# CVEs published 2024-10-10

118 CVEs were published on October 10, 2024: 7 critical, 28 high. Days are UTC.

- [CVE-2024-9818](https://cve.now/CVE-2024-9818.md): SourceCodester Online Veterinary Appointment System manage\_category.php sql injection (CVSS 6.9, SourceCodester Online Veterinary Appointment System)
- [CVE-2024-9817](https://cve.now/CVE-2024-9817.md): code-projects Blood Bank System update.php sql injection (CVSS 5.3, code-projects Blood Bank System)
- [CVE-2024-47867](https://cve.now/CVE-2024-47867.md): Lack of integrity check on the downloaded FRP client in Gradio (CVSS 2.1, gradio-app gradio · gradio)
- [CVE-2024-47868](https://cve.now/CVE-2024-47868.md): Several components’ post-process steps may allow arbitrary file leaks in Gradio (CVSS 6.3, gradio-app gradio · gradio)
- [CVE-2024-47869](https://cve.now/CVE-2024-47869.md): Non-constant-time comparison when comparing hashes in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-47870](https://cve.now/CVE-2024-47870.md): Race condition in update\_root\_in\_config may redirect user traffic in Gradio (CVSS 7.1, gradio-app gradio · gradio)
- [CVE-2024-47871](https://cve.now/CVE-2024-47871.md): Insecure communication between the FRP client and server in Gradio (CVSS 8.2, gradio-app gradio · gradio)
- [CVE-2024-47872](https://cve.now/CVE-2024-47872.md): Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-9816](https://cve.now/CVE-2024-9816.md): Codezips Tourist Management System change-image.php unrestricted upload (CVSS 5.1, Codezips Tourist Management System)
- [CVE-2024-47084](https://cve.now/CVE-2024-47084.md): CORS origin validation is not performed when the request has a cookie in Gradio (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-47164](https://cve.now/CVE-2024-47164.md): The \`is\_in\_or\_equal\` function may be bypassed in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-47165](https://cve.now/CVE-2024-47165.md): CORS origin validation accepts the null origin in Gradio (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-47166](https://cve.now/CVE-2024-47166.md): One-level read path traversal in \`/custom\_component\` in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-47167](https://cve.now/CVE-2024-47167.md): SSRF in the path parameter of /queue/join in Gradio (CVSS 6.9, gradio-app gradio · gradio)
- [CVE-2024-47168](https://cve.now/CVE-2024-47168.md): The \`enable\_monitoring\` flag set to \`False\` does not disable monitoring in Gradio (CVSS 2.3, gradio-app gradio · gradio)
- [CVE-2024-9815](https://cve.now/CVE-2024-9815.md): Codezips Tourist Management System create-package.php unrestricted upload (CVSS 5.1, Codezips Tourist Management System)
- [CVE-2024-9814](https://cve.now/CVE-2024-9814.md): Codezips Pharmacy Management System update.php sql injection (CVSS 6.9, Codezips Pharmacy Management System)
- [CVE-2024-9487](https://cve.now/CVE-2024-9487.md): An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled (CVSS 9.5, GitHub Enterprise Server)
- [CVE-2024-9813](https://cve.now/CVE-2024-9813.md): Codezips Pharmacy Management System register.php sql injection (CVSS 6.9, Codezips Pharmacy Management System)
- [CVE-2024-9812](https://cve.now/CVE-2024-9812.md): code-projects Crud Operation System delete.php sql injection (CVSS 6.9, code-projects Crud Operation System)
- [CVE-2024-9180](https://cve.now/CVE-2024-9180.md): Vault Operators in Root Namespace May Elevate Their Privileges (CVSS 7.2, HashiCorp Vault · github.com/hashicorp/vault +1)
- [CVE-2024-9811](https://cve.now/CVE-2024-9811.md): code-projects Restaurant Reservation System filter3.php sql injection (CVSS 6.9, code-projects Restaurant Reservation System)
