# CVEs published 2024-07-29

280 CVEs were published on July 29, 2024: 12 critical, 119 high. Days are UTC.

- [CVE-2024-40777](https://cve.now/CVE-2024-40777.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40798](https://cve.now/CVE-2024-40798.md): This issue was addressed with improved redaction of sensitive information. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27888](https://cve.now/CVE-2024-27888.md): A permissions issue was addressed by removing vulnerable code and adding additional checks. (CVSS 7.1, Apple macOS)
- [CVE-2024-40809](https://cve.now/CVE-2024-40809.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-27871](https://cve.now/CVE-2024-27871.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27826](https://cve.now/CVE-2024-27826.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40833](https://cve.now/CVE-2024-40833.md): A logic issue was addressed with improved checks. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-40794](https://cve.now/CVE-2024-40794.md): This issue was addressed through improved state management. (CVSS 5.3, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2024-27884](https://cve.now/CVE-2024-27884.md): This issue was addressed with a new entitlement. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40813](https://cve.now/CVE-2024-40813.md): A lock screen issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2024-40805](https://cve.now/CVE-2024-40805.md): A permissions issue was addressed with additional restrictions. (CVSS 7.7, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-40782](https://cve.now/CVE-2024-40782.md): A use-after-free issue was addressed with improved memory management. (CVSS 9.8, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-40829](https://cve.now/CVE-2024-40829.md): The issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-40828](https://cve.now/CVE-2024-40828.md): The issue was addressed with improved checks. (CVSS 8.4, Apple macOS)
- [CVE-2024-40783](https://cve.now/CVE-2024-40783.md): The issue was addressed with improved restriction of data container access. (CVSS 7.1, Apple macOS)
- [CVE-2024-40804](https://cve.now/CVE-2024-40804.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-40812](https://cve.now/CVE-2024-40812.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-40795](https://cve.now/CVE-2024-40795.md): This issue was addressed with improved data protection. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-40832](https://cve.now/CVE-2024-40832.md): The issue was addressed with improved checks. (CVSS 3.3, Apple macOS)
- [CVE-2024-40824](https://cve.now/CVE-2024-40824.md): This issue was addressed through improved state management. (CVSS 7.7, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-40776](https://cve.now/CVE-2024-40776.md): A use-after-free issue was addressed with improved memory management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-40799](https://cve.now/CVE-2024-40799.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40815](https://cve.now/CVE-2024-40815.md): A race condition was addressed with additional validation. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-27882](https://cve.now/CVE-2024-27882.md): A permissions issue was addressed with additional restrictions. (CVSS 4.4, Apple macOS)
- [CVE-2024-40803](https://cve.now/CVE-2024-40803.md): A type confusion issue was addressed with improved checks. (CVSS 7.5, Apple macOS)
- [CVE-2024-40784](https://cve.now/CVE-2024-40784.md): An integer overflow was addressed with improved input validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-27877](https://cve.now/CVE-2024-27877.md): The issue was addressed with improved memory handling. (CVSS 6.1, Apple macOS)
- [CVE-2024-40788](https://cve.now/CVE-2024-40788.md): A type confusion issue was addressed with improved memory handling. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40823](https://cve.now/CVE-2024-40823.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-40835](https://cve.now/CVE-2024-40835.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-40834](https://cve.now/CVE-2024-40834.md): This issue was addressed by adding an additional prompt for user consent. (CVSS 4.4, Apple macOS)
- [CVE-2024-40822](https://cve.now/CVE-2024-40822.md): This issue was addressed by restricting options offered on a locked device. (CVSS 2.4, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-40789](https://cve.now/CVE-2024-40789.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-40818](https://cve.now/CVE-2024-40818.md): This issue was addressed by restricting options offered on a locked device. (CVSS 4.6, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-40785](https://cve.now/CVE-2024-40785.md): This issue was addressed with improved checks. (CVSS 6.1, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-40802](https://cve.now/CVE-2024-40802.md): The issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2024-40814](https://cve.now/CVE-2024-40814.md): A downgrade issue was addressed with additional code-signing restrictions. (CVSS 7.1, Apple macOS)
