# CVEs published 2024-05-24

129 CVEs were published on May 24, 2024: 14 critical, 29 high. Days are UTC.

- [CVE-2024-36079](https://cve.now/CVE-2024-36079.md): An issue was discovered in Vaultize 21.07.27. (CVSS 6.5)
- [CVE-2024-35232](https://cve.now/CVE-2024-35232.md): github.com/huandu/facebook may expose access\_token in error message (CVSS 3.7, huandu facebook · github.com/huandu/facebook/v2 +1)
- [CVE-2024-35374](https://cve.now/CVE-2024-35374.md): Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql\_case input field in /web/generate.php, allowing remote attackers to (CVSS 9.8, mocodo)
- [CVE-2024-35373](https://cve.now/CVE-2024-35373.md): Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php. (CVSS 9.8)
- [CVE-2024-33471](https://cve.now/CVE-2024-33471.md): An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafte (CVSS 7.2)
- [CVE-2024-35388](https://cve.now/CVE-2024-35388.md): TOTOLINK NR1800X v9.1.0u.6681\_B20230703 was discovered to contain a stack overflow via the password parameter in the function urldecode (CVSS 8.8)
- [CVE-2024-35387](https://cve.now/CVE-2024-35387.md): TOTOLINK LR350 V9.3.5u.6369\_B20220309 was discovered to contain a stack overflow via the http\_host parameter in the function loginAuth. (CVSS 9.8)
- [CVE-2024-36049](https://cve.now/CVE-2024-36049.md): Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and pas (CVSS 6.5)
- [CVE-2023-46442](https://cve.now/CVE-2023-46442.md): An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS). (CVSS 4.3, org.soot-oss:soot)
- [CVE-2024-34995](https://cve.now/CVE-2024-34995.md): svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserC (CVSS 4.3)
- [CVE-2024-35395](https://cve.now/CVE-2024-35395.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows atta (CVSS 8.8)
- [CVE-2024-35396](https://cve.now/CVE-2024-35396.md): TOTOLINK CP900L v4.1.5cu.798\_B20221228 was discovered to contain a hardcoded password for telnet in /web\_cste/cgi-bin/product.ini, which all (CVSS 9.8)
- [CVE-2023-52880](https://cve.now/CVE-2023-52880.md): tty: n\_gsm: require CAP\_NET\_ADMIN to attach N\_GSM0710 ldisc (CVSS 7.8, Linux)
- [CVE-2021-47572](https://cve.now/CVE-2021-47572.md): net: nexthop: fix null pointer dereference when IPv6 is not enabled (no CVSS, Linux)
- [CVE-2021-47571](https://cve.now/CVE-2021-47571.md): staging: rtl8192e: Fix use after free in \_rtl92e\_pci\_disconnect() (no CVSS, Linux)
- [CVE-2021-47570](https://cve.now/CVE-2021-47570.md): staging: r8188eu: fix a memory leak in rtw\_wx\_read32() (no CVSS, Linux)
- [CVE-2021-47569](https://cve.now/CVE-2021-47569.md): io\_uring: fail cancellation for EXITING tasks (no CVSS, Linux)
- [CVE-2021-47568](https://cve.now/CVE-2021-47568.md): ksmbd: fix memleak in get\_file\_stream\_info() (no CVSS, Linux)
- [CVE-2021-47567](https://cve.now/CVE-2021-47567.md): powerpc/32: Fix hardlockup on vmap stack overflow (no CVSS, Linux)
- [CVE-2021-47566](https://cve.now/CVE-2021-47566.md): proc/vmcore: fix clearing user buffer by properly using clear\_user() (no CVSS, Linux)
- [CVE-2021-47565](https://cve.now/CVE-2021-47565.md): scsi: mpt3sas: Fix kernel panic during drive powercycle test (no CVSS, Linux)