- [CVE-2024-9810](https://cve.now/CVE-2024-9810.md): SourceCodester Record Management System sort2\_user.php cross site scripting (CVSS 5.3, SourceCodester Record Management System)
- [CVE-2024-9809](https://cve.now/CVE-2024-9809.md): SourceCodester Online Eyewear Shop Master.php delete\_product sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9808](https://cve.now/CVE-2024-9808.md): SourceCodester Online Eyewear Shop sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2024-9807](https://cve.now/CVE-2024-9807.md): Craig Rodway Classroombookings Session Page sessions cross site scripting (CVSS 5.1, Craig Rodway Classroombookings)
- [CVE-2024-9806](https://cve.now/CVE-2024-9806.md): Craig Rodway Classroombookings Room Page fields cross site scripting (CVSS 5.3, Craig Rodway Classroombookings)
- [CVE-2024-47354](https://cve.now/CVE-2024-47354.md): WordPress Simple Membership After Login Redirection plugin \<= 1.6 - Open Redirection vulnerability (CVSS 4.7, wp.insider Simple Membership After Login Redirection)
- [CVE-2024-47648](https://cve.now/CVE-2024-47648.md): WordPress EventPrime plugin \<= 4.0.4.5 - Open Redirection vulnerability (CVSS 4.7, Metagauss EventPrime)
- [CVE-2024-47636](https://cve.now/CVE-2024-47636.md): WordPress WP JobSearch plugin \<= 2.5.9 - PHP Object Injection vulnerability (CVSS 9.8, eyecix JobSearch)
- [CVE-2024-9805](https://cve.now/CVE-2024-9805.md): code-projects Blood Bank System campsdetails.php cross site scripting (CVSS 5.3, code-projects Blood Bank System)
- [CVE-2024-9804](https://cve.now/CVE-2024-9804.md): code-projects Blood Bank System campsdetails.php sql injection (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2024-47966](https://cve.now/CVE-2024-47966.md): Use of Uninitialized Variable vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47965](https://cve.now/CVE-2024-47965.md): Out-of-bounds Read vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47964](https://cve.now/CVE-2024-47964.md): Heap-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47963](https://cve.now/CVE-2024-47963.md): Out-of-bounds Write vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-47962](https://cve.now/CVE-2024-47962.md): Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 (CVSS 8.4, Delta Electronics CNCSoft-G2)
- [CVE-2024-9803](https://cve.now/CVE-2024-9803.md): code-projects Blood Bank Management System blooddetails.php cross site scripting (CVSS 5.3, code-projects Blood Bank Management System)
- [CVE-2024-9799](https://cve.now/CVE-2024-9799.md): SourceCodester Profile Registration without Reload Refresh add.php cross site scripting (CVSS 5.3, SourceCodester Profile Registration without Reload Refresh)
- [CVE-2024-9797](https://cve.now/CVE-2024-9797.md): code-projects Blood Bank System register.php sql injection (CVSS 6.9, code-projects Blood Bank System)
- [CVE-2024-9794](https://cve.now/CVE-2024-9794.md): Codezips Online Shopping Portal update-image1.php unrestricted upload (CVSS 5.3, Codezips Online Shopping Portal)
- [CVE-2023-25581](https://cve.now/CVE-2023-25581.md): Deserialization of untrusted data in InternalAttributeHandler in pac4j (CVSS 9.2, pac4j · org.pac4j:pac4j-core)
- [CVE-2024-9793](https://cve.now/CVE-2024-9793.md): Tenda AC1206 ate ate\_ifconfig\_set command injection (CVSS 5.3, Tenda AC1206)
- [CVE-2024-9792](https://cve.now/CVE-2024-9792.md): D-Link DSL-2750U Port Forwarding Page cross site scripting (CVSS 5.1, D-Link DSL-2750U)
- [CVE-2024-9790](https://cve.now/CVE-2024-9790.md): LyLme\_spage sou.php sql injection (CVSS 5.1, LyLme\_spage)
