# CVEs published 2024-10-01

110 CVEs were published on October 1, 2024: 9 critical, 38 high. Days are UTC.

- [CVE-2024-47523](https://cve.now/CVE-2024-47523.md): LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature (CVSS 7.5, librenms · librenms/librenms)
- [CVE-2024-47524](https://cve.now/CVE-2024-47524.md): LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name (CVSS 7.2, librenms · librenms/librenms)
- [CVE-2024-47525](https://cve.now/CVE-2024-47525.md): Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php (CVSS 7.5, librenms · librenms/librenms)
- [CVE-2024-47526](https://cve.now/CVE-2024-47526.md): LibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert\_template.inc.php (CVSS 3.5, librenms · librenms/librenms)
- [CVE-2024-47527](https://cve.now/CVE-2024-47527.md): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php (CVSS 7.5, librenms · librenms/librenms)
- [CVE-2024-47528](https://cve.now/CVE-2024-47528.md): LibreNMS Contains a Stored XSS via File Upload (CVSS 4.6, librenms · librenms/librenms)
- [CVE-2024-47609](https://cve.now/CVE-2024-47609.md): Remotely exploitable DoS in Tonic \`\<=v0.12.2\` (CVSS 6.9, hyperium tonic · tonic)
- [CVE-2024-9407](https://cve.now/CVE-2024-9407.md): Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction (CVSS 4.7, podman · buildah +8)
- [CVE-2024-9411](https://cve.now/CVE-2024-9411.md): OFCMS add.json add cross site scripting (CVSS 5.3, OFCMS)
- [CVE-2024-9341](https://cve.now/CVE-2024-9341.md): Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library (CVSS 5.4, github.com/containers/common · Red Hat Enterprise Linux +1)
- [CVE-2024-9355](https://cve.now/CVE-2024-9355.md): Golang-fips: golang fips zeroed buffer (CVSS 6.5, github.com/golang-fips/openssl · Red Hat Enterprise Lin… +20)
- [CVE-2024-47608](https://cve.now/CVE-2024-47608.md): Logicytics vulnerable to shell injections (CVSS 6.9, DefinetlyNotAI Logicytics)
- [CVE-2024-47071](https://cve.now/CVE-2024-47071.md): OSS Endpoint Manager allows unauthorized access to read system files (CVSS 6.8, FreePBX endpointman)
- [CVE-2024-47604](https://cve.now/CVE-2024-47604.md): XSS vulnerability in NuGetGallery HTML attributes handling (CVSS 8.2, NuGetGallery)
- [CVE-2024-47534](https://cve.now/CVE-2024-47534.md): Incorrect delegation lookups can make go-tuf download the wrong artifact (CVSS 8.2, theupdateframework go-tuf · github.com/theupdateframework/g…)
- [CVE-2024-9403](https://cve.now/CVE-2024-9403.md): Memory safety bugs present in Firefox 130. (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9395](https://cve.now/CVE-2024-9395.md): A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. (CVSS 5.3, Mozilla Firefox)
- [CVE-2024-9391](https://cve.now/CVE-2024-9391.md): A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. (CVSS 6.5, Mozilla Firefox)
- [CVE-2024-9402](https://cve.now/CVE-2024-9402.md): Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9401](https://cve.now/CVE-2024-9401.md): Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9400](https://cve.now/CVE-2024-9400.md): A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9399](https://cve.now/CVE-2024-9399.md): A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service con (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9398](https://cve.now/CVE-2024-9398.md): By checking the result of calls to \`window.open\` with specifically set protocol handlers, an attacker could determine if the application whi (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9397](https://cve.now/CVE-2024-9397.md): A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9396](https://cve.now/CVE-2024-9396.md): It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to m (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9394](https://cve.now/CVE-2024-9394.md): An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the \`resource://devtools\` origin. (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9393](https://cve.now/CVE-2024-9393.md): An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the \`resource://pdf.js\` origin. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-9392](https://cve.now/CVE-2024-9392.md): A compromised content process could have allowed for the arbitrary loading of cross-origin pages. (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-41673](https://cve.now/CVE-2024-41673.md): Decidim has a cross-site scripting vulnerability in the version control page (CVSS 7.1, decidim)
- [CVE-2024-45408](https://cve.now/CVE-2024-45408.md): eLabFTW contains a direct and indirect information disclosure (CVSS 7.5, elabftw)
- [CVE-2024-25632](https://cve.now/CVE-2024-25632.md): Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances (CVSS 8.6, elabftw)
- [CVE-2023-7273](https://cve.now/CVE-2023-7273.md): Cross Site Request Forgery in Kiteworks OwnCloud (CVSS 6.8, Kiteworks OwnCloud)
- [CVE-2024-30132](https://cve.now/CVE-2024-30132.md): Missing default HTTP security headers affect HCL Nomad server on Domino (CVSS 3.7, HCL Software Nomad server on Domino)
- [CVE-2024-9405](https://cve.now/CVE-2024-9405.md): An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. (CVSS 5.3, Pluck CMS)
- [CVE-2023-3441](https://cve.now/CVE-2023-3441.md): Exposure of Sensitive Information Due to Incompatible Policies in GitLab (CVSS 6.6, GitLab)
- [CVE-2024-9060](https://cve.now/CVE-2024-9060.md): AVIF & SVG Uploader \<= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, grandplugins AVIF Uploader)
- [CVE-2024-9118](https://cve.now/CVE-2024-9118.md): QS Dark Mode Plugin \<= 2.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, quomodosoft QS Dark Mode Plugin)
- [CVE-2024-9289](https://cve.now/CVE-2024-9289.md): WordPress & WooCommerce Affiliate Program \<= 8.4.1 - Authentication Bypass to Account Takeover and Privilege Escalation (CVSS 9.8, RedefiningTheWeb WordPress & WooCommerce Affiliate Program)
- [CVE-2024-8430](https://cve.now/CVE-2024-8430.md): Spice Starter Sites \<= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import (CVSS 5.3, spicethemes Spice Starter Sites)
- [CVE-2024-9265](https://cve.now/CVE-2024-9265.md): Echo RSS Feed Post Generator \<= 5.4.6 - Unauthenticated Privilege Escalation (CVSS 9.8, CodeRevolution Echo RSS Feed Post Generator)
- [CVE-2024-8324](https://cve.now/CVE-2024-8324.md): XO Slider \<= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ishitaka XO Slider)
- [CVE-2024-8786](https://cve.now/CVE-2024-8786.md): Auto Featured Image from Title \<= 2.3 - Reflected Cross-Site Scripting (CVSS 6.1, brochris Auto Featured Image from Title)
- [CVE-2024-9018](https://cve.now/CVE-2024-9018.md): WP Easy Gallery \<= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter (CVSS 8.8, hahncgdev WP Easy Gallery – WordPress Gallery Plugin)
- [CVE-2024-9220](https://cve.now/CVE-2024-9220.md): LH Copy Media File \<= 1.08 - Reflected Cross-Site Scripting (CVSS 6.1, shawfactor LH Copy Media File)
- [CVE-2024-8793](https://cve.now/CVE-2024-8793.md): Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More \<= 2.7.2.1 - Reflected Cross-Site Scripting (CVSS 6.1, jkohlbach Store Exporter – Export WooCommerce Products, Ord…)