- [CVE-2021-47564](https://cve.now/CVE-2021-47564.md): net: marvell: prestera: fix double free issue on err path (no CVSS, Linux)
- [CVE-2021-47563](https://cve.now/CVE-2021-47563.md): ice: avoid bpf\_prog refcount underflow (CVSS 5.5, Linux)
- [CVE-2021-47562](https://cve.now/CVE-2021-47562.md): ice: fix vsi-\>txq\_map sizing (no CVSS, Linux)
- [CVE-2021-47561](https://cve.now/CVE-2021-47561.md): i2c: virtio: disable timeout handling (CVSS 7.8, Linux)
- [CVE-2021-47560](https://cve.now/CVE-2021-47560.md): mlxsw: spectrum: Protect driver from buggy firmware (no CVSS, Linux)
- [CVE-2021-47559](https://cve.now/CVE-2021-47559.md): net/smc: Fix NULL pointer dereferencing in smc\_vlan\_by\_tcpsk() (CVSS 7.5, Linux)
- [CVE-2021-47558](https://cve.now/CVE-2021-47558.md): net: stmmac: Disable Tx queues when reconfiguring the interface (no CVSS, Linux)
- [CVE-2021-47557](https://cve.now/CVE-2021-47557.md): net/sched: sch\_ets: don't peek at classes beyond 'nbands' (no CVSS, Linux)
- [CVE-2021-47556](https://cve.now/CVE-2021-47556.md): ethtool: ioctl: fix potential NULL deref in ethtool\_set\_coalesce() (no CVSS, Linux)
- [CVE-2021-47555](https://cve.now/CVE-2021-47555.md): net: vlan: fix underflow for the real\_dev refcnt (CVSS 7.8, Linux)
- [CVE-2021-47554](https://cve.now/CVE-2021-47554.md): vdpa\_sim: avoid putting an uninitialized iova\_domain (no CVSS, Linux)
- [CVE-2021-47553](https://cve.now/CVE-2021-47553.md): sched/scs: Reset task stack state in bringup\_cpu() (no CVSS, Linux)
- [CVE-2021-47552](https://cve.now/CVE-2021-47552.md): blk-mq: cancel blk-mq dispatch work in both blk\_cleanup\_queue and disk\_release() (CVSS 7.8, Linux)
- [CVE-2021-47551](https://cve.now/CVE-2021-47551.md): drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again (CVSS 7.8, Linux)
- [CVE-2021-47550](https://cve.now/CVE-2021-47550.md): drm/amd/amdgpu: fix potential memleak (no CVSS, Linux)
- [CVE-2021-47549](https://cve.now/CVE-2021-47549.md): sata\_fsl: fix UAF in sata\_fsl\_port\_stop when rmmod sata\_fsl (no CVSS, Linux)
- [CVE-2021-47548](https://cve.now/CVE-2021-47548.md): ethernet: hisilicon: hns: hns\_dsaf\_misc: fix a possible array overflow in hns\_dsaf\_ge\_srst\_by\_port() (CVSS 9.8, Linux)
- [CVE-2021-47547](https://cve.now/CVE-2021-47547.md): net: tulip: de4x5: fix the problem that the array 'lp-\>phy\[8\]' may be out of bound (CVSS 4.4, Linux)
- [CVE-2021-47546](https://cve.now/CVE-2021-47546.md): ipv6: fix memory leak in fib6\_rule\_suppress (no CVSS, Linux)
- [CVE-2021-47544](https://cve.now/CVE-2021-47544.md): tcp: fix page frag corruption on page fault (CVSS 9.8, Linux)
- [CVE-2021-47542](https://cve.now/CVE-2021-47542.md): net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic\_83xx\_add\_rings() (no CVSS, Linux)
- [CVE-2021-47541](https://cve.now/CVE-2021-47541.md): net/mlx4\_en: Fix an use-after-free bug in mlx4\_en\_try\_alloc\_resources() (CVSS 7.8, Linux)
- [CVE-2021-47540](https://cve.now/CVE-2021-47540.md): mt76: mt7915: fix NULL pointer dereference in mt7915\_get\_phy\_mode (no CVSS, Linux)