- [CVE-2024-9789](https://cve.now/CVE-2024-9789.md): LyLme\_spage apply.php sql injection (CVSS 5.1, LyLme\_spage)
- [CVE-2024-9788](https://cve.now/CVE-2024-9788.md): LyLme\_spage tag.php sql injection (CVSS 5.1, LyLme\_spage)
- [CVE-2024-9312](https://cve.now/CVE-2024-9312.md): Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. (CVSS 7.5, Canonical Authd · github.com/ubuntu/authd)
- [CVE-2024-4658](https://cve.now/CVE-2024-4658.md): SQLi in TE Informatics' Nova CMS (CVSS 6.9, TE Informatics Nova CMS)
- [CVE-2024-9787](https://cve.now/CVE-2024-9787.md): Contemporary Control System BASrouter BACnet BASRT-B UDP Packet denial of service (CVSS 6.9, Contemporary Control System BASrouter BACnet BASRT-B)
- [CVE-2024-9786](https://cve.now/CVE-2024-9786.md): D-Link DIR-619L B1 formSetLog buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9785](https://cve.now/CVE-2024-9785.md): D-Link DIR-619L B1 formSetDDNS buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-6157](https://cve.now/CVE-2024-6157.md): An attacker who successfully exploited these vulnerabilities could cause the robot to stop. (CVSS 5.1, ABB RobotWare)
- [CVE-2024-6530](https://cve.now/CVE-2024-6530.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 7.3, GitLab)
- [CVE-2024-9784](https://cve.now/CVE-2024-9784.md): D-Link DIR-619L B1 formResetStatistic buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9783](https://cve.now/CVE-2024-9783.md): D-Link DIR-619L B1 formLogDnsquery buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-9782](https://cve.now/CVE-2024-9782.md): D-Link DIR-619L B1 formEasySetupWWConfig buffer overflow (CVSS 8.7, D-Link DIR-619L B1)
- [CVE-2024-48902](https://cve.now/CVE-2024-48902.md): In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via AP (CVSS 5.4, JetBrains YouTrack)
- [CVE-2024-9201](https://cve.now/CVE-2024-9201.md): SQL injection vulnerability in SEUR plugin (CVSS 9.4, SEUR plugin)
- [CVE-2024-8977](https://cve.now/CVE-2024-8977.md): Server-Side Request Forgery (SSRF) in GitLab (CVSS 8.2, GitLab)
- [CVE-2024-9596](https://cve.now/CVE-2024-9596.md): Inclusion of Sensitive Information in Source Code in GitLab (CVSS 3.7, GitLab)
- [CVE-2024-45127](https://cve.now/CVE-2024-45127.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Commerce · magento/community-edition)
- [CVE-2024-45128](https://cve.now/CVE-2024-45128.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.4, Adobe Commerce · magento/community-edition)
- [CVE-2024-45133](https://cve.now/CVE-2024-45133.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45124](https://cve.now/CVE-2024-45124.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 5.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45123](https://cve.now/CVE-2024-45123.md): Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 6.1, Adobe Commerce · magento/community-edition)
- [CVE-2024-45121](https://cve.now/CVE-2024-45121.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45115](https://cve.now/CVE-2024-45115.md): Adobe Commerce | Improper Authentication (CWE-287) (CVSS 9.8, Adobe Commerce)
- [CVE-2024-45117](https://cve.now/CVE-2024-45117.md): Adobe Commerce | Improper Input Validation (CWE-20) (CVSS 7.6, Adobe Commerce · magento/community-edition)
- [CVE-2024-45116](https://cve.now/CVE-2024-45116.md): Adobe Commerce | Cross-site Scripting (XSS) (CWE-79) (CVSS 8.1, Adobe Commerce · magento/community-edition)
- [CVE-2024-45119](https://cve.now/CVE-2024-45119.md): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 4.9, Adobe Commerce · magento/community-edition)
