, Linux)
- [CVE-2021-47310](https://cve.now/CVE-2021-47310.md): net: ti: fix UAF in tlan\_remove\_one (no CVSS, Linux)
- [CVE-2021-47309](https://cve.now/CVE-2021-47309.md): net: validate lwtstate-\>data before returning from skb\_tunnel\_info() (CVSS 7.8, Linux)
- [CVE-2021-47308](https://cve.now/CVE-2021-47308.md): scsi: libfc: Fix array index out of bound exception (CVSS 8.8, Linux)
- [CVE-2021-47307](https://cve.now/CVE-2021-47307.md): cifs: prevent NULL deref in cifs\_compose\_mount\_options() (CVSS 7.5, Linux)
- [CVE-2021-47306](https://cve.now/CVE-2021-47306.md): net: fddi: fix UAF in fza\_probe (no CVSS, Linux)
- [CVE-2021-47305](https://cve.now/CVE-2021-47305.md): dma-buf/sync\_file: Don't leak fences on merge failure (no CVSS, Linux)
- [CVE-2021-47304](https://cve.now/CVE-2021-47304.md): tcp: fix tcp\_init\_transfer() to not reset icsk\_ca\_initialized (no CVSS, Linux)
- [CVE-2021-47303](https://cve.now/CVE-2021-47303.md): bpf: Track subprog poke descriptors correctly and fix use-after-free (CVSS 7.8, Linux)
- [CVE-2021-47302](https://cve.now/CVE-2021-47302.md): igc: Fix use-after-free error during reset (no CVSS, Linux)
- [CVE-2021-47301](https://cve.now/CVE-2021-47301.md): igb: Fix use-after-free error during reset (no CVSS, Linux)
- [CVE-2021-47300](https://cve.now/CVE-2021-47300.md): bpf: Fix tail\_call\_reachable rejection for interpreter when jit failed (CVSS 7.8, Linux)
- [CVE-2021-47299](https://cve.now/CVE-2021-47299.md): xdp, net: Fix use-after-free in bpf\_xdp\_link\_release (no CVSS, Linux)
- [CVE-2021-47298](https://cve.now/CVE-2021-47298.md): bpf, sockmap: Fix potential memory leak on unlikely error case (no CVSS, Linux)
- [CVE-2021-47297](https://cve.now/CVE-2021-47297.md): net: fix uninit-value in caif\_seqpkt\_sendmsg (CVSS 5.5, Linux)
- [CVE-2021-47296](https://cve.now/CVE-2021-47296.md): KVM: PPC: Fix kvm\_arch\_vcpu\_ioctl vcpu\_load leak (CVSS 7.8, Linux)
- [CVE-2021-47295](https://cve.now/CVE-2021-47295.md): net: sched: fix memory leak in tcindex\_partial\_destroy\_work (CVSS 7.5, Linux)
- [CVE-2021-47294](https://cve.now/CVE-2021-47294.md): netrom: Decrease sock refcount when sock timers expire (no CVSS, Linux)
- [CVE-2021-47293](https://cve.now/CVE-2021-47293.md): net/sched: act\_skbmod: Skip non-Ethernet packets (no CVSS, Linux)
- [CVE-2021-47292](https://cve.now/CVE-2021-47292.md): io\_uring: fix memleak in io\_init\_wq\_offload() (no CVSS, Linux)
- [CVE-2021-47291](https://cve.now/CVE-2021-47291.md): ipv6: fix another slab-out-of-bounds in fib6\_nh\_flush\_exceptions (CVSS 7.8, Linux)
- [CVE-2021-47290](https://cve.now/CVE-2021-47290.md): scsi: target: Fix NULL dereference on XCOPY completion (CVSS 7.5, Linux)
- [CVE-2021-47289](https://cve.now/CVE-2021-47289.md): ACPI: fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2021-47288](https://cve.now/CVE-2021-47288.md): media: ngene: Fix out-of-bounds bug in ngene\_command\_config\_free\_buf() (no CVSS, Linux)
- [CVE-2021-47287](https://cve.now/CVE-2021-47287.md): driver core: auxiliary bus: Fix memory leak when driver\_register() fail (no CVSS, Linux)
- [CVE-2021-47286](https://cve.now/CVE-2021-47286.md): bus: mhi: core: Validate channel ID when processing command completions (no CVSS, Linux)