- [CVE-2024-8288](https://cve.now/CVE-2024-8288.md): Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg \<= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute (CVSS 6.4, adreastrian Guten Post Layout – An Advanced Post Grid Colle…)
- [CVE-2024-9228](https://cve.now/CVE-2024-9228.md): Loggedin – Limit Active Logins \<= 1.3.1 - Reflected Cross-Site Scripting (CVSS 6.1, joelcj91 Loggedin – Limit Concurrent Sessions)
- [CVE-2024-8799](https://cve.now/CVE-2024-8799.md): Custom Banners \<= 3.3 - Reflected Cross-Site Scripting (CVSS 6.1, ghuger Custom Banners)
- [CVE-2024-9224](https://cve.now/CVE-2024-9224.md): Hello World \<= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, kau-boy Hello World)
- [CVE-2024-9209](https://cve.now/CVE-2024-9209.md): WP Search Analytics \<= 1.4.10 - Reflected Cross-Site Scripting (CVSS 6.1, cornelraiu-1 Search Analytics for WP)
- [CVE-2024-9241](https://cve.now/CVE-2024-9241.md): PDF Image Generator \<= 1.5.6 - Reflected Cross-Site Scripting (CVSS 6.1, fishpie PDF Image Generator)
- [CVE-2024-8728](https://cve.now/CVE-2024-8728.md): Easy Load More \<= 1.0.3 - Reflected Cross-Site Scripting (CVSS 6.1, brianbrey Easy Load More)
- [CVE-2024-8727](https://cve.now/CVE-2024-8727.md): DK PDF \<= 1.9.6 - Reflected Cross-Site Scripting (CVSS 6.1, torstenbulk DK PDF – WordPress PDF Generator)
- [CVE-2024-7434](https://cve.now/CVE-2024-7434.md): UltraPress \<= 1.2.2 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, ultrapressorg UltraPress)
- [CVE-2024-9267](https://cve.now/CVE-2024-9267.md): Easy WordPress Subscribe – Optin Hound \<= 1.4.3 - Reflected Cross-Site Scripting via add\_query\_arg Parameter (CVSS 6.1, optinhound Easy WordPress Subscribe – Optin Hound)
- [CVE-2024-8989](https://cve.now/CVE-2024-8989.md): Stars Testimonials \<= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars\_testimonials Shortcode (CVSS 6.4, premio Stars Testimonials — Responsive Reviews & Star Ratin…)
- [CVE-2024-8675](https://cve.now/CVE-2024-8675.md): Soumettre.fr \<= 2.1.3 - Missing Authorization (CVSS 4.3, Soumettre.fr)
- [CVE-2024-9304](https://cve.now/CVE-2024-9304.md): LocateAndFilter \<= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, dgamoni LocateAndFilter)
- [CVE-2024-8990](https://cve.now/CVE-2024-8990.md): Geo Mashup \<= 1.13.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via geo\_mashup\_visible\_posts\_list Shortcode (CVSS 6.4, cyberhobo Geo Mashup)
- [CVE-2024-8632](https://cve.now/CVE-2024-8632.md): KB Support – WordPress Help Desk and Knowledge Base \<= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure (CVSS 6.5, logoninc KB Support – Customer Support Ticket & Helpdesk Pl…)
- [CVE-2024-8548](https://cve.now/CVE-2024-8548.md): KB Support – WordPress Help Desk and Knowledge Base \<= 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions (CVSS 8.1, logoninc KB Support – Customer Support Ticket & Helpdesk Pl…)
- [CVE-2024-9272](https://cve.now/CVE-2024-9272.md): R Animated Icon Plugin \<= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, mascotdevelopers R Animated Icon Plugin)
- [CVE-2024-8720](https://cve.now/CVE-2024-8720.md): RumbleTalk Live Group Chat – HTML5 \<= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, RumbleTalk Live Group Chat – HTML5)
- [CVE-2024-8718](https://cve.now/CVE-2024-8718.md): Gravity Forms Toolbar \<= 1.7.0 - Reflected Cross-Site Scripting (CVSS 6.1, daveshine Gravity Forms Toolbar)
- [CVE-2024-7433](https://cve.now/CVE-2024-7433.md): Empowerment \<= 1.0.2 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, ultrapressorg Empowerment)