- [CVE-2024-45122](https://cve.now/CVE-2024-45122.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45135](https://cve.now/CVE-2024-45135.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45120](https://cve.now/CVE-2024-45120.md): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) (CVSS 3.1, Adobe Commerce · magento/community-edition)
- [CVE-2024-45130](https://cve.now/CVE-2024-45130.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45132](https://cve.now/CVE-2024-45132.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 6.5, Adobe Commerce · magento/community-edition)
- [CVE-2024-45131](https://cve.now/CVE-2024-45131.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.4, Adobe Commerce · magento/community-edition)
- [CVE-2024-45148](https://cve.now/CVE-2024-45148.md): Adobe Commerce | Improper Authentication (CWE-287) (CVSS 8.8, Adobe Commerce)
- [CVE-2024-45134](https://cve.now/CVE-2024-45134.md): Adobe Commerce | Information Exposure (CWE-200) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45129](https://cve.now/CVE-2024-45129.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-45118](https://cve.now/CVE-2024-45118.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 6.5, Adobe Commerce · magento/community-edition)
- [CVE-2024-45149](https://cve.now/CVE-2024-45149.md): Adobe Commerce | Improper Access Control (CWE-284) (CVSS 2.7, Adobe Commerce · magento/community-edition)
- [CVE-2024-45125](https://cve.now/CVE-2024-45125.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 4.3, Adobe Commerce · magento/community-edition)
- [CVE-2024-9623](https://cve.now/CVE-2024-9623.md): Incorrect Authorization in GitLab (CVSS 4.9, GitLab)
- [CVE-2024-22068](https://cve.now/CVE-2024-22068.md): Weak Password Vulnerability in ZTE ZSR V2 Intelligent Multi Service Router (CVSS 6.0, ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 1…)
- [CVE-2024-6747](https://cve.now/CVE-2024-6747.md): Information leak in mknotifyd (CVSS 5.3, Checkmk)
- [CVE-2024-9802](https://cve.now/CVE-2024-9802.md): Conformance validation endpoint discloses detail about service to unauthenticated users (CVSS 5.3, Open Mainframe Project Zowe)
- [CVE-2024-9796](https://cve.now/CVE-2024-9796.md): WP-Advanced-Search \< 3.3.9.2 - Unauthenticated SQL Injection (CVSS 5.9, WP-Advanced-Search)
- [CVE-2024-9798](https://cve.now/CVE-2024-9798.md): Health endpoint offers list of onboarded services to unauthenticated users (CVSS 5.3, Open Mainframe Project Zowe)
- [CVE-2024-9781](https://cve.now/CVE-2024-9781.md): Improper Handling of Missing Values in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-9780](https://cve.now/CVE-2024-9780.md): Missing Initialization of a Variable in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-9156](https://cve.now/CVE-2024-9156.md): TI WooCommerce Wishlist \<= 2.8.2 - Unauthenticated SQL Injection via lang parameters (CVSS 5.9, TI WooCommerce Wishlist)
- [CVE-2024-9074](https://cve.now/CVE-2024-9074.md): Advanced Blocks Pro \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, essamamdani Advanced Blocks Pro)
- [CVE-2024-9520](https://cve.now/CVE-2024-9520.md): UserPlus \<= 2.0 - Missing Authorization via Multiple Functions (CVSS 6.3, User registration & user profile – UserPlus)
- [CVE-2024-9067](https://cve.now/CVE-2024-9067.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress \<= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion (CVSS 4.3, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-8477](https://cve.now/CVE-2024-8477.md): Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) \<= 3.1.87 - Cross-Site Request Forgery (CVSS 4.3, neeraj\_slit Brevo – Email, SMS, Web Push, Chat, and more.)