- [CVE-2021-47284](https://cve.now/CVE-2021-47284.md): isdn: mISDN: netjet: Fix crash in nj\_probe: (CVSS 4.7, Linux)
- [CVE-2021-47283](https://cve.now/CVE-2021-47283.md): net:sfc: fix non-freed irq in legacy irq mode (no CVSS, Linux)
- [CVE-2021-47282](https://cve.now/CVE-2021-47282.md): spi: bcm2835: Fix out-of-bounds access with more than 4 slaves (CVSS 7.8, Linux)
- [CVE-2021-47281](https://cve.now/CVE-2021-47281.md): ALSA: seq: Fix race of snd\_seq\_timer\_open() (CVSS 7.8, Linux)
- [CVE-2021-47280](https://cve.now/CVE-2021-47280.md): drm: Fix use-after-free read in drm\_getunique() (no CVSS, Linux)
- [CVE-2021-47279](https://cve.now/CVE-2021-47279.md): usb: misc: brcmstb-usb-pinmap: check return value after calling platform\_get\_resource() (no CVSS, Linux)
- [CVE-2021-47278](https://cve.now/CVE-2021-47278.md): bus: mhi: pci\_generic: Fix possible use-after-free in mhi\_pci\_remove() (no CVSS, Linux)
- [CVE-2021-47277](https://cve.now/CVE-2021-47277.md): kvm: avoid speculation-based attacks from out-of-range memslot accesses (no CVSS, Linux)
- [CVE-2021-47276](https://cve.now/CVE-2021-47276.md): ftrace: Do not blindly read the ip address in ftrace\_bug() (no CVSS, Linux)
- [CVE-2021-47275](https://cve.now/CVE-2021-47275.md): bcache: avoid oversized read request in cache missing code path (no CVSS, Linux)
- [CVE-2021-47274](https://cve.now/CVE-2021-47274.md): tracing: Correct the length check which causes memory corruption (CVSS 7.8, Linux)
- [CVE-2021-47273](https://cve.now/CVE-2021-47273.md): usb: dwc3-meson-g12a: fix usb2 PHY glue init when phy0 is disabled (no CVSS, Linux)
- [CVE-2021-47272](https://cve.now/CVE-2021-47272.md): usb: dwc3: gadget: Bail from dwc3\_gadget\_exit() if dwc-\>gadget is NULL (no CVSS, Linux)
- [CVE-2021-47271](https://cve.now/CVE-2021-47271.md): usb: cdnsp: Fix deadlock issue in cdnsp\_thread\_irq\_handler (CVSS 5.5, Linux)
- [CVE-2021-47270](https://cve.now/CVE-2021-47270.md): usb: fix various gadgets null ptr deref on 10gbps cabling. (no CVSS, Linux)
- [CVE-2021-47269](https://cve.now/CVE-2021-47269.md): usb: dwc3: ep0: fix NULL pointer exception (no CVSS, Linux)
- [CVE-2021-47268](https://cve.now/CVE-2021-47268.md): usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port (no CVSS, Linux)
- [CVE-2021-47267](https://cve.now/CVE-2021-47267.md): usb: fix various gadget panics on 10gbps cabling (CVSS 6.3, Linux)
- [CVE-2021-47266](https://cve.now/CVE-2021-47266.md): RDMA/ipoib: Fix warning caused by destroying non-initial netns (no CVSS, Linux)
- [CVE-2021-47265](https://cve.now/CVE-2021-47265.md): RDMA: Verify port when creating flow rule (no CVSS, Linux)
- [CVE-2021-47264](https://cve.now/CVE-2021-47264.md): ASoC: core: Fix Null-point-dereference in fmt\_single\_name() (no CVSS, Linux)
- [CVE-2021-47263](https://cve.now/CVE-2021-47263.md): gpio: wcd934x: Fix shift-out-of-bounds error (no CVSS, Linux)
- [CVE-2021-47262](https://cve.now/CVE-2021-47262.md): KVM: x86: Ensure liveliness of nested VM-Enter fail tracepoint message (CVSS 7.1, Linux)
- [CVE-2021-47261](https://cve.now/CVE-2021-47261.md): IB/mlx5: Fix initializing CQ fragments buffer (CVSS 7.8, Linux)