- [CVE-2024-9274](https://cve.now/CVE-2024-9274.md): Elastik Page Builder \<= 0.27.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, azexo Elastik Page Builder)
- [CVE-2024-7869](https://cve.now/CVE-2024-7869.md): 123.chat - Video Chat \<= 1.3.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, 123.chat - Video Chat)
- [CVE-2024-9106](https://cve.now/CVE-2024-9106.md): Wechat Social login \<= 1.3.0 - Authentication Bypass (CVSS 9.8, xunhuweb Wechat Social login 微信QQ钉钉登录插件)
- [CVE-2024-7432](https://cve.now/CVE-2024-7432.md): Unseen Blog \<= 1.0.0 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, ultrapressorg Unseen Blog)
- [CVE-2024-9269](https://cve.now/CVE-2024-9269.md): Relogo \<= 0.4.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, cconover Relogo)
- [CVE-2024-9119](https://cve.now/CVE-2024-9119.md): SVG Complete \<= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, automatic-rock SVG Complete)
- [CVE-2024-9108](https://cve.now/CVE-2024-9108.md): Wechat Social login \<= 1.3.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, xunhuweb Wechat Social login 微信QQ钉钉登录插件)
- [CVE-2024-9145](https://cve.now/CVE-2024-9145.md): Local command injection in Wiz Code Visual Studio Code extension (CVSS 7.1, Wiz Code Visual Studio Code extension)
- [CVE-2024-8107](https://cve.now/CVE-2024-8107.md): Slider Revolution \<= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, Revolution Slider Slider Revolution)
- [CVE-2024-21531](https://cve.now/CVE-2024-21531.md): All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the pro (CVSS 5.3, git-shallow-clone)
- [CVE-2024-21489](https://cve.now/CVE-2024-21489.md): Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the (CVSS 8.8, uplot · org.webjars.npm:uplot)
- [CVE-2024-0116](https://cve.now/CVE-2024-0116.md): NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds read issue by releasing a shared memory regi (CVSS 4.9, NVIDIA Triton Inference Server)
- [CVE-2024-47295](https://cve.now/CVE-2024-47295.md): Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary passwor (CVSS 8.1, SEIKO EPSON Web Config)
- [CVE-2024-9360](https://cve.now/CVE-2024-9360.md): code-projects Restaurant Reservation System updatebal.php sql injection (CVSS 6.9, code-projects Restaurant Reservation System)
- [CVE-2024-8981](https://cve.now/CVE-2024-8981.md): Broken Link Checker \<= 2.4.0 - Reflected Cross-Site Scripting (CVSS 7.1, wpmudev Broken Link Checker)
- [CVE-2024-9359](https://cve.now/CVE-2024-9359.md): code-projects Restaurant Reservation System addcompany.php sql injection (CVSS 6.9, code-projects Restaurant Reservation System)
- [CVE-2024-47396](https://cve.now/CVE-2024-47396.md): WordPress Move Addons for Elementor plugin \<= 1.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, moveaddons Move Addons for Elementor)
- [CVE-2024-47560](https://cve.now/CVE-2024-47560.md): RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. (CVSS 7.8, J’s Communication Co. RevoWorks Cloud Client)
- [CVE-2024-9358](https://cve.now/CVE-2024-9358.md): ThingsBoard HTTP RPC API resource consumption (CVSS 6.0, ThingsBoard)
- [CVE-2021-37577](https://cve.now/CVE-2021-37577.md): Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specificatio (CVSS 6.8)
- [CVE-2024-25658](https://cve.now/CVE-2024-25658.md): Cleartext storage of passwords in Infinera TNMS (Transcend Network Management System) Server 19.10.3 allows attackers (with access to the da (CVSS 6.5)
- [CVE-2024-25659](https://cve.now/CVE-2024-25659.md): In Infinera TNMS (Transcend Network Management System) 19.10.3, an insecure default configuration of the internal SFTP server on Linux serve (CVSS 7.2)
