# CVEs published 2024-07-01

121 CVEs were published on July 1, 2024: 26 critical, 43 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-39314](https://cve.now/CVE-2024-39314.md): toy-blog administrative token leaked through the command line parameter (CVSS 4.7, KisaragiEffective toy-blog)
- [CVE-2024-39313](https://cve.now/CVE-2024-39313.md): toy-blog Improper Input Validation vulnerability (CVSS 6.5, KisaragiEffective toy-blog)
- [CVE-2024-39310](https://cve.now/CVE-2024-39310.md): WordPress Basil Theme Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability (CVSS 5.4, XjSv Basil)
- [CVE-2024-39309](https://cve.now/CVE-2024-39309.md): ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability (CVSS 9.8, parse-community parse-server · parse-server)
- [CVE-2024-39305](https://cve.now/CVE-2024-39305.md): Envoy Proxy use after free when route hash policy is configured with cookie attributes (CVSS 6.5, envoyproxy envoy)
- [CVE-2024-38368](https://cve.now/CVE-2024-38368.md): Trunk's 'Claim your pod' could be used to obtain un-used pods (CVSS 9.3, CocoaPods)
- [CVE-2024-28200](https://cve.now/CVE-2024-28200.md): N-central Authentication Bypass (CVSS 9.1, N-able N-central)
- [CVE-2024-38367](https://cve.now/CVE-2024-38367.md): CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking (CVSS 8.2, CocoaPods)
- [CVE-2024-5322](https://cve.now/CVE-2024-5322.md): N-central Authentication Bypass via Session Rebinding (CVSS 9.1, N-able N-central)
- [CVE-2024-38366](https://cve.now/CVE-2024-38366.md): CoacoaPods trunk RCE in email verification system rfc-822 (CVSS 10.0, CocoaPods)
- [CVE-2024-39303](https://cve.now/CVE-2024-39303.md): Weblate vulnerabler to improper sanitization of project backups (CVSS 4.4, WeblateOrg weblate · weblate)
- [CVE-2024-38513](https://cve.now/CVE-2024-38513.md): Fiber Session Middleware Token Injection Vulnerability (CVSS 10.0, gofiber fiber · github.com/gofiber/fiber +2)
- [CVE-2024-37298](https://cve.now/CVE-2024-37298.md): Potential memory exhaustion attack due to sparse slice deserialization (CVSS 7.5, gorilla schema · github.com/gorilla/schema)
- [CVE-2024-37146](https://cve.now/CVE-2024-37146.md): GHSL-2023-248: Flowise xss in /api/v1/credentials/id (CVSS 6.1, FlowiseAI Flowise · flowise)
- [CVE-2024-37145](https://cve.now/CVE-2024-37145.md): GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id (CVSS 6.1, FlowiseAI Flowise · flowise)
- [CVE-2024-36423](https://cve.now/CVE-2024-36423.md): GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id (CVSS 6.1, FlowiseAI Flowise · flowise)
- [CVE-2024-39573](https://cve.now/CVE-2024-39573.md): Apache HTTP Server: mod\_rewrite proxy handler substitution (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38477](https://cve.now/CVE-2024-38477.md): Apache HTTP Server: Crash resulting in Denial of Service in mod\_proxy via a malicious request (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38476](https://cve.now/CVE-2024-38476.md): Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38475](https://cve.now/CVE-2024-38475.md): Apache HTTP Server weakness in mod\_rewrite when first segment of substitution matches filesystem path. (CVSS 9.1, KEV, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38474](https://cve.now/CVE-2024-38474.md): Apache HTTP Server weakness with encoded question marks in backreferences (CVSS 8.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38473](https://cve.now/CVE-2024-38473.md): Apache HTTP Server proxy encoding problem (CVSS 8.1, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-38472](https://cve.now/CVE-2024-38472.md): Apache HTTP Server on WIndows UNC SSRF (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-36387](https://cve.now/CVE-2024-36387.md): Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVSS 5.4, Apache Software Foundation Apache HTTP Server)
- [CVE-2024-39879](https://cve.now/CVE-2024-39879.md): In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings (CVSS 5.0, JetBrains TeamCity)
- [CVE-2024-39878](https://cve.now/CVE-2024-39878.md): In JetBrains TeamCity before 2024.03.3 private key could be exposed via testing GitHub App Connection (CVSS 4.1, JetBrains TeamCity)
- [CVE-2024-36997](https://cve.now/CVE-2024-36997.md): Persistent Cross-site Scripting (XSS) in conf-web/settings REST endpoint (CVSS 4.6, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36993](https://cve.now/CVE-2024-36993.md): Persistent Cross-site Scripting (XSS) in Web Bulletin (CVSS 5.4, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36995](https://cve.now/CVE-2024-36995.md): Low-privileged user could create experimental items (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-21586](https://cve.now/CVE-2024-21586.md): Junos OS: SRX Series and NFX Series: Specific valid traffic leads to a PFE crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-36982](https://cve.now/CVE-2024-36982.md): Denial of Service through null pointer reference in “cluster/config” REST endpoint (CVSS 7.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36991](https://cve.now/CVE-2024-36991.md): Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows (CVSS 7.5, Splunk Enterprise)
