# CVEs published 2024-07-06

24 CVEs were published on July 6, 2024: 0 critical, 3 high. Days are UTC.

- [CVE-2024-6095](https://cve.now/CVE-2024-6095.md): SSRF and Partial LFI in /models/apply Endpoint in mudler/localai (CVSS 5.8, mudler/localai)
- [CVE-2024-37554](https://cve.now/CVE-2024-37554.md): WordPress UltraAddons plugin \<= 2.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Saiful Islam UltraAddons Elementor Lite)
- [CVE-2024-37553](https://cve.now/CVE-2024-37553.md): WordPress Testimonials Widget plugin \<= 4.0.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Axelerant Testimonials Widget)
- [CVE-2024-37547](https://cve.now/CVE-2024-37547.md): WordPress Elementor Addons by Livemesh plugin \<= 8.4.0 - Local File Inclusion vulnerability (CVSS 6.5, Livemesh Addons for Elementor)
- [CVE-2024-37546](https://cve.now/CVE-2024-37546.md): WordPress Image Hover Effects for Elementor with Lightbox and Flipbox plugin \<= 3.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, biplob018 Image Hover Effects - Caption Hover with Carousel)
- [CVE-2024-37542](https://cve.now/CVE-2024-37542.md): WordPress Gallery – Image and Video Gallery with Thumbnails plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 5.4, WpDevArt Responsive Image Gallery, Gallery Album)
- [CVE-2024-37541](https://cve.now/CVE-2024-37541.md): WordPress Elementor Addons, Widgets and Enhancements – Stax plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, StaxWP Elementor Addons, Widgets and Enhancements – Stax)
- [CVE-2024-37539](https://cve.now/CVE-2024-37539.md): WordPress WP To Do plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Delower WP To Do)
- [CVE-2024-37234](https://cve.now/CVE-2024-37234.md): WordPress Academy LMS plugin \<= 2.0.4 - Open Redirection vulnerability (CVSS 3.5, Kodezen Limited Academy LMS)
- [CVE-2024-37208](https://cve.now/CVE-2024-37208.md): WordPress WP Scraper plugin \<= 5.7 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Robert Macchi WP Scraper)
- [CVE-2024-37260](https://cve.now/CVE-2024-37260.md): WordPress Foxiz Theme theme \<= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2, Theme-Ruby Foxiz)
- [CVE-2024-39486](https://cve.now/CVE-2024-39486.md): drm/drm\_file: Fix pid refcounting race (CVSS 7.8, Linux)
- [CVE-2024-5616](https://cve.now/CVE-2024-5616.md): CSRF Vulnerability in mudler/LocalAI (CVSS 4.3, mudler/localai)
- [CVE-2024-40594](https://cve.now/CVE-2024-40594.md): The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a location accessible t (CVSS 2.3)
- [CVE-2024-40596](https://cve.now/CVE-2024-40596.md): An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. (CVSS 4.3)
- [CVE-2024-40597](https://cve.now/CVE-2024-40597.md): An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. (CVSS 7.5)
- [CVE-2024-40598](https://cve.now/CVE-2024-40598.md): An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. (CVSS 4.3)
- [CVE-2024-40599](https://cve.now/CVE-2024-40599.md): An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. (CVSS 4.8)
- [CVE-2024-40600](https://cve.now/CVE-2024-40600.md): An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. (CVSS 6.1)
- [CVE-2024-40601](https://cve.now/CVE-2024-40601.md): An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. (CVSS 6.3)
- [CVE-2024-40602](https://cve.now/CVE-2024-40602.md): An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. (CVSS 6.1)
- [CVE-2024-40603](https://cve.now/CVE-2024-40603.md): An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. (CVSS 4.3)
- [CVE-2024-40604](https://cve.now/CVE-2024-40604.md): An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. (CVSS 4.8)
- [CVE-2024-40605](https://cve.now/CVE-2024-40605.md): An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. (CVSS 4.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.