- [CVE-2024-27883](https://cve.now/CVE-2024-27883.md): A permissions issue was addressed with additional restrictions. (CVSS 4.4, Apple macOS)
- [CVE-2024-40793](https://cve.now/CVE-2024-40793.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-40786](https://cve.now/CVE-2024-40786.md): This issue was addressed through improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-40817](https://cve.now/CVE-2024-40817.md): The issue was addressed with improved UI handling. (CVSS 6.1, Apple Safari · Apple macOS)
- [CVE-2024-40821](https://cve.now/CVE-2024-40821.md): An access issue was addressed with additional sandbox restrictions. (CVSS 8.4, Apple macOS)
- [CVE-2024-27863](https://cve.now/CVE-2024-27863.md): An information disclosure issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-27862](https://cve.now/CVE-2024-27862.md): A logic issue was addressed with improved state management. (CVSS 5.3, Apple macOS)
- [CVE-2024-27823](https://cve.now/CVE-2024-27823.md): A race condition was addressed with improved locking. (CVSS 5.9, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40836](https://cve.now/CVE-2024-40836.md): A logic issue was addressed with improved checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-27881](https://cve.now/CVE-2024-27881.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.3, Apple macOS)
- [CVE-2024-40816](https://cve.now/CVE-2024-40816.md): An out-of-bounds read was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2024-27878](https://cve.now/CVE-2024-27878.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 6.5, Apple macOS)
- [CVE-2024-40800](https://cve.now/CVE-2024-40800.md): An input validation issue was addressed with improved input validation. (CVSS 8.4, Apple macOS)
- [CVE-2024-40787](https://cve.now/CVE-2024-40787.md): This issue was addressed by adding an additional prompt for user consent. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23261](https://cve.now/CVE-2024-23261.md): A logic issue was addressed with improved state management. (CVSS 7.5, Apple macOS)
- [CVE-2024-40827](https://cve.now/CVE-2024-40827.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-27873](https://cve.now/CVE-2024-27873.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-40775](https://cve.now/CVE-2024-40775.md): A downgrade issue was addressed with additional code-signing restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2024-27853](https://cve.now/CVE-2024-27853.md): This issue was addressed with improved checks. (CVSS 4.4, Apple macOS)
- [CVE-2024-40780](https://cve.now/CVE-2024-40780.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-40807](https://cve.now/CVE-2024-40807.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-40811](https://cve.now/CVE-2024-40811.md): The issue was addressed with improved checks. (CVSS 8.4, Apple macOS)
- [CVE-2024-27886](https://cve.now/CVE-2024-27886.md): A logic issue was addressed with improved restrictions. (CVSS 7.5, Apple macOS)
- [CVE-2024-40796](https://cve.now/CVE-2024-40796.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-40779](https://cve.now/CVE-2024-40779.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 5.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-40778](https://cve.now/CVE-2024-40778.md): An authentication issue was addressed with improved state management. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-27887](https://cve.now/CVE-2024-27887.md): A path handling issue was addressed with improved validation. (CVSS 6.2, Apple macOS)
- [CVE-2024-40806](https://cve.now/CVE-2024-40806.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-40781](https://cve.now/CVE-2024-40781.md): The issue was addressed with improved checks. (CVSS 8.4, Apple macOS)
- [CVE-2024-40774](https://cve.now/CVE-2024-40774.md): A downgrade issue was addressed with additional code-signing restrictions. (CVSS 5.9, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-27872](https://cve.now/CVE-2024-27872.md): This issue was addressed with improved validation of symlinks. (CVSS 5.5, Apple macOS)
- [CVE-2024-27809](https://cve.now/CVE-2024-27809.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2024-3219](https://cve.now/CVE-2024-3219.md): Pure-Python fallback of socket.socketpair() doesn’t authenticate peer connection (CVSS 5.1, Python Software Foundation CPython)
- [CVE-2024-7252](https://cve.now/CVE-2024-7252.md): Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Comodo Internet Security Pro)