- [CVE-2024-36990](https://cve.now/CVE-2024-36990.md): Denial of Service (DoS) on the datamodel/web REST endpoint (CVSS 6.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36985](https://cve.now/CVE-2024-36985.md): Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk\_archiver“ application in Splunk Enterprise (CVSS 8.8, Splunk Enterprise)
- [CVE-2024-36992](https://cve.now/CVE-2024-36992.md): Persistent Cross-site Scripting (XSS) in Dashboard Elements (CVSS 5.4, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36984](https://cve.now/CVE-2024-36984.md): Remote Code Execution through Serialized Session Payload in Splunk Enterprise on Windows (CVSS 8.8, Splunk Enterprise)
- [CVE-2024-36986](https://cve.now/CVE-2024-36986.md): Risky command safeguards bypass through Search ID query in Analytics Workspace (CVSS 6.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36983](https://cve.now/CVE-2024-36983.md): Command Injection using External Lookups (CVSS 8.0, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36996](https://cve.now/CVE-2024-36996.md): Information Disclosure of user names (CVSS 5.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36994](https://cve.now/CVE-2024-36994.md): Persistent Cross-site Scripting (XSS) in Dashboard Elements (CVSS 5.4, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36989](https://cve.now/CVE-2024-36989.md): Low-privileged user could create notifications in Splunk Web Bulletin Messages (CVSS 6.5, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-36987](https://cve.now/CVE-2024-36987.md): Insecure File Upload in the indexing/preview REST endpoint (CVSS 4.3, Splunk Enterprise · Splunk Cloud Platform)
- [CVE-2024-20399](https://cve.now/CVE-2024-20399.md): Cisco NX-OS Software CLI Command Injection Vulnerability (CVSS 6.0, KEV, Cisco NX-OS Software)
- [CVE-2024-36422](https://cve.now/CVE-2024-36422.md): GHSL-2023-245: Flowise xss in api/v1/chatflows/id (CVSS 6.1, FlowiseAI Flowise · flowise)
- [CVE-2024-36421](https://cve.now/CVE-2024-36421.md): GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts (CVSS 7.5, FlowiseAI Flowise · flowise)
- [CVE-2024-36420](https://cve.now/CVE-2024-36420.md): GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file (CVSS 7.5, FlowiseAI Flowise · flowise)
- [CVE-2024-36401](https://cve.now/CVE-2024-36401.md): Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver (CVSS 9.8, KEV, geoserver · org.geoserver.web:gs-web-app +2)
- [CVE-2024-6376](https://cve.now/CVE-2024-6376.md): ejson shell parser in MongoDB Compass maybe bypassed (CVSS 7.0, MongoDB Compass · @mongodb-js/connection-form)
- [CVE-2024-6375](https://cve.now/CVE-2024-6375.md): Missing authorization check may lead to shard key refinement (CVSS 5.4, MongoDB Server)
- [CVE-2024-34696](https://cve.now/CVE-2024-34696.md): GeoServer's Server Status shows sensitive environmental variables and Java properties (CVSS 4.5, geoserver · org.geoserver.web:gs-web-app +1)
- [CVE-2024-23380](https://cve.now/CVE-2024-23380.md): Use After Free in Graphics (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23373](https://cve.now/CVE-2024-23373.md): Use After Free in Graphics (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23372](https://cve.now/CVE-2024-23372.md): Integer Overflow or Wraparound in Graphics (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-23368](https://cve.now/CVE-2024-23368.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Qualcomm IPC (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-21482](https://cve.now/CVE-2024-21482.