- [CVE-2021-47539](https://cve.now/CVE-2021-47539.md): rxrpc: Fix rxrpc\_peer leak in rxrpc\_look\_up\_bundle() (no CVSS, Linux)
- [CVE-2021-47538](https://cve.now/CVE-2021-47538.md): rxrpc: Fix rxrpc\_local leak in rxrpc\_lookup\_peer() (no CVSS, Linux)
- [CVE-2021-47537](https://cve.now/CVE-2021-47537.md): octeontx2-af: Fix a memleak bug in rvu\_mbox\_init() (no CVSS, Linux)
- [CVE-2021-47536](https://cve.now/CVE-2021-47536.md): net/smc: fix wrong list\_del in smc\_lgr\_cleanup\_early (CVSS 9.8, Linux)
- [CVE-2021-47535](https://cve.now/CVE-2021-47535.md): drm/msm/a6xx: Allocate enough space for GMU registers (CVSS 7.8, Linux)
- [CVE-2021-47534](https://cve.now/CVE-2021-47534.md): drm/vc4: kms: Add missing drm\_crtc\_commit\_put (CVSS 4.1, Linux)
- [CVE-2021-47533](https://cve.now/CVE-2021-47533.md): drm/vc4: kms: Clear the HVS FIFO commit pointer once done (CVSS 7.8, Linux)
- [CVE-2021-47532](https://cve.now/CVE-2021-47532.md): drm/msm/devfreq: Fix OPP refcnt leak (no CVSS, Linux)
- [CVE-2021-47531](https://cve.now/CVE-2021-47531.md): drm/msm: Fix mmap to include VM\_IO and VM\_DONTDUMP (no CVSS, Linux)
- [CVE-2021-47530](https://cve.now/CVE-2021-47530.md): drm/msm: Fix wait\_fence submitqueue leak (no CVSS, Linux)
- [CVE-2021-47529](https://cve.now/CVE-2021-47529.md): iwlwifi: Fix memory leaks in error handling path (no CVSS, Linux)
- [CVE-2021-47528](https://cve.now/CVE-2021-47528.md): usb: cdnsp: Fix a NULL pointer dereference in cdnsp\_endpoint\_init() (no CVSS, Linux)
- [CVE-2021-47527](https://cve.now/CVE-2021-47527.md): serial: core: fix transmit-buffer reset and memleak (no CVSS, Linux)
- [CVE-2021-47526](https://cve.now/CVE-2021-47526.md): serial: liteuart: Fix NULL pointer dereference in -\>remove() (no CVSS, Linux)
- [CVE-2021-47525](https://cve.now/CVE-2021-47525.md): serial: liteuart: fix use-after-free and memleak on unbind (no CVSS, Linux)
- [CVE-2021-47524](https://cve.now/CVE-2021-47524.md): serial: liteuart: fix minor-number leak on probe errors (no CVSS, Linux)
- [CVE-2021-47523](https://cve.now/CVE-2021-47523.md): IB/hfi1: Fix leak of rcvhdrtail\_dummy\_kvaddr (no CVSS, Linux)
- [CVE-2021-47522](https://cve.now/CVE-2021-47522.md): HID: bigbenff: prevent null pointer dereference (no CVSS, Linux)
- [CVE-2021-47521](https://cve.now/CVE-2021-47521.md): can: sja1000: fix use after free in ems\_pcmcia\_add\_card() (no CVSS, Linux)
- [CVE-2021-47520](https://cve.now/CVE-2021-47520.md): can: pch\_can: pch\_can\_rx\_normal: fix use after free (CVSS 8.8, Linux)
- [CVE-2021-47519](https://cve.now/CVE-2021-47519.md): can: m\_can: m\_can\_read\_fifo: fix memory leak in error branch (CVSS 7.5, Linux)
- [CVE-2021-47518](https://cve.now/CVE-2021-47518.md): nfc: fix potential NULL pointer deref in nfc\_genl\_dump\_ses\_done (no CVSS, Linux)
- [CVE-2021-47517](https://cve.now/CVE-2021-47517.md): ethtool: do not perform operations on net devices being unregistered (CVSS 7.8, Linux)
- [CVE-2021-47516](https://cve.now/CVE-2021-47516.md): nfp: Fix memory leak in nfp\_cpp\_area\_cache\_add() (no CVSS, Linux)
- [CVE-2021-47515](https://cve.now/CVE-2021-47515.md): seg6: fix the iif in the IPv6 socket control block (CVSS 7.5, Linux)