- [CVE-2024-25660](https://cve.now/CVE-2024-25660.md): The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unautho (CVSS 9.0)
- [CVE-2024-25661](https://cve.now/CVE-2024-25661.md): In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop applicat (CVSS 7.7)
- [CVE-2024-31835](https://cve.now/CVE-2024-31835.md): Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload (CVSS 4.7)
- [CVE-2024-41276](https://cve.now/CVE-2024-41276.md): A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. (CVSS 9.8)
- [CVE-2024-42514](https://cve.now/CVE-2024-42514.md): A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to (CVSS 8.1)
- [CVE-2024-44610](https://cve.now/CVE-2024-44610.md): PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters i (CVSS 5.6)
- [CVE-2024-44744](https://cve.now/CVE-2024-44744.md): An issue in Malwarebytes Premium Security v5.0.0.883 allows attackers to execute arbitrary code via placing crafted binaries into unspecifie (CVSS 5.7)
- [CVE-2024-45967](https://cve.now/CVE-2024-45967.md): Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. (CVSS 4.7, pagekit/pagekit)
- [CVE-2024-45999](https://cve.now/CVE-2024-45999.md): A SQL Injection vulnerability was discovered in Cloudlog 2.6.15, specifically within the get\_station\_info()function located in the file /app (CVSS 6.6)
- [CVE-2024-46079](https://cve.now/CVE-2024-46079.md): Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in proj\_new.php via the Descricao parameter. (CVSS 6.1)
- [CVE-2024-46080](https://cve.now/CVE-2024-46080.md): Scriptcase v9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm\_zip function. (CVSS 8.0)
- [CVE-2024-46081](https://cve.now/CVE-2024-46081.md): Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2024-46082](https://cve.now/CVE-2024-46082.md): Scriptcase v.9.10.023 and before is vulnerable to Cross Site Scripting (XSS) in nm\_cor.php via the form and field parameters. (CVSS 5.4)
- [CVE-2024-46083](https://cve.now/CVE-2024-46083.md): Scriptcase v9.10.023 and before is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2024-46084](https://cve.now/CVE-2024-46084.md): Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm\_unzip function. (CVSS 8.0)
- [CVE-2024-46258](https://cve.now/CVE-2024-46258.md): cute\_png v1.05 was discovered to contain a heap buffer overflow via the cp\_load\_png\_mem() function at cute\_png.h. (CVSS 7.8)
- [CVE-2024-46259](https://cve.now/CVE-2024-46259.md): cute\_png v1.05 was discovered to contain a heap buffer overflow via the cp\_unfilter() function at cute\_png.h. (CVSS 7.8)
- [CVE-2024-46261](https://cve.now/CVE-2024-46261.md): cute\_png v1.05 was discovered to contain a heap buffer overflow via the cp\_make32() function at cute\_png.h. (CVSS 7.8)
- [CVE-2024-46263](https://cve.now/CVE-2024-46263.md): cute\_png v1.05 was discovered to contain a stack overflow via the cp\_dynamic() function at cute\_png.h. (CVSS 7.8)
- [CVE-2024-46264](https://cve.now/CVE-2024-46264.md): cute\_png v1.05 was discovered to contain a heap buffer overflow via the cp\_find() function at cute\_png.h. (CVSS 7.8)
- [CVE-2024-46267](https://cve.now/CVE-2024-46267.md): cute\_png v1.05 was discovered to contain a heap buffer overflow via the cp\_block() function at cute\_png.h. (CVSS 7.8)
- [CVE-2024-46274](https://cve.now/CVE-2024-46274.md): cute\_png v1.05 was discovered to contain a heap buffer overflow via the cp\_stored() function at cute\_png.h. (CVSS 7.8)
- [CVE-2024-46276](https://cve.now/CVE-2024-46276.md): cute\_png v1.05 was discovered to contain a heap buffer overflow via the cp\_chunk() function at cute\_png.h. (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.