- [CVE-2024-7251](https://cve.now/CVE-2024-7251.md): Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Comodo Internet Security Pro)
- [CVE-2024-7250](https://cve.now/CVE-2024-7250.md): Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Comodo Internet Security Pro)
- [CVE-2024-7249](https://cve.now/CVE-2024-7249.md): Comodo Firewall Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Comodo Firewall)
- [CVE-2024-7248](https://cve.now/CVE-2024-7248.md): Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability (CVSS 7.8, Comodo Internet Security Pro)
- [CVE-2023-40398](https://cve.now/CVE-2023-40398.md): This issue was addressed with improved checks. (CVSS 8.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-42957](https://cve.now/CVE-2023-42957.md): A permissions issue was addressed with additional restrictions. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-42948](https://cve.now/CVE-2023-42948.md): This issue was addressed through improved state management. (CVSS 3.3, Apple macOS)
- [CVE-2023-42925](https://cve.now/CVE-2023-42925.md): The issue was addressed with improved restriction of data container access. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42949](https://cve.now/CVE-2023-42949.md): This issue was addressed with improved data protection. (CVSS 3.3, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-40396](https://cve.now/CVE-2023-40396.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-42958](https://cve.now/CVE-2023-42958.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2023-42959](https://cve.now/CVE-2023-42959.md): A race condition was addressed with improved state handling. (CVSS 7.0, Apple macOS)
- [CVE-2023-42918](https://cve.now/CVE-2023-42918.md): A permissions issue was addressed with additional restrictions. (CVSS 8.6, Apple macOS)
- [CVE-2023-42943](https://cve.now/CVE-2023-42943.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2024-6620](https://cve.now/CVE-2024-6620.md): Honeywell PC42t, PC42tp, and PC42d Printers, T10.19.020016 to T10.20.060398, contain a cross-site scripting vulnerability. (CVSS 3.5, Honeywell PC42t, PC42tp, and PC42d)
- [CVE-2024-6578](https://cve.now/CVE-2024-6578.md): Stored XSS in aimhubio/aim (CVSS 7.2, aimhubio/aim · aim)
- [CVE-2024-6727](https://cve.now/CVE-2024-6727.md): Broken Access Control in Delphix (CVSS 5.4, Delphix Data Control Tower)
- [CVE-2024-42098](https://cve.now/CVE-2024-42098.md): crypto: ecdh - explicitly zeroize private\_key (no CVSS, Linux)
- [CVE-2024-42097](https://cve.now/CVE-2024-42097.md): ALSA: emux: improve patch ioctl data validation (CVSS 7.8, Linux)
- [CVE-2024-42096](https://cve.now/CVE-2024-42096.md): x86: stop playing stack games in profile\_pc() (no CVSS, Linux)
- [CVE-2024-42095](https://cve.now/CVE-2024-42095.md): serial: 8250\_omap: Implementation of Errata i2310 (no CVSS, Linux)
- [CVE-2024-42094](https://cve.now/CVE-2024-42094.md): net/iucv: Avoid explicit cpumask var allocation on stack (no CVSS, Linux)
- [CVE-2024-42093](https://cve.now/CVE-2024-42093.md): net/dpaa2: Avoid explicit cpumask var allocation on stack (no CVSS, Linux)
- [CVE-2024-42092](https://cve.now/CVE-2024-42092.md): gpio: davinci: Validate the obtained number of IRQs (no CVSS, Linux)
- [CVE-2024-42091](https://cve.now/CVE-2024-42091.md): drm/xe: Check pat.ops before dumping PAT settings (no CVSS, Linux)
- [CVE-2024-6726](https://cve.now/CVE-2024-6726.md): Remote Code Execution (RCE) in Delphix (CVSS 8.8, Delphix Engine)
- [CVE-2024-42090](https://cve.now/CVE-2024-42090.md): pinctrl: fix deadlock in create\_pinctrl() when handling -EPROBE\_DEFER (no CVSS, Linux)
- [CVE-2024-42089](https://cve.now/CVE-2024-42089.md): ASoC: fsl-asoc-card: set priv-\>pdev before using it (no CVSS, Linux)
- [CVE-2024-42088](https://cve.now/CVE-2024-42088.md): ASoC: mediatek: mt8195: Add platform entry for ETDM1\_OUT\_BE dai link (CVSS 7.3, Linux)
- [CVE-2024-42087](https://cve.now/CVE-2024-42087.md): drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep (no CVSS, Linux)
- [CVE-2024-42086](https://cve.now/CVE-2024-42086.md): iio: chemical: bme680: Fix overflows in compensate() functions (no CVSS, Linux)
- [CVE-2024-42085](https://cve.now/CVE-2024-42085.md): usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock (no CVSS, Linux)
- [CVE-2024-42084](https://cve.now/CVE-2024-42084.md): ftruncate: pass a signed offset (no CVSS, Linux)
- [CVE-2024-6748](https://cve.now/CVE-2024-6748.md): SQL Injection (CVSS 8.3, ManageEngine OpManager)
- [CVE-2024-41819](https://cve.now/CVE-2024-41819.md): Note Mark has a stored XSS in the note link href attribute (CVSS 8.7, enchant97 note-mark)
- [CVE-2024-41818](https://cve.now/CVE-2024-41818.md): ReDOS at currency parsing fast-xml-parser (CVSS 7.5, NaturalIntelligence fast-xml-parser · fast-xml-parser)