- [CVE-2021-47514](https://cve.now/CVE-2021-47514.md): devlink: fix netns refcount leak in devlink\_nl\_cmd\_reload() (no CVSS, Linux)
- [CVE-2021-47513](https://cve.now/CVE-2021-47513.md): net: dsa: felix: Fix memory leak in felix\_setup\_mmio\_filtering (no CVSS, Linux)
- [CVE-2021-47512](https://cve.now/CVE-2021-47512.md): net/sched: fq\_pie: prevent dismantle issue (CVSS 7.8, Linux)
- [CVE-2021-47511](https://cve.now/CVE-2021-47511.md): ALSA: pcm: oss: Fix negative period/buffer sizes (CVSS 5.5, Linux)
- [CVE-2021-47510](https://cve.now/CVE-2021-47510.md): btrfs: fix re-dirty process of tree-log nodes (no CVSS, Linux)
- [CVE-2021-47509](https://cve.now/CVE-2021-47509.md): ALSA: pcm: oss: Limit the period size to 16MB (CVSS 5.5, Linux)
- [CVE-2024-33470](https://cve.now/CVE-2024-33470.md): An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passbac (CVSS 4.9)
- [CVE-2021-47508](https://cve.now/CVE-2021-47508.md): btrfs: free exchange changeset on failures (no CVSS, Linux)
- [CVE-2021-47507](https://cve.now/CVE-2021-47507.md): nfsd: Fix nsfd startup race (again) (no CVSS, Linux)
- [CVE-2021-47506](https://cve.now/CVE-2021-47506.md): nfsd: fix use-after-free due to delegation race (CVSS 9.8, Linux)
- [CVE-2021-47505](https://cve.now/CVE-2021-47505.md): aio: fix use-after-free due to missing POLLFREE handling (CVSS 7.8, Linux)
- [CVE-2021-47503](https://cve.now/CVE-2021-47503.md): scsi: pm80xx: Do not call scsi\_remove\_host() in pm8001\_alloc() (CVSS 6.2, Linux)
- [CVE-2021-47502](https://cve.now/CVE-2021-47502.md): ASoC: codecs: wcd934x: handle channel mappping list correctly (CVSS 7.8, Linux)
- [CVE-2021-47501](https://cve.now/CVE-2021-47501.md): i40e: Fix NULL pointer dereference in i40e\_dbg\_dump\_desc (no CVSS, Linux)
- [CVE-2021-47500](https://cve.now/CVE-2021-47500.md): iio: mma8452: Fix trigger reference couting (CVSS 7.8, Linux)
- [CVE-2021-47499](https://cve.now/CVE-2021-47499.md): iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove (no CVSS, Linux)
- [CVE-2024-22588](https://cve.now/CVE-2024-22588.md): Kwik commit 745fd4e2 does not discard unused encryption keys. (CVSS 6.5, tech.kwik:kwik)
- [CVE-2024-33809](https://cve.now/CVE-2024-33809.md): PingCAP TiDB v7.5.1 was discovered to contain a buffer overflow vulnerability, which could lead to database crashes and denial of service at (CVSS 6.5)
- [CVE-2024-35340](https://cve.now/CVE-2024-35340.md): Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the cmdinput parameter at ip/goform/formexeComma (CVSS 8.6)
- [CVE-2024-35618](https://cve.now/CVE-2024-35618.md): PingCAP TiDB v7.5.1 was discovered to contain a NULL pointer dereference via the component SortedRowContainer. (CVSS 7.5)
- [CVE-2024-35339](https://cve.now/CVE-2024-35339.md): Tenda FH1206 V1.2.0.8(8155) was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac. (CVSS 9.8)
- [CVE-2024-31510](https://cve.now/CVE-2024-31510.md): An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto\_sign\_signature parameter in the / (CVSS 9.8)