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux Boot Loader (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2024-21469](https://cve.now/CVE-2024-21469.md): Permissions, Privileges, and Access Control issues in TZ Secure OS (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2024-21466](https://cve.now/CVE-2024-21466.md): Integer Underflow (Wrap or Wraparound) in WLAN Host Communication (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-21465](https://cve.now/CVE-2024-21465.md): Buffer Over-read in Trusted Execution Environment (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2024-21462](https://cve.now/CVE-2024-21462.md): Buffer Over-read in TZ Secure OS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2024-21461](https://cve.now/CVE-2024-21461.md): Double Free in HLOS (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-21460](https://cve.now/CVE-2024-21460.md): Use of Insufficiently Random Values in Core (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2024-21458](https://cve.now/CVE-2024-21458.md): Buffer Over-read in WLAN HOST (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-21457](https://cve.now/CVE-2024-21457.md): Buffer Over-read in WLAN Host Communication (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2024-21456](https://cve.now/CVE-2024-21456.md): Buffer Over-read in WLAN HOST (CVSS 6.5, Qualcomm Snapdragon)
- [CVE-2023-43554](https://cve.now/CVE-2023-43554.md): Improper Restriction of Operations withing the Bounds of a Memory Buffer in DSP Services (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2024-24749](https://cve.now/CVE-2024-24749.md): Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat (CVSS 7.5, geoserver · org.geoserver.web:gs-web-app +1)
- [CVE-2024-6050](https://cve.now/CVE-2024-6050.md): Reflected XSS in SOWA OPAC (CVSS 5.3, SOKRATES-software SOWA OPAC)
- [CVE-2024-6425](https://cve.now/CVE-2024-6425.md): Incorrect Provision of Specified Functionality vulnerability in MESbook (CVSS 9.1, MESbook)
- [CVE-2024-6424](https://cve.now/CVE-2024-6424.md): Server-Side Request Forgery vulnerability in MESbook (CVSS 9.3, MESbook)
- [CVE-2024-6387](https://cve.now/CVE-2024-6387.md): Openssh: regresshion - race condition in ssh allows rce/dos (CVSS 8.1, OpenSSH · Red Hat Enterprise Linux +2)
- [CVE-2024-4007](https://cve.now/CVE-2024-4007.md): Hard coded default credential contained in install package (CVSS 8.7, ABB ASPECT Enterprise · ABB NEXUS Series +1)
- [CVE-2024-0153](https://cve.now/CVE-2024-0153.md): Mali GPU Firmware allows improper GPU processing operations (CVSS 7.8, Arm Valhall GPU Firmware · Arm 5th Gen GPU Architecture Fir…)
- [CVE-2024-39430](https://cve.now/CVE-2024-39430.md): In faceid servive, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.1, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-39429](https://cve.now/CVE-2024-39429.md): In faceid servive, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.1, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-39428](https://cve.now/CVE-2024-39428.md): In trusty service, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.8, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-39427](https://cve.now/CVE-2024-39427.md): In trusty service, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.1, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-6130](https://cve.now/CVE-2024-6130.md): Form Maker by 10Web \< 1.15.26 - Admin+ Stored XSS (CVSS 4.8, Form Maker by 10Web)
- [CVE-2024-4934](https://cve.now/CVE-2024-4934.md): Quiz And Survey Master \< 9.0.2 - Contributor+ Stored XSS (CVSS 5.5, Quiz and Survey Master)
- [CVE-2024-20081](https://cve.now/CVE-2024-20081.md): In gnss service, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT…)
- [CVE-2024-20080](https://cve.now/CVE-2024-20080.md): In gnss service, there is a possible escalation of privilege due to improper certificate validation. (CVSS 9.8, MediaTek MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT…)
- [CVE-2024-20079](https://cve.now/CVE-2024-20079.md): In gnss service, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT…)
- [CVE-2024-20078](https://cve.now/CVE-2024-20078.md): In venc, there is a possible out of bounds write due to type confusion. (CVSS 9.8, MediaTek MT6768, MT6779, MT8321, MT8385, MT8755, MT8765, MT…)
- [CVE-2024-20076](https://cve.now/CVE-2024-20076.md): In Modem, there is a possible system crash due to incorrect error handling. (CVSS 7.5, MediaTek MT2731, MT6739, MT6761, MT6762, MT6763, MT6765, MT…)
- [CVE-2024-20077](https://cve.now/CVE-2024-20077.md): In Modem, there is a possible system crash due to incorrect error handling. (CVSS 7.5, MediaTek MT2731, MT6739, MT6761, MT6762, MT6763, MT6765, MT…)
- [CVE-2024-3123](https://cve.now/CVE-2024-3123.md): CHANGING Mobile One Time Password - Arbitrary File Upload (CVSS 7.2, CHANGING Mobile One Time Password)
- [CVE-2024-3122](https://cve.now/CVE-2024-3122.md): CHANGING Mobile One Time Password - Arbitrary File Reading (CVSS 4.9, CHANGING Mobile One Time Password)
- [CVE-2024-38480](https://cve.now/CVE-2024-38480.md): "Piccoma" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attack (CVSS 4.0, Kakao piccoma "Piccoma" App for Android · Kakao piccoma "Pi…)
- [CVE-2024-23736](https://cve.now/CVE-2024-23736.md): Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/ (CVSS 8.8)