- [CVE-2024-42083](https://cve.now/CVE-2024-42083.md): ionic: fix kernel panic due to multi-buffer handling (CVSS 8.8, Linux)
- [CVE-2024-41817](https://cve.now/CVE-2024-41817.md): Arbitrary Code Execution in \`AppImage\` version \`ImageMagick\` (CVSS 7.0, ImageMagick)
- [CVE-2024-42082](https://cve.now/CVE-2024-42082.md): xdp: Remove WARN() from \_\_xdp\_reg\_mem\_model() (no CVSS, Linux)
- [CVE-2024-42081](https://cve.now/CVE-2024-42081.md): drm/xe/xe\_devcoredump: Check NULL before assignments (no CVSS, Linux)
- [CVE-2024-42080](https://cve.now/CVE-2024-42080.md): RDMA/restrack: Fix potential invalid address access (no CVSS, Linux)
- [CVE-2024-42079](https://cve.now/CVE-2024-42079.md): gfs2: Fix NULL pointer dereference in gfs2\_log\_flush (no CVSS, Linux)
- [CVE-2024-42078](https://cve.now/CVE-2024-42078.md): nfsd: initialise nfsd\_info.mutex early. (no CVSS, Linux)
- [CVE-2024-42077](https://cve.now/CVE-2024-42077.md): ocfs2: fix DIO failure due to insufficient transaction credits (no CVSS, Linux)
- [CVE-2024-42076](https://cve.now/CVE-2024-42076.md): net: can: j1939: Initialize unused data in j1939\_send\_one() (no CVSS, Linux)
- [CVE-2024-42075](https://cve.now/CVE-2024-42075.md): bpf: Fix remap of arena. (CVSS 7.8, Linux)
- [CVE-2024-42074](https://cve.now/CVE-2024-42074.md): ASoC: amd: acp: add a null check for chip\_pdev structure (no CVSS, Linux)
- [CVE-2024-42073](https://cve.now/CVE-2024-42073.md): mlxsw: spectrum\_buffers: Fix memory corruptions on Spectrum-4 systems (no CVSS, Linux)
- [CVE-2024-42072](https://cve.now/CVE-2024-42072.md): bpf: Fix may\_goto with negative offset. (CVSS 7.8, Linux)
- [CVE-2024-42071](https://cve.now/CVE-2024-42071.md): ionic: use dev\_consume\_skb\_any outside of napi (CVSS 7.8, Linux)
- [CVE-2024-42070](https://cve.now/CVE-2024-42070.md): netfilter: nf\_tables: fully validate NFT\_DATA\_VALUE on store to data registers (no CVSS, Linux)
- [CVE-2024-42069](https://cve.now/CVE-2024-42069.md): net: mana: Fix possible double free in error handling path (CVSS 7.8, Linux)
- [CVE-2024-42068](https://cve.now/CVE-2024-42068.md): bpf: Take return from set\_memory\_ro() into account with bpf\_prog\_lock\_ro() (CVSS 7.8, Linux)
- [CVE-2024-42067](https://cve.now/CVE-2024-42067.md): bpf: Take return from set\_memory\_rox() into account with bpf\_jit\_binary\_lock\_ro() (CVSS 7.8, Linux)
- [CVE-2024-42066](https://cve.now/CVE-2024-42066.md): drm/xe: Fix potential integer overflow in page size calculation (CVSS 7.8, Linux)
- [CVE-2024-42065](https://cve.now/CVE-2024-42065.md): drm/xe: Add a NULL check in xe\_ttm\_stolen\_mgr\_init (no CVSS, Linux)
- [CVE-2024-42064](https://cve.now/CVE-2024-42064.md): drm/amd/display: Skip pipe if the pipe idx not set properly (CVSS 7.8, Linux)
- [CVE-2024-42063](https://cve.now/CVE-2024-42063.md): bpf: Mark bpf prog stack with kmsan\_unposion\_memory in interpreter mode (no CVSS, Linux)
- [CVE-2023-52887](https://cve.now/CVE-2023-52887.md): net: can: j1939: enhanced error handling for tightly received RTS messages in xtp\_rx\_rts\_session\_new (CVSS 7.5, Linux)
- [CVE-2024-41098](https://cve.now/CVE-2024-41098.md): ata: libata-core: Fix null pointer dereference on error (no CVSS, Linux)
- [CVE-2024-41097](https://cve.now/CVE-2024-41097.md): usb: atm: cxacru: fix endpoint checking in cxacru\_bind() (no CVSS, Linux)
- [CVE-2024-41096](https://cve.now/CVE-2024-41096.md): PCI/MSI: Fix UAF in msi\_capability\_init (CVSS 7.8, Linux)
- [CVE-2024-41095](https://cve.now/CVE-2024-41095.md): drm/nouveau/dispnv04: fix null pointer dereference in nv17\_tv\_get\_ld\_modes (no CVSS, Linux)
- [CVE-2024-41094](https://cve.now/CVE-2024-41094.md): drm/fbdev-dma: Only set smem\_start is enable per module option (no CVSS, Linux)
- [CVE-2024-41093](https://cve.now/CVE-2024-41093.md): drm/amdgpu: avoid using null object of framebuffer (no CVSS, Linux)
- [CVE-2024-41092](https://cve.now/CVE-2024-41092.md): drm/i915/gt: Fix potential UAF by revoke of fence registers (CVSS 7.8, Linux)
- [CVE-2024-41089](https://cve.now/CVE-2024-41089.md): drm/nouveau/dispnv04: fix null pointer dereference in nv17\_tv\_get\_hd\_modes (no CVSS, Linux)
- [CVE-2024-41088](https://cve.now/CVE-2024-41088.md): can: mcp251xfd: fix infinite loop when xmit fails (no CVSS, Linux)
- [CVE-2024-41087](https://cve.now/CVE-2024-41087.md): ata: libata-core: Fix double free on error (CVSS 7.8, Linux)
- [CVE-2024-41086](https://cve.now/CVE-2024-41086.md): bcachefs: Fix sb\_field\_downgrade validation (CVSS 7.8, Linux)
- [CVE-2024-41085](https://cve.now/CVE-2024-41085.md): cxl/mem: Fix no cxl\_nvd during pmem region auto-assembling (no CVSS, Linux)
- [CVE-2024-41084](https://cve.now/CVE-2024-41084.md): cxl/region: Avoid null pointer dereference in region lookup (no CVSS, Linux)