- [CVE-2024-35592](https://cve.now/CVE-2024-35592.md): An arbitrary file upload vulnerability in the Upload function of Box-IM v2.0 allows attackers to execute arbitrary code via uploading a craf (CVSS 9.6)
- [CVE-2024-35591](https://cve.now/CVE-2024-35591.md): An arbitrary file upload vulnerability in O2OA v8.3.8 allows attackers to execute arbitrary code via uploading a crafted PDF file. (CVSS 5.4)
- [CVE-2024-5273](https://cve.now/CVE-2024-5273.md): Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing (CVSS 4.3, Jenkins Project Jenkins Report Info Plugin · org.jenkins-ci…)
- [CVE-2024-35593](https://cve.now/CVE-2024-35593.md): An arbitrary file upload vulnerability in the File preview function of Raingad IM v4.1.4 allows attackers to execute arbitrary code via uplo (CVSS 5.5)
- [CVE-2024-35595](https://cve.now/CVE-2024-35595.md): An arbitrary file upload vulnerability in the File Preview function of Xintongda OA v2023.12.30.1 allows attackers to execute arbitrary code (CVSS 6.1)
- [CVE-2024-5318](https://cve.now/CVE-2024-5318.md): Missing Authorization in GitLab (CVSS 4.0, GitLab)
- [CVE-2023-49575](https://cve.now/CVE-2023-49575.md): XSS vulnerability in VX Search Enterprise (CVSS 7.1, Flexense VX Search Enterprise · Flexense Sync Breeze Ent… +1)
- [CVE-2023-49574](https://cve.now/CVE-2023-49574.md): XSS vulnerability in VX Search Enterprise (CVSS 7.1, Flexense VX Search Enterprise)
- [CVE-2023-49573](https://cve.now/CVE-2023-49573.md): XSS vulnerability in VX Search Enterprise (CVSS 7.1, Flexense VX Search Enterprise)
- [CVE-2023-49572](https://cve.now/CVE-2023-49572.md): XSS vulnerability in VX Search Enterprise (CVSS 7.1, Flexense VX Search Enterprise · Flexense Disk Pulse Enterpr…)
- [CVE-2023-47710](https://cve.now/CVE-2023-47710.md): IBM Security Guardium cross-site scripting (CVSS 5.4, IBM Security Guardium)
- [CVE-2024-4455](https://cve.now/CVE-2024-4455.md): YITH WooCommerce Ajax Search \<= 2.4.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, yithemes YITH WooCommerce Ajax Search)
- [CVE-2024-5312](https://cve.now/CVE-2024-5312.md): Cross-Site Scripting vulnerability in PHP Server Monitor (CVSS 6.3, PHP Server Monitor · phpservermon/phpservermon)
- [CVE-2024-5315](https://cve.now/CVE-2024-5315.md): Multiple vulnerabilities in DOLIBARR's ERP CMS (CVSS 9.1, Dolibarr ERP CMS · dolibarr/dolibarr)
- [CVE-2024-5314](https://cve.now/CVE-2024-5314.md): Multiple vulnerabilities in DOLIBARR's ERP CMS (CVSS 9.1, Dolibarr ERP CMS · dolibarr/dolibarr)
- [CVE-2024-5310](https://cve.now/CVE-2024-5310.md): JFinalCMS content cross site scripting (CVSS 5.1, JFinalCMS)
- [CVE-2024-4037](https://cve.now/CVE-2024-4037.md): WP Photo Album Plus \<= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5, opajaap WP Photo Album Plus)
- [CVE-2024-4366](https://cve.now/CVE-2024-4366.md): Spectra – WordPress Gutenberg Blocks \<= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, brainstormforce Spectra Gutenberg Blocks – Website Builder…)
- [CVE-2023-7259](https://cve.now/CVE-2023-7259.md): zzdevelop lenosp Adduser Page cross site scripting (CVSS 5.1, zzdevelop lenosp)