- [CVE-2021-47260](https://cve.now/CVE-2021-47260.md): NFS: Fix a potential NULL dereference in nfs\_get\_client() (no CVSS, Linux)
- [CVE-2021-47259](https://cve.now/CVE-2021-47259.md): NFS: Fix use-after-free in nfs4\_init\_client() (CVSS 7.8, Linux)
- [CVE-2021-47258](https://cve.now/CVE-2021-47258.md): scsi: core: Fix error handling of scsi\_host\_alloc() (no CVSS, Linux)
- [CVE-2021-47257](https://cve.now/CVE-2021-47257.md): net: ieee802154: fix null deref in parse dev addr (CVSS 5.5, Linux)
- [CVE-2021-47256](https://cve.now/CVE-2021-47256.md): mm/memory-failure: make sure wait for page writeback in memory\_failure (no CVSS, Linux)
- [CVE-2021-47255](https://cve.now/CVE-2021-47255.md): kvm: LAPIC: Restore guard to prevent illegal APIC register access (no CVSS, Linux)
- [CVE-2021-47254](https://cve.now/CVE-2021-47254.md): gfs2: Fix use-after-free in gfs2\_glock\_shrink\_scan (CVSS 7.8, Linux)
- [CVE-2021-47253](https://cve.now/CVE-2021-47253.md): drm/amd/display: Fix potential memory leak in DMUB hw\_init (no CVSS, Linux)
- [CVE-2021-47252](https://cve.now/CVE-2021-47252.md): batman-adv: Avoid WARN\_ON timing related checks (no CVSS, Linux)
- [CVE-2021-47251](https://cve.now/CVE-2021-47251.md): mac80211: fix skb length check in ieee80211\_scan\_rx() (no CVSS, Linux)
- [CVE-2021-47250](https://cve.now/CVE-2021-47250.md): net: ipv4: fix memory leak in netlbl\_cipsov4\_add\_std (no CVSS, Linux)
- [CVE-2021-47249](https://cve.now/CVE-2021-47249.md): net: rds: fix memory leak in rds\_recvmsg (no CVSS, Linux)
- [CVE-2021-47248](https://cve.now/CVE-2021-47248.md): udp: fix race between close() and udp\_abort() (CVSS 7.8, Linux)
- [CVE-2021-47247](https://cve.now/CVE-2021-47247.md): net/mlx5e: Fix use-after-free of encap entry in neigh update handler (CVSS 7.8, Linux)
- [CVE-2021-47246](https://cve.now/CVE-2021-47246.md): net/mlx5e: Fix page reclaim for dead peer hairpin (no CVSS, Linux)
- [CVE-2021-47245](https://cve.now/CVE-2021-47245.md): netfilter: synproxy: Fix out of bounds when parsing TCP options (CVSS 8.2, Linux)
- [CVE-2021-47244](https://cve.now/CVE-2021-47244.md): mptcp: Fix out of bounds when parsing TCP options (CVSS 8.2, Linux)
- [CVE-2021-47243](https://cve.now/CVE-2021-47243.md): sch\_cake: Fix out of bounds when parsing TCP options and header (CVSS 7.1, Linux)
- [CVE-2021-47242](https://cve.now/CVE-2021-47242.md): mptcp: fix soft lookup in subflow\_error\_report() (CVSS 7.5, Linux)
- [CVE-2021-47241](https://cve.now/CVE-2021-47241.md): ethtool: strset: fix message length calculation (CVSS 7.5, Linux)
- [CVE-2021-47240](https://cve.now/CVE-2021-47240.md): net: qrtr: fix OOB Read in qrtr\_endpoint\_post (CVSS 8.4, Linux)
- [CVE-2021-47239](https://cve.now/CVE-2021-47239.md): net: usb: fix possible use-after-free in smsc75xx\_bind (no CVSS, Linux)
- [CVE-2021-47238](https://cve.now/CVE-2021-47238.md): net: ipv4: fix memory leak in ip\_mc\_add1\_src (CVSS 5.5, Linux)
- [CVE-2021-47237](https://cve.now/CVE-2021-47237.md): net: hamradio: fix memory leak in mkiss\_close (no CVSS, Linux)
- [CVE-2021-47236](https://cve.now/CVE-2021-47236.md): net: cdc\_eem: fix tx fixup skb leak (no CVSS, Linux)
