# CVEs published 2024-10-21

433 CVEs were published on October 21, 2024: 23 critical, 141 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-10125](https://cve.now/CVE-2024-10125.md): Lack of JWT issuer and signer validation (CVSS 6.9, Amazon.ApplicationLoadBalancer.Identity.AspNetCore Middlewa…)
- [CVE-2024-8901](https://cve.now/CVE-2024-8901.md): Lack of JWT issuer and signer validation (CVSS 6.9, Amazon AWS ALB Route Directive Adapter For Istio · github.c…)
- [CVE-2022-49033](https://cve.now/CVE-2022-49033.md): btrfs: qgroup: fix sleep from invalid context bug in btrfs\_qgroup\_inherit() (no CVSS, Linux)
- [CVE-2022-49032](https://cve.now/CVE-2022-49032.md): iio: health: afe4404: Fix oob read in afe4404\_\[read|write\]\_raw (no CVSS, Linux)
- [CVE-2022-49031](https://cve.now/CVE-2022-49031.md): iio: health: afe4403: Fix oob read in afe4403\_read\_raw (no CVSS, Linux)
- [CVE-2022-49030](https://cve.now/CVE-2022-49030.md): libbpf: Handle size overflow for ringbuf mmap (CVSS 7.8, Linux)
- [CVE-2022-49029](https://cve.now/CVE-2022-49029.md): hwmon: (ibmpex) Fix possible UAF when ibmpex\_register\_bmc() fails (CVSS 7.8, Linux)
- [CVE-2022-49028](https://cve.now/CVE-2022-49028.md): ixgbevf: Fix resource leak in ixgbevf\_init\_module() (no CVSS, Linux)
- [CVE-2022-49027](https://cve.now/CVE-2022-49027.md): iavf: Fix error handling in iavf\_init\_module() (no CVSS, Linux)
- [CVE-2022-49026](https://cve.now/CVE-2022-49026.md): e100: Fix possible use after free in e100\_xmit\_prepare (CVSS 7.8, Linux)
- [CVE-2022-49025](https://cve.now/CVE-2022-49025.md): net/mlx5e: Fix use-after-free when reverting termination table (CVSS 7.8, Linux)
- [CVE-2022-49024](https://cve.now/CVE-2022-49024.md): can: m\_can: pci: add missing m\_can\_class\_free\_dev() in probe/remove methods (no CVSS, Linux)
- [CVE-2022-49023](https://cve.now/CVE-2022-49023.md): wifi: cfg80211: fix buffer overflow in elem comparison (CVSS 7.1, Linux)
- [CVE-2022-49022](https://cve.now/CVE-2022-49022.md): wifi: mac8021: fix possible oob access in ieee80211\_get\_rate\_duration (CVSS 8.1, Linux)
- [CVE-2022-49021](https://cve.now/CVE-2022-49021.md): net: phy: fix null-ptr-deref while probe() failed (no CVSS, Linux)
- [CVE-2022-49020](https://cve.now/CVE-2022-49020.md): net/9p: Fix a potential socket leak in p9\_socket\_open (no CVSS, Linux)
- [CVE-2022-49019](https://cve.now/CVE-2022-49019.md): net: ethernet: nixge: fix NULL dereference (no CVSS, Linux)
- [CVE-2022-49018](https://cve.now/CVE-2022-49018.md): mptcp: fix sleep in atomic at close time (no CVSS, Linux)
- [CVE-2022-49017](https://cve.now/CVE-2022-49017.md): tipc: re-fetch skb cb after tipc\_msg\_validate (CVSS 8.8, Linux)
- [CVE-2022-49016](https://cve.now/CVE-2022-49016.md): net: mdiobus: fix unbalanced node reference count (no CVSS, Linux)
- [CVE-2022-49015](https://cve.now/CVE-2022-49015.md): net: hsr: Fix potential use-after-free (CVSS 8.8, Linux)
- [CVE-2022-49014](https://cve.now/CVE-2022-49014.md): net: tun: Fix use-after-free in tun\_detach() (CVSS 7.8, Linux)
- [CVE-2022-49013](https://cve.now/CVE-2022-49013.md): sctp: fix memory leak in sctp\_stream\_outq\_migrate() (no CVSS, Linux)