- [CVE-2024-4484](https://cve.now/CVE-2024-4484.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-1332](https://cve.now/CVE-2024-1332.md): Custom Fonts – Host Your Fonts Locally \<= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, brainstormforce Custom Fonts – Host Your Fonts Locally)
- [CVE-2024-1376](https://cve.now/CVE-2024-1376.md): Event post \<= 5.9.4 - Missing Authorization (CVSS 4.3, bastho Event post)
- [CVE-2024-5060](https://cve.now/CVE-2024-5060.md): LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor \<= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, kapasias LottieFiles – JSON Based Animation Lottie & Bodymo…)
- [CVE-2024-4485](https://cve.now/CVE-2024-4485.md): The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce \<= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-0893](https://cve.now/CVE-2024-0893.md): Schema App Structured Data \<= 2.2.0 - Missing Authorization (CVSS 4.3, vberkel Schema App Structured Data)
- [CVE-2023-1111](https://cve.now/CVE-2023-1111.md): FastCMS New Article Tab cross site scripting (CVSS 5.1, FastCMS)
- [CVE-2024-36361](https://cve.now/CVE-2024-36361.md): Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compi (CVSS 6.8, pug-code-gen · pug)
- [CVE-2023-1001](https://cve.now/CVE-2023-1001.md): xuliangzhan vxe-table vxe-textarea textarea.js export cross site scripting (CVSS 5.3, xuliangzhan vxe-table · vxe-table)
- [CVE-2024-5142](https://cve.now/CVE-2024-5142.md): XSS in Hubshare's social module (CVSS 7.0, M-Files Hubshare)
- [CVE-2024-0867](https://cve.now/CVE-2024-0867.md): Email Log \<= 2.4.8 - Unauthenticated Hook Injection (CVSS 8.1, webfactory Email Log)
- [CVE-2024-1134](https://cve.now/CVE-2024-1134.md): SEOPress – On-site SEO \<= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rainbowgeek SEOPress – On-site SEO & Analytics)
- [CVE-2024-3718](https://cve.now/CVE-2024-3718.md): The Plus Addons for Elementor \<= 5.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-3557](https://cve.now/CVE-2024-3557.md): WP Go Maps (formerly WP Google Maps) \<= 9.0.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpgmaps WP Go Maps)
- [CVE-2024-2784](https://cve.now/CVE-2024-2784.md): The Plus Addons for Elementor \<= 5.5.4 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card (CVSS 6.4, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2024-2618](https://cve.now/CVE-2024-2618.md): Elementor Header & Footer Builder \<= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, brainstormforce Ultimate Addons for Elementor)
- [CVE-2024-4544](https://cve.now/CVE-2024-4544.md): Pie Register - Social Sites Login (Add on) \<= 1.7.7 - Authentication Bypass (CVSS 9.8, Genetech Solutions Pie Register - Social Sites Login)
- [CVE-2024-5205](https://cve.now/CVE-2024-5205.md): Videojs HTML5 Player \<= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs\_video Shortcode (CVSS 6.4, naa986 Videojs HTML5 Player)
- [CVE-2024-4409](https://cve.now/CVE-2024-4409.md): WP-ViperGB \<= 1.6.1 - Cross-Site Request Forgery (CVSS 4.3, justin\_k WP-ViperGB)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-05-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.