- [CVE-2024-9022](https://cve.now/CVE-2024-9022.md): TS Poll – Survey, Versus Poll, Image Poll, Video Poll \<= 2.4.0 - Authenticated (Administrator+) SQL Injection via orderby Parameter (CVSS 7.2, totalsoft TS Poll – Survey, Versus Poll, Image Poll, Video…)
- [CVE-2024-8729](https://cve.now/CVE-2024-8729.md): Easy Social Share Buttons \<= 1.4.5 - Reflected Cross-Site Scripting (CVSS 6.1, brianbrey Easy Social Share Buttons)
- [CVE-2024-9685](https://cve.now/CVE-2024-9685.md): Notification for Telegram \<= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message (CVSS 4.3, rainafarai Notification for Telegram)
- [CVE-2024-9057](https://cve.now/CVE-2024-9057.md): Curator.io: Show all your social media posts in a beautiful feed. \<= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via feed\_id Attribute (CVSS 6.4, curatorio Curator.io)
- [CVE-2024-9581](https://cve.now/CVE-2024-9581.md): Shortcodes AnyWhere \<= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, happyplugins Shortcodes AnyWhere)
- [CVE-2024-9377](https://cve.now/CVE-2024-9377.md): Products, Order & Customers Export for WooCommerce \<= 2.0.15 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory Export Products, Orders & Customers for WooCo…)
- [CVE-2024-9065](https://cve.now/CVE-2024-9065.md): WP Helper Premium \<= 4.6.1 - Missing Authorization in whp\_smtp\_send\_mail\_test (CVSS 5.3, matbao WP Helper Premium)
- [CVE-2024-9064](https://cve.now/CVE-2024-9064.md): Elementor Inline SVG \<= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, namogo Elementor Inline SVG)
- [CVE-2024-9066](https://cve.now/CVE-2024-9066.md): Marketing and SEO Booster \<= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, dale668 Marketing and SEO Booster)
- [CVE-2024-9522](https://cve.now/CVE-2024-9522.md): WP Users Masquerade \<= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass (CVSS 8.8, lagunaisw WP Users Masquerade)
- [CVE-2024-9518](https://cve.now/CVE-2024-9518.md): UserPlus \<= 2.0 - Unauthenticated Privilege Escalation (CVSS 9.8, User registration & user profile – UserPlus)
- [CVE-2024-8987](https://cve.now/CVE-2024-8987.md): Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify\_media Shortcode (CVSS 6.4, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2024-8513](https://cve.now/CVE-2024-8513.md): QA Analytics \<= 4.1.1.1 - Missing Authorization to Unauthenticated Settings Update (CVSS 5.3, quarka QA Assistants – Driven by data)
- [CVE-2024-9205](https://cve.now/CVE-2024-9205.md): Maximum Products per User for WooCommerce \<= 4.2.8 - Reflected Cross-Site Scripting (CVSS 6.1, wpcodefactory Maximum Products per User for WooCommerce)
- [CVE-2024-9519](https://cve.now/CVE-2024-9519.md): UserPlus \<= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation (CVSS 7.2, User registration & user profile – UserPlus)
- [CVE-2024-9072](https://cve.now/CVE-2024-9072.md): GDPR-Extensions-com – Consent Manager \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, gdprextensionscom GDPR-Extensions-com – Consent Manager)
- [CVE-2024-9457](https://cve.now/CVE-2024-9457.md): WP Builder \<= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, cssjockey WP Builder)
- [CVE-2024-7048](https://cve.now/CVE-2024-7048.md): IDOR in open-webui/open-webui (CVSS 6.3, open-webui/open-webui)
- [CVE-2024-35202](https://cve.now/CVE-2024-35202.md): Bitcoin Core before 25.0 allows remote attackers to cause a denial of service (blocktxn message-handling assertion and node exit) by includi (CVSS 7.5)
- [CVE-2024-48949](https://cve.now/CVE-2024-48949.md): The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || (CVSS 9.1, elliptic)
- [CVE-2024-48957](https://cve.now/CVE-2024-48957.md): execute\_filter\_audio in archive\_read\_support\_format\_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file (CVSS 7.8)
- [CVE-2024-48958](https://cve.now/CVE-2024-48958.md): execute\_filter\_delta in archive\_read\_support\_format\_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.