- [CVE-2024-41083](https://cve.now/CVE-2024-41083.md): netfs: Fix netfs\_page\_mkwrite() to check folio-\>mapping is valid (no CVSS, Linux)
- [CVE-2024-41810](https://cve.now/CVE-2024-41810.md): HTML injection in HTTP redirect body (CVSS 6.1, twisted)
- [CVE-2024-41082](https://cve.now/CVE-2024-41082.md): nvme-fabrics: use reserved tag for reg read/write command (no CVSS, Linux)
- [CVE-2024-41081](https://cve.now/CVE-2024-41081.md): ila: block BH in ila\_output() (CVSS 9.8, Linux)
- [CVE-2024-41080](https://cve.now/CVE-2024-41080.md): io\_uring: fix possible deadlock in io\_register\_iowq\_max\_workers() (no CVSS, Linux)
- [CVE-2024-41079](https://cve.now/CVE-2024-41079.md): nvmet: always initialize cqe.result (CVSS 7.5, Linux)
- [CVE-2024-41078](https://cve.now/CVE-2024-41078.md): btrfs: qgroup: fix quota root leak after quota disable failure (no CVSS, Linux)
- [CVE-2024-41799](https://cve.now/CVE-2024-41799.md): tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users (CVSS 8.4, tgstation-server · Tgstation.Server.Api +1)
- [CVE-2024-41077](https://cve.now/CVE-2024-41077.md): null\_blk: fix validation of block size (no CVSS, Linux)
- [CVE-2024-41076](https://cve.now/CVE-2024-41076.md): NFSv4: Fix memory leak in nfs4\_set\_security\_label (no CVSS, Linux)
- [CVE-2024-41075](https://cve.now/CVE-2024-41075.md): cachefiles: add consistency check for copen/cread (CVSS 7.8, Linux)
- [CVE-2024-41074](https://cve.now/CVE-2024-41074.md): cachefiles: Set object to close if ondemand\_id \< 0 in copen (no CVSS, Linux)
- [CVE-2024-41073](https://cve.now/CVE-2024-41073.md): nvme: avoid double free special payload (CVSS 9.8, Linux)
- [CVE-2024-41072](https://cve.now/CVE-2024-41072.md): wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (no CVSS, Linux)
- [CVE-2024-41070](https://cve.now/CVE-2024-41070.md): KVM: PPC: Book3S HV: Prevent UAF in kvm\_spapr\_tce\_attach\_iommu\_group() (CVSS 7.8, Linux)
- [CVE-2024-41069](https://cve.now/CVE-2024-41069.md): ASoC: topology: Fix references to freed memory (CVSS 7.8, Linux)
- [CVE-2024-41068](https://cve.now/CVE-2024-41068.md): s390/sclp: Fix sclp\_init() cleanup on failure (no CVSS, Linux)
- [CVE-2024-41067](https://cve.now/CVE-2024-41067.md): btrfs: scrub: handle RST lookup error correctly (no CVSS, Linux)
- [CVE-2024-41066](https://cve.now/CVE-2024-41066.md): ibmvnic: Add tx check to prevent skb leak (CVSS 7.5, Linux)
- [CVE-2024-41065](https://cve.now/CVE-2024-41065.md): powerpc/pseries: Whitelist dtl slub object for copying to userspace (no CVSS, Linux)
- [CVE-2024-41064](https://cve.now/CVE-2024-41064.md): powerpc/eeh: avoid possible crash when edev-\>pdev changes (CVSS 7.8, Linux)
- [CVE-2024-41063](https://cve.now/CVE-2024-41063.md): Bluetooth: hci\_core: cancel all works upon hci\_unregister\_dev() (no CVSS, Linux)
- [CVE-2024-41062](https://cve.now/CVE-2024-41062.md): bluetooth/l2cap: sync sock recv cb and release (CVSS 8.8, Linux)
- [CVE-2024-41061](https://cve.now/CVE-2024-41061.md): drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport (no CVSS, Linux)
- [CVE-2024-41060](https://cve.now/CVE-2024-41060.md): drm/radeon: check bo\_va-\>bo is non-NULL before using it (CVSS 7.8, Linux)
- [CVE-2024-41059](https://cve.now/CVE-2024-41059.md): hfsplus: fix uninit-value in copy\_name (CVSS 7.8, Linux)
- [CVE-2024-41058](https://cve.now/CVE-2024-41058.md): cachefiles: fix slab-use-after-free in fscache\_withdraw\_volume() (no CVSS, Linux)
- [CVE-2024-41057](https://cve.now/CVE-2024-41057.md): cachefiles: fix slab-use-after-free in cachefiles\_withdraw\_cookie() (CVSS 7.8, Linux)
- [CVE-2024-41676](https://cve.now/CVE-2024-41676.md): Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs (CVSS 4.1, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2024-41671](https://cve.now/CVE-2024-41671.md): twisted.web has disordered HTTP pipeline response (CVSS 8.3, twisted)
- [CVE-2024-41056](https://cve.now/CVE-2024-41056.md): firmware: cs\_dsp: Use strnlen() on name fields in V1 wmfw files (CVSS 7.3, Linux)
- [CVE-2024-41055](https://cve.now/CVE-2024-41055.md): mm: prevent derefencing NULL ptr in pfn\_section\_valid() (no CVSS, Linux)
- [CVE-2024-41054](https://cve.now/CVE-2024-41054.md): scsi: ufs: core: Fix ufshcd\_clear\_cmd racing issue (no CVSS, Linux)
- [CVE-2024-41053](https://cve.now/CVE-2024-41053.md): scsi: ufs: core: Fix ufshcd\_abort\_one racing issue (no CVSS, Linux)
- [CVE-2024-41052](https://cve.now/CVE-2024-41052.md): vfio/pci: Init the count variable in collecting hot-reset devices (no CVSS, Linux)
- [CVE-2024-41051](https://cve.now/CVE-2024-41051.md): cachefiles: wait for ondemand\_object\_worker to finish when dropping object (CVSS 7.8, Linux)
- [CVE-2024-41050](https://cve.now/CVE-2024-41050.md): cachefiles: cyclic allocation of msg\_id to avoid reuse (no CVSS, Linux)