- [CVE-2024-23737](https://cve.now/CVE-2024-23737.md): Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipula (CVSS 5.4)
- [CVE-2024-32228](https://cve.now/CVE-2024-32228.md): FFmpeg 7.0 is vulnerable to Buffer Overflow. (CVSS 6.6)
- [CVE-2024-32229](https://cve.now/CVE-2024-32229.md): FFmpeg 7.0 contains a heap-buffer-overflow at libavfilter/vf\_tiltandshift.c:189:5 in copy\_column. (CVSS 8.4)
- [CVE-2024-32230](https://cve.now/CVE-2024-32230.md): FFmpeg 7.0 is vulnerable to Buffer Overflow. (CVSS 7.8)
- [CVE-2024-37762](https://cve.now/CVE-2024-37762.md): MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution. (CVSS 9.9)
- [CVE-2024-37763](https://cve.now/CVE-2024-37763.md): MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can vie (CVSS 5.4)
- [CVE-2024-37764](https://cve.now/CVE-2024-37764.md): MachForm up to version 19 is affected by an authenticated stored cross-site scripting. (CVSS 5.4)
- [CVE-2024-37765](https://cve.now/CVE-2024-37765.md): Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. (CVSS 8.8)
- [CVE-2024-38953](https://cve.now/CVE-2024-38953.md): phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok\_f() method under the framework/api/upload\_control.php file. (CVSS 6.1)
- [CVE-2024-38987](https://cve.now/CVE-2024-38987.md): aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep. (CVSS 6.3, @aofl/cli-lib)
- [CVE-2024-38990](https://cve.now/CVE-2024-38990.md): Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. (CVSS 6.3)
- [CVE-2024-38991](https://cve.now/CVE-2024-38991.md): akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto. (CVSS 8.8, @akbr/patch-into)
- [CVE-2024-38992](https://cve.now/CVE-2024-38992.md): airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView. (CVSS 8.8, @airvertco/frappejs)
- [CVE-2024-38993](https://cve.now/CVE-2024-38993.md): rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. (CVSS 9.8)
- [CVE-2024-38994](https://cve.now/CVE-2024-38994.md): amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. (CVSS 7.3, @amoy/common)
- [CVE-2024-38996](https://cve.now/CVE-2024-38996.md): ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the \_.mergeDeep function. (CVSS 9.8, ag-grid-enterprise · ag-grid-community)
- [CVE-2024-38997](https://cve.now/CVE-2024-38997.md): adolph\_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults. (CVSS 6.5, @adolph\_dudu/ratio-swiper)
- [CVE-2024-38999](https://cve.now/CVE-2024-38999.md): jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts.\_.configure. (CVSS 10.0, requirejs)
- [CVE-2024-39000](https://cve.now/CVE-2024-39000.md): adolph\_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function parse. (CVSS 6.5)
- [CVE-2024-39001](https://cve.now/CVE-2024-39001.md): ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component \_ModuleSupport.jsonApply. (CVSS 6.3, @ag-grid-enterprise/charts · ag-grid-community +1)
- [CVE-2024-39002](https://cve.now/CVE-2024-39002.md): rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. (CVSS 6.3)
- [CVE-2024-39003](https://cve.now/CVE-2024-39003.md): amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. (CVSS 7.3)
- [CVE-2024-39008](https://cve.now/CVE-2024-39008.md): robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. (CVSS 10.0, fast-loops)
- [CVE-2024-39013](https://cve.now/CVE-2024-39013.md): 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. (CVSS 9.8)
- [CVE-2024-39014](https://cve.now/CVE-2024-39014.md): ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. (CVSS 9.8)
- [CVE-2024-39015](https://cve.now/CVE-2024-39015.md): cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. (CVSS 9.8)
- [CVE-2024-39016](https://cve.now/CVE-2024-39016.md): che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. (CVSS 8.1)
- [CVE-2024-39017](https://cve.now/CVE-2024-39017.md): agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. (CVSS 9.8)
- [CVE-2024-39018](https://cve.now/CVE-2024-39018.md): harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query". (CVSS 6.3, @cat5th/key-serializer)
- [CVE-2024-39236](https://cve.now/CVE-2024-39236.md): Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component\_meta.py. (CVSS 9.8, gradio)
- [CVE-2024-39249](https://cve.now/CVE-2024-39249.md): Async \<= 2.6.4 and \<= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. (CVSS 7.5)
- [CVE-2024-39251](https://cve.now/CVE-2024-39251.md): An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive (CVSS 10.0)
- [CVE-2024-39853](https://cve.now/CVE-2024-39853.md): adolph\_dudu ratio-swiper 0.0.2 was discovered to contain a prototype pollution via the function parse. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.