- [CVE-2021-47235](https://cve.now/CVE-2021-47235.md): net: ethernet: fix potential use-after-free in ec\_bhf\_remove (no CVSS, Linux)
- [CVE-2021-47234](https://cve.now/CVE-2021-47234.md): phy: phy-mtk-tphy: Fix some resource leaks in mtk\_phy\_init() (no CVSS, Linux)
- [CVE-2021-47233](https://cve.now/CVE-2021-47233.md): regulator: rt4801: Fix NULL pointer dereference if priv-\>enable\_gpios is NULL (no CVSS, Linux)
- [CVE-2021-47232](https://cve.now/CVE-2021-47232.md): can: j1939: fix Use-after-Free, hold skb ref while in use (CVSS 9.8, Linux)
- [CVE-2021-47231](https://cve.now/CVE-2021-47231.md): can: mcba\_usb: fix memory leak in mcba\_usb (CVSS 5.5, Linux)
- [CVE-2021-47230](https://cve.now/CVE-2021-47230.md): KVM: x86: Immediately reset the MMU context when the SMM flag is cleared (CVSS 6.6, Linux)
- [CVE-2021-47229](https://cve.now/CVE-2021-47229.md): PCI: aardvark: Fix kernel panic during PIO transfer (no CVSS, Linux)
- [CVE-2021-47228](https://cve.now/CVE-2021-47228.md): x86/ioremap: Map EFI-reserved memory as encrypted for SEV (CVSS 6.2, Linux)
- [CVE-2021-47227](https://cve.now/CVE-2021-47227.md): x86/fpu: Prevent state corruption in \_\_fpu\_\_restore\_sig() (no CVSS, Linux)
- [CVE-2021-47226](https://cve.now/CVE-2021-47226.md): x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer (CVSS 7.1, Linux)
- [CVE-2021-47225](https://cve.now/CVE-2021-47225.md): mac80211: fix deadlock in AP/VLAN handling (CVSS 5.5, Linux)
- [CVE-2021-47224](https://cve.now/CVE-2021-47224.md): net: ll\_temac: Make sure to free skb when it is completely used (CVSS 7.8, Linux)
- [CVE-2021-47223](https://cve.now/CVE-2021-47223.md): net: bridge: fix vlan tunnel dst null pointer dereference (no CVSS, Linux)
- [CVE-2021-47222](https://cve.now/CVE-2021-47222.md): net: bridge: fix vlan tunnel dst refcnt when egressing (CVSS 7.8, Linux)
- [CVE-2021-47221](https://cve.now/CVE-2021-47221.md): mm/slub: actually fix freelist pointer vs redzoning (no CVSS, Linux)
- [CVE-2024-4452](https://cve.now/CVE-2024-4452.md): ElementsKit Pro \<= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpmet ElementsKit Pro)
- [CVE-2024-35218](https://cve.now/CVE-2024-35218.md): Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane (CVSS 4.2, Umbraco-CMS · UmbracoCms.Core)
- [CVE-2024-35385](https://cve.now/CVE-2024-35385.md): An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs\_mk\_ffi\_sig function in the mjs.c file. (CVSS 4.3)
- [CVE-2024-35384](https://cve.now/CVE-2024-35384.md): An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs\_array\_length function in the mjs.c file. (CVSS 5.5)
- [CVE-2024-35386](https://cve.now/CVE-2024-35386.md): An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs\_do\_gc function in the mjs.c file. (CVSS 7.5)
- [CVE-2023-3943](https://cve.now/CVE-2023-3943.md): Multiple buffer overflow in ZkTeco-based OEM devices (CVSS 10.0, ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-735…)
- [CVE-2024-34071](https://cve.now/CVE-2024-34071.md): Open Redirect Bypass Protection (CVSS 6.1, Umbraco-CMS · UmbracoCms.Core +1)
- [CVE-2024-35180](https://cve.now/CVE-2024-35180.md): OMERO.web JSONP callback vulnerability (CVSS 6.1, omero-web)