- [CVE-2024-41049](https://cve.now/CVE-2024-41049.md): filelock: fix potential use-after-free in posix\_lock\_inode (CVSS 7.8, Linux)
- [CVE-2024-41048](https://cve.now/CVE-2024-41048.md): skmsg: Skip zero length skb in sk\_msg\_recvmsg (CVSS 7.5, Linux)
- [CVE-2024-41047](https://cve.now/CVE-2024-41047.md): i40e: Fix XDP program unloading while removing the driver (no CVSS, Linux)
- [CVE-2024-41046](https://cve.now/CVE-2024-41046.md): net: ethernet: lantiq\_etop: fix double free in detach (CVSS 8.8, Linux)
- [CVE-2024-41045](https://cve.now/CVE-2024-41045.md): bpf: Defer work in bpf\_timer\_cancel\_and\_free (CVSS 7.8, Linux)
- [CVE-2024-41044](https://cve.now/CVE-2024-41044.md): ppp: reject claimed-as-LCP but actually malformed packets (no CVSS, Linux)
- [CVE-2024-41043](https://cve.now/CVE-2024-41043.md): netfilter: nfnetlink\_queue: drop bogus WARN\_ON (no CVSS, Linux)
- [CVE-2024-41042](https://cve.now/CVE-2024-41042.md): netfilter: nf\_tables: prefer nft\_chain\_validate (no CVSS, Linux)
- [CVE-2024-41041](https://cve.now/CVE-2024-41041.md): udp: Set SOCK\_RCU\_FREE earlier in udp\_lib\_get\_port(). (CVSS 7.8, Linux)
- [CVE-2024-41040](https://cve.now/CVE-2024-41040.md): net/sched: Fix UAF when resolving a clash (CVSS 9.8, Linux)
- [CVE-2024-41039](https://cve.now/CVE-2024-41039.md): firmware: cs\_dsp: Fix overflow checking of wmfw header (no CVSS, Linux)
- [CVE-2024-41038](https://cve.now/CVE-2024-41038.md): firmware: cs\_dsp: Prevent buffer overrun when processing V2 alg headers (CVSS 7.8, Linux)
- [CVE-2024-41037](https://cve.now/CVE-2024-41037.md): ASoC: SOF: Intel: hda: fix null deref on system suspend entry (no CVSS, Linux)
- [CVE-2024-41036](https://cve.now/CVE-2024-41036.md): net: ks8851: Fix deadlock with the SPI chip variant (CVSS 7.5, Linux)
- [CVE-2024-41035](https://cve.now/CVE-2024-41035.md): USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (no CVSS, Linux)
- [CVE-2024-41034](https://cve.now/CVE-2024-41034.md): nilfs2: fix kernel bug on rename operation of broken directory (CVSS 7.8, Linux)
- [CVE-2024-41033](https://cve.now/CVE-2024-41033.md): cachestat: do not flush stats in recency check (no CVSS, Linux)
- [CVE-2024-41032](https://cve.now/CVE-2024-41032.md): mm: vmalloc: check if a hash-index is in cpu\_possible\_mask (CVSS 7.8, Linux)
- [CVE-2024-41031](https://cve.now/CVE-2024-41031.md): mm/filemap: skip to create PMD-sized page cache if needed (no CVSS, Linux)
- [CVE-2024-41030](https://cve.now/CVE-2024-41030.md): ksmbd: discard write access to the directory open (no CVSS, Linux)
- [CVE-2024-41029](https://cve.now/CVE-2024-41029.md): nvmem: core: limit cell sysfs permissions to main attribute ones (no CVSS, Linux)
- [CVE-2024-41028](https://cve.now/CVE-2024-41028.md): platform/x86: toshiba\_acpi: Fix array out-of-bounds access (CVSS 7.1, Linux)
- [CVE-2024-41027](https://cve.now/CVE-2024-41027.md): Fix userfaultfd\_api to return EINVAL as expected (no CVSS, Linux)
- [CVE-2024-41026](https://cve.now/CVE-2024-41026.md): mmc: davinci\_mmc: Prevent transmitted data size from exceeding sgm's length (CVSS 7.8, Linux)
- [CVE-2024-41025](https://cve.now/CVE-2024-41025.md): misc: fastrpc: Fix memory leak in audio daemon attach operation (no CVSS, Linux)
- [CVE-2024-41023](https://cve.now/CVE-2024-41023.md): sched/deadline: Fix task\_struct reference leak (no CVSS, Linux)
- [CVE-2024-38529](https://cve.now/CVE-2024-38529.md): Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment (CVSS 9.1, admidio · admidio/admidio)
- [CVE-2024-37906](https://cve.now/CVE-2024-37906.md): Admidio has Blind SQL Injection in ecard\_send.php (CVSS 10.0, admidio · admidio/admidio)
- [CVE-2024-6984](https://cve.now/CVE-2024-6984.md): An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access (CVSS 8.8, Canonical Juju · github.com/juju/juju)
- [CVE-2024-6576](https://cve.now/CVE-2024-6576.md): MOVEit Transfer Privilege Escalation Vulnerability (CVSS 7.3, Progress MOVEit Transfer)
- [CVE-2024-41022](https://cve.now/CVE-2024-41022.md): drm/amdgpu: Fix signedness bug in sdma\_v4\_0\_process\_trap\_irq() (CVSS 7.0, Linux)
- [CVE-2024-41021](https://cve.now/CVE-2024-41021.md): s390/mm: Fix VM\_FAULT\_HWPOISON handling in do\_exception() (no CVSS, Linux)
- [CVE-2024-41020](https://cve.now/CVE-2024-41020.md): filelock: Fix fcntl/close race recovery compat path (CVSS 7.8, Linux)
- [CVE-2024-6124](https://cve.now/CVE-2024-6124.md): Reflected XSS in Hubshare via Open Redirect (CVSS 8.5, M-Files Hubshare)
- [CVE-2024-7200](https://cve.now/CVE-2024-7200.md): SourceCodester Complaints Report Management System cross site scripting (CVSS 5.3, SourceCodester Complaints Report Management System)
- [CVE-2024-6881](https://cve.now/CVE-2024-6881.md): Stored XSS Vulnerability (CVSS 8.5, M-Files Hubshare)