- [CVE-2022-49012](https://cve.now/CVE-2022-49012.md): afs: Fix server-\>active leak in afs\_put\_server (no CVSS, Linux)
- [CVE-2022-49011](https://cve.now/CVE-2022-49011.md): hwmon: (coretemp) fix pci device refcount leak in nv1a\_ram\_new() (no CVSS, Linux)
- [CVE-2022-49010](https://cve.now/CVE-2022-49010.md): hwmon: (coretemp) Check for null before removing sysfs attrs (no CVSS, Linux)
- [CVE-2022-49009](https://cve.now/CVE-2022-49009.md): hwmon: (asus-ec-sensors) Add checks for devm\_kcalloc (no CVSS, Linux)
- [CVE-2022-49008](https://cve.now/CVE-2022-49008.md): can: can327: can327\_feed\_frame\_to\_netdev(): fix potential skb leak when netdev is down (no CVSS, Linux)
- [CVE-2022-49007](https://cve.now/CVE-2022-49007.md): nilfs2: fix NULL pointer dereference in nilfs\_palloc\_commit\_free\_entry() (no CVSS, Linux)
- [CVE-2022-49006](https://cve.now/CVE-2022-49006.md): tracing: Free buffers when a used dynamic event is removed (no CVSS, Linux)
- [CVE-2022-49005](https://cve.now/CVE-2022-49005.md): ASoC: ops: Fix bounds check for \_sx controls (no CVSS, Linux)
- [CVE-2022-49004](https://cve.now/CVE-2022-49004.md): riscv: Sync efi page table's kernel mappings before switching (no CVSS, Linux)
- [CVE-2022-49003](https://cve.now/CVE-2022-49003.md): nvme: fix SRCU protection of nvme\_ns\_head list (CVSS 9.8, Linux)
- [CVE-2022-49002](https://cve.now/CVE-2022-49002.md): iommu/vt-d: Fix PCI device refcount leak in dmar\_dev\_scope\_init() (no CVSS, Linux)
- [CVE-2022-49001](https://cve.now/CVE-2022-49001.md): riscv: fix race when vmap stack overflow (CVSS 7.0, Linux)
- [CVE-2022-49000](https://cve.now/CVE-2022-49000.md): iommu/vt-d: Fix PCI device refcount leak in has\_external\_pci() (no CVSS, Linux)
- [CVE-2022-48999](https://cve.now/CVE-2022-48999.md): ipv4: Handle attempt to delete multipath route when fib\_info contains an nh reference (CVSS 7.1, Linux)
- [CVE-2022-48998](https://cve.now/CVE-2022-48998.md): powerpc/bpf/32: Fix Oops on tail call tests (CVSS 7.8, Linux)
- [CVE-2022-48997](https://cve.now/CVE-2022-48997.md): char: tpm: Protect tpm\_pm\_suspend with locks (no CVSS, Linux)
- [CVE-2022-48996](https://cve.now/CVE-2022-48996.md): mm/damon/sysfs: fix wrong empty schemes assumption under online tuning in damon\_sysfs\_set\_schemes() (no CVSS, Linux)
- [CVE-2022-48995](https://cve.now/CVE-2022-48995.md): Input: raydium\_ts\_i2c - fix memory leak in raydium\_i2c\_send() (no CVSS, Linux)
- [CVE-2022-48994](https://cve.now/CVE-2022-48994.md): ALSA: seq: Fix function prototype mismatch in snd\_seq\_expand\_var\_event (no CVSS, Linux)
- [CVE-2022-48992](https://cve.now/CVE-2022-48992.md): ASoC: soc-pcm: Add NULL check in BE reparenting (no CVSS, Linux)
- [CVE-2022-48991](https://cve.now/CVE-2022-48991.md): mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths (CVSS 8.8, Linux)
- [CVE-2022-48990](https://cve.now/CVE-2022-48990.md): drm/amdgpu: fix use-after-free during gpu recovery (CVSS 7.8, Linux)
- [CVE-2022-48989](https://cve.now/CVE-2022-48989.md): fscache: Fix oops due to race with cookie\_lru and use\_cookie (CVSS 7.8, Linux)