- [CVE-2023-3942](https://cve.now/CVE-2023-3942.md): Multiple SQLi in ZkTeco-based OEM devices (CVSS 7.5, ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-735…)
- [CVE-2024-35361](https://cve.now/CVE-2024-35361.md): MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. (CVSS 9.8)
- [CVE-2024-4420](https://cve.now/CVE-2024-4420.md): Denial of Service in Tink-cc (CVSS 6.8, Google Tink)
- [CVE-2024-3268](https://cve.now/CVE-2024-3268.md): YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress \<= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation (CVSS 5.3, emarket-design Video Gallery – YouTube Gallery & Responsive…)
- [CVE-2024-4619](https://cve.now/CVE-2024-4619.md): Elementor Website Builder – More than Just a Page Builder \<= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, elemntor Elementor Website Builder – more than just a page…)
- [CVE-2024-4361](https://cve.now/CVE-2024-4361.md): Page Builder by SiteOrigin \<= 2.29.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin\_widget' Shortcode (CVSS 6.4, gpriday Page Builder by SiteOrigin)
- [CVE-2024-4876](https://cve.now/CVE-2024-4876.md): HT Mega – Absolute Addons For Elementor \<= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2023-3941](https://cve.now/CVE-2023-3941.md): Multiple arbitrary file writes in ZkTeco-based OEM devices (CVSS 10.0, ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-735…)
- [CVE-2023-3940](https://cve.now/CVE-2023-3940.md): Multiple arbitrary file reads in ZkTeco-based OEM devices (CVSS 7.5, ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-735…)
- [CVE-2024-4988](https://cve.now/CVE-2024-4988.md): Improper permission control in com.transsion.videocallenhancer (CVSS 7.5, TECNO com.transsion.videocallenhancer)
- [CVE-2023-3939](https://cve.now/CVE-2023-3939.md): Multiple command injection in ZkTeco-based OEM devices (CVSS 10.0, ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-735…)
- [CVE-2024-4435](https://cve.now/CVE-2024-4435.md): BTreeMap memory leak when deallocating nodes with overflows (CVSS 5.9, Internet Computer ic-stable-structures · ic-stable-structur…)
- [CVE-2023-3938](https://cve.now/CVE-2023-3938.md): Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code (CVSS 4.6, ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-735…)
- [CVE-2024-4553](https://cve.now/CVE-2024-4553.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via su\_members Shortcode (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-4695](https://cve.now/CVE-2024-4695.md): Move Addons for Elementor \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, moveaddons Move Addons for Elementor)
- [CVE-2024-4700](https://cve.now/CVE-2024-4700.md): WP Table Builder – WordPress Table Plugin \<= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wptb WP Table Builder – Drag & Drop Table Builder)
- [CVE-2024-3345](https://cve.now/CVE-2024-3345.md): ShopLentor \<= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode (CVSS 6.4, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-4566](https://cve.now/CVE-2024-4566.md): ShopLentor \<= 2.8.8 - Missing Authorization to WordPress Option Modification (CVSS 7.1, devitemsllc ShopLentor – All-in-One WooCommerce Growth & St…)