- [CVE-2024-7199](https://cve.now/CVE-2024-7199.md): SourceCodester Complaints Report Management System manage\_user.php sql injection (CVSS 5.3, SourceCodester Complaints Report Management System)
- [CVE-2024-7198](https://cve.now/CVE-2024-7198.md): SourceCodester Complaints Report Management System manage\_station.php sql injection (CVSS 5.3, SourceCodester Complaints Report Management System)
- [CVE-2024-7197](https://cve.now/CVE-2024-7197.md): SourceCodester Complaints Report Management System manage\_complaint.php sql injection (CVSS 5.3, SourceCodester Complaints Report Management System)
- [CVE-2024-7196](https://cve.now/CVE-2024-7196.md): SourceCodester Complaints Report Management System sql injection (CVSS 6.9, SourceCodester Complaints Report Management System)
- [CVE-2024-7195](https://cve.now/CVE-2024-7195.md): itsourcecode Society Management System check\_admin.php sql injection (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2024-7194](https://cve.now/CVE-2024-7194.md): itsourcecode Society Management System check\_student.php sql injection (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2024-7193](https://cve.now/CVE-2024-7193.md): Mp3tag DLL tak\_deco\_lib.dll uncontrolled search path (CVSS 4.8, Mp3tag)
- [CVE-2024-7192](https://cve.now/CVE-2024-7192.md): itsourcecode Society Management System student.php unrestricted upload (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2024-41726](https://cve.now/CVE-2024-41726.md): Path traversal vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. (CVSS 7.5, Sky Co. SKYSEA Client View)
- [CVE-2024-41143](https://cve.now/CVE-2024-41143.md): Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. (CVSS 7.8, Sky Co. SKYSEA Client View)
- [CVE-2024-41139](https://cve.now/CVE-2024-41139.md): Incorrect privilege assignment vulnerability exists in SKYSEA Client View Ver.6.010.06 to Ver.19.210.04e. (CVSS 7.8, Sky Co. SKYSEA Client View)
- [CVE-2024-41881](https://cve.now/CVE-2024-41881.md): SDoP versions prior to 1.11 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow (CVSS 8.8, Philip Hazel SDoP)
- [CVE-2024-7191](https://cve.now/CVE-2024-7191.md): itsourcecode Society Management System get\_balance.php sql injection (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2024-7190](https://cve.now/CVE-2024-7190.md): itsourcecode Society Management System get\_price.php sql injection (CVSS 5.3, itsourcecode Society Management System)
- [CVE-2024-7189](https://cve.now/CVE-2024-7189.md): itsourcecode Online Food Ordering System editproduct.php unrestricted upload (CVSS 5.3, itsourcecode Online Food Ordering System)
- [CVE-2024-7188](https://cve.now/CVE-2024-7188.md): Bylancer Quicklancer GET Parameter listing sql injection (CVSS 6.9, Bylancer Quicklancer)
- [CVE-2024-41019](https://cve.now/CVE-2024-41019.md): fs/ntfs3: Validate ff offset (CVSS 7.8, Linux)
- [CVE-2024-41018](https://cve.now/CVE-2024-41018.md): fs/ntfs3: Add a check for attr\_names and oatbl (CVSS 7.8, Linux)
- [CVE-2024-41017](https://cve.now/CVE-2024-41017.md): jfs: don't walk off the end of ealist (CVSS 7.8, Linux)
- [CVE-2024-41016](https://cve.now/CVE-2024-41016.md): ocfs2: strict bound check before memcmp in ocfs2\_xattr\_find\_entry() (CVSS 7.8, Linux)
- [CVE-2024-41015](https://cve.now/CVE-2024-41015.md): ocfs2: add bounds checking to ocfs2\_check\_dir\_entry() (CVSS 7.8, Linux)
- [CVE-2024-41014](https://cve.now/CVE-2024-41014.md): xfs: add bounds checking to xlog\_recover\_process\_data (CVSS 7.1, Linux)
- [CVE-2024-41013](https://cve.now/CVE-2024-41013.md): xfs: don't walk off the end of a directory data block (no CVSS, Linux)
- [CVE-2024-7187](https://cve.now/CVE-2024-7187.md): TOTOLINK A3600R cstecgi.cgi UploadCustomModule buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-41091](https://cve.now/CVE-2024-41091.md): tun: add missing verification for short frame (CVSS 8.8, Linux)
- [CVE-2024-41090](https://cve.now/CVE-2024-41090.md): tap: add missing verification for short frame (CVSS 8.8, Linux)
- [CVE-2024-7186](https://cve.now/CVE-2024-7186.md): TOTOLINK A3600R cstecgi.cgi setWiFiAclAddConfig buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-6487](https://cve.now/CVE-2024-6487.md): Inline Related Posts \< 3.8.0 - Admin+ Stored XSS (CVSS 5.9, Inline Related Posts)
- [CVE-2024-6366](https://cve.now/CVE-2024-6366.md): User Profile Builder \< 3.11.8 - Unauthenticated Media Upload (CVSS 9.1, User Profile Builder)
- [CVE-2024-6362](https://cve.now/CVE-2024-6362.md): Ultimate Blocks \< 3.2.0 - Contributor+ Stored XSS (CVSS 4.6, Ultimate Blocks)
- [CVE-2024-5883](https://cve.now/CVE-2024-5883.md): Ultimate Classified Listings \< 1.3 - Reflected XSS (CVSS 4.7, Ultimate Classified Listings)
- [CVE-2024-5882](https://cve.now/CVE-2024-5882.md): Ultimate Classified Listings \< 1.3 - Unauthenticated LFI (CVSS 7.5, Ultimate Classified Listings)
- [CVE-2024-5285](https://cve.now/CVE-2024-5285.md): WP Affiliate Platform \< 6.5.2 - Affiliate Deletion via CSRF (CVSS 5.5, wp-affiliate-platform)
- [CVE-2024-4483](https://cve.now/CVE-2024-4483.md): Email Encoder \< 2.2.2 - Admin+ Stored XSS (CVSS 5.4, Email Encoder)
- [CVE-2024-37381](https://cve.now/CVE-2024-37381.md): An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network t (CVSS 8.4, Ivanti EPM)
- [CVE-2024-7185](https://cve.now/CVE-2024-7185.md): TOTOLINK A3600R cstecgi.cgi setWebWlanIdx buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7184](https://cve.now/CVE-2024-7184.md): TOTOLINK A3600R cstecgi.cgi setUrlFilterRules buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7183](https://cve.now/CVE-2024-7183.md): TOTOLINK A3600R cstecgi.cgi setUploadSetting buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7182](https://cve.now/CVE-2024-7182.md): TOTOLINK A3600R cstecgi.cgi setUpgradeFW buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7181](https://cve.now/CVE-2024-7181.md): TOTOLINK A3600R cstecgi.cgi setTelnetCfg command injection (CVSS 5.3, TOTOLINK A3600R)
- [CVE-2024-7202](https://cve.now/CVE-2024-7202.md): Simopro Technology WinMatrix3 Web package - SQL Injection (CVSS 9.8, Simopro Technology WinMatrix3)
- [CVE-2024-7180](https://cve.now/CVE-2024-7180.md): TOTOLINK A3600R cstecgi.cgi setPortForwardRules buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7201](https://cve.now/CVE-2024-7201.md): Simopro Technology WinMatrix3 Web package - SQL Injection (CVSS 9.8, Simopro Technology WinMatrix3)
- [CVE-2024-32671](https://cve.now/CVE-2024-32671.md): Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escarg (CVSS 6.9, Samsung Open Source Escargot)
- [CVE-2024-7179](https://cve.now/CVE-2024-7179.md): TOTOLINK A3600R cstecgi.cgi setParentalRules buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-5670](https://cve.now/CVE-2024-5670.md): Softnext Mail SQR Expert and Mail Archiving Expert - OS Command Injection (CVSS 9.8, Softnext SN OS)
- [CVE-2024-7178](https://cve.now/CVE-2024-7178.md): TOTOLINK A3600R cstecgi.cgi setMacQos buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7177](https://cve.now/CVE-2024-7177.md): TOTOLINK A3600R cstecgi.cgi setLanguageCfg buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7176](https://cve.now/CVE-2024-7176.md): TOTOLINK A3600R cstecgi.cgi setIpQosRules buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-7175](https://cve.now/CVE-2024-7175.md): TOTOLINK A3600R cstecgi.cgi setDiagnosisCfg os command injection (CVSS 5.3, TOTOLINK A3600R)
- [CVE-2024-7174](https://cve.now/CVE-2024-7174.md): TOTOLINK A3600R cstecgi.cgi setdeviceName buffer overflow (CVSS 8.7, TOTOLINK A3600R)
- [CVE-2024-28804](https://cve.now/CVE-2024-28804.md): An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. (CVSS 7.1)
- [CVE-2024-28805](https://cve.now/CVE-2024-28805.md): An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. (CVSS 9.1)
- [CVE-2024-28806](https://cve.now/CVE-2024-28806.md): An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. (CVSS 7.5)
- [CVE-2024-33365](https://cve.now/CVE-2024-33365.md): Buffer Overflow vulnerability in Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.20\_cn allows a remote attacker to execute arbitrary code via the Virt (CVSS 7.5)
- [CVE-2024-37856](https://cve.now/CVE-2024-37856.md): Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the first, l (CVSS 5.4)
- [CVE-2024-37857](https://cve.now/CVE-2024-37857.md): SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via id parameter to php (CVSS 8.8)
- [CVE-2024-37858](https://cve.now/CVE-2024-37858.md): SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to (CVSS 9.8)
- [CVE-2024-37859](https://cve.now/CVE-2024-37859.md): Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page par (CVSS 6.1)
- [CVE-2024-40576](https://cve.now/CVE-2024-40576.md): Cross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "Ho (CVSS 4.7)
- [CVE-2024-41624](https://cve.now/CVE-2024-41624.md): Incorrect access control in Himalaya Xiaoya nano smart speaker rom\_version 1.6.96 allows a remote attacker to have an unspecified impact. (CVSS 6.3)
- [CVE-2024-41631](https://cve.now/CVE-2024-41631.md): Buffer Overflow vulnerability in host-host NEUQ\_board v.1.0 allows a remote attacker to cause a denial of service via the password.h compone (CVSS 7.5)
- [CVE-2024-41637](https://cve.now/CVE-2024-41637.md): RaspAP before 3.1.5 allows an attacker to escalate privileges: the www-data user has write access to the restapi.service file and also posse (CVSS 8.3, billz/raspap-webgui)
- [CVE-2024-41640](https://cve.now/CVE-2024-41640.md): Cross Site Scripting (XSS) vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-07-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.