- [CVE-2024-4875](https://cve.now/CVE-2024-4875.md): HT Mega – Absolute Addons For Elementor \<= 2.5.2 - Missing Authorization to Options Update (CVSS 4.3, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-4442](https://cve.now/CVE-2024-4442.md): Salon booking system \<= 9.9 - Unauthenticated Arbitrary File Deletion (CVSS 9.1, wordpresschef Salon Booking System – Free Version)
- [CVE-2024-4470](https://cve.now/CVE-2024-4470.md): Master Slider – Responsive Touch Slider \<= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, averta Master Slider – Responsive Touch Slider)
- [CVE-2024-4710](https://cve.now/CVE-2024-4710.md): Uber Menu \<= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (CVSS 6.4, SevenSpark UberMenu)
- [CVE-2024-4372](https://cve.now/CVE-2024-4372.md): Carousel Slider \< 2.2.11 - Editor+ Stored XSS (CVSS 5.4, Carousel Slider)
- [CVE-2024-4290](https://cve.now/CVE-2024-4290.md): Sailthru Triggermail \<= 1.1 - Admin+ Stored XSS (CVSS 7.1, Sailthru Triggermail)
- [CVE-2024-4289](https://cve.now/CVE-2024-4289.md): Sailthru Triggermail \<= 1.1 - Reflected XSS (CVSS 6.1, Sailthru Triggermail)
- [CVE-2024-4061](https://cve.now/CVE-2024-4061.md): Survey Maker \< 4.2.9 - Admin+ Stored XSS via Plugin Settings (CVSS 4.8, Survey Maker)
- [CVE-2024-2189](https://cve.now/CVE-2024-2189.md): Social Icons Widget & Block \< 4.2.18 - Admin+ Stored XSS (CVSS 6.1, Social Icons Widget & Block by WPZOOM)
- [CVE-2024-4943](https://cve.now/CVE-2024-4943.md): Blocksy \<= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, creativethemeshq Blocksy)
- [CVE-2024-3155](https://cve.now/CVE-2024-3155.md): Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks \<= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, pickplugins Post Grid)
- [CVE-2024-0816](https://cve.now/CVE-2024-0816.md): The buffer overflow vulnerability in the DX3300-T1 firmware version V5.50(ABVY.4)C0 could allow an authenticated local attacker to cause den (CVSS 5.5, Zyxel DX3300-T1 firmware)
- [CVE-2023-37929](https://cve.now/CVE-2023-37929.md): The buffer overflow vulnerability in the CGI program of the VMG3625-T50B firmware version V5.50(ABPM.8)C0 could allow an authenticated remot (CVSS 6.5, Zyxel V5.50(ABPM.8)C0 firmware)
- [CVE-2024-35056](https://cve.now/CVE-2024-35056.md): NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query\_packets and insert functions. (CVSS 9.8, ait-core)
- [CVE-2024-35057](https://cve.now/CVE-2024-35057.md): An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet. (CVSS 7.5, ait-core)
- [CVE-2024-35058](https://cve.now/CVE-2024-35058.md): An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string. (CVSS 7.5, ait-core)
- [CVE-2024-35059](https://cve.now/CVE-2024-35059.md): An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands. (CVSS 7.5, ait-core)
- [CVE-2024-35060](https://cve.now/CVE-2024-35060.md): An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file (CVSS 7.5)
- [CVE-2024-35061](https://cve.now/CVE-2024-35061.md): NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-th (CVSS 7.3, ait-core)
- [CVE-2024-36039](https://cve.now/CVE-2024-36039.md): PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape\_dict. (CVSS 6.3, pymysql)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.