- [CVE-2022-48988](https://cve.now/CVE-2022-48988.md): memcg: fix possible use-after-free in memcg\_write\_event\_control() (CVSS 7.8, Linux)
- [CVE-2022-48987](https://cve.now/CVE-2022-48987.md): media: v4l2-dv-timings.c: fix too strict blanking sanity checks (no CVSS, Linux)
- [CVE-2022-48986](https://cve.now/CVE-2022-48986.md): mm/gup: fix gup\_pud\_range() for dax (CVSS 7.8, Linux)
- [CVE-2022-48985](https://cve.now/CVE-2022-48985.md): net: mana: Fix race on per-CQ variable napi work\_done (CVSS 9.8, Linux)
- [CVE-2022-48984](https://cve.now/CVE-2022-48984.md): can: slcan: fix freed work crash (no CVSS, Linux)
- [CVE-2022-48983](https://cve.now/CVE-2022-48983.md): io\_uring: Fix a null-ptr-deref in io\_tctx\_exit\_cb() (no CVSS, Linux)
- [CVE-2022-48982](https://cve.now/CVE-2022-48982.md): Bluetooth: Fix crash when replugging CSR fake controllers (no CVSS, Linux)
- [CVE-2022-48981](https://cve.now/CVE-2022-48981.md): drm/shmem-helper: Remove errant put in error path (CVSS 7.8, Linux)
- [CVE-2022-48980](https://cve.now/CVE-2022-48980.md): net: dsa: sja1105: avoid out of bounds access in sja1105\_init\_l2\_policing() (no CVSS, Linux)
- [CVE-2022-48979](https://cve.now/CVE-2022-48979.md): drm/amd/display: fix array index out of bound error in DCN32 DML (CVSS 7.8, Linux)
- [CVE-2022-48978](https://cve.now/CVE-2022-48978.md): HID: core: fix shift-out-of-bounds in hid\_report\_raw\_event (no CVSS, Linux)
- [CVE-2022-48977](https://cve.now/CVE-2022-48977.md): can: af\_can: fix NULL pointer dereference in can\_rcv\_filter (no CVSS, Linux)
- [CVE-2022-48976](https://cve.now/CVE-2022-48976.md): netfilter: flowtable\_offload: fix using \_\_this\_cpu\_add in preemptible (no CVSS, Linux)
- [CVE-2022-48975](https://cve.now/CVE-2022-48975.md): gpiolib: fix memory leak in gpiochip\_setup\_dev() (no CVSS, Linux)
- [CVE-2022-48974](https://cve.now/CVE-2022-48974.md): netfilter: conntrack: fix using \_\_this\_cpu\_add in preemptible (no CVSS, Linux)
- [CVE-2022-48973](https://cve.now/CVE-2022-48973.md): gpio: amd8111: Fix PCI device reference count leak (no CVSS, Linux)
- [CVE-2022-48972](https://cve.now/CVE-2022-48972.md): mac802154: fix missing INIT\_LIST\_HEAD in ieee802154\_if\_add() (no CVSS, Linux)
- [CVE-2022-48971](https://cve.now/CVE-2022-48971.md): Bluetooth: Fix not cleanup led when bt\_init fails (no CVSS, Linux)
- [CVE-2022-48970](https://cve.now/CVE-2022-48970.md): af\_unix: Get user\_ns from in\_skb in unix\_diag\_get\_exact(). (no CVSS, Linux)
- [CVE-2022-48969](https://cve.now/CVE-2022-48969.md): xen-netfront: Fix NULL sring after live migration (no CVSS, Linux)
- [CVE-2022-48968](https://cve.now/CVE-2022-48968.md): octeontx2-pf: Fix potential memory leak in otx2\_init\_tc() (no CVSS, Linux)
- [CVE-2022-48967](https://cve.now/CVE-2022-48967.md): NFC: nci: Bounds check struct nfc\_target arrays (CVSS 8.8, Linux)
- [CVE-2022-48966](https://cve.now/CVE-2022-48966.md): net: mvneta: Prevent out of bounds read in mvneta\_config\_rss() (no CVSS, Linux)
- [CVE-2022-48965](https://cve.now/CVE-2022-48965.md): gpio/rockchip: fix refcount leak in rockchip\_gpiolib\_register() (no CVSS, Linux)
- [CVE-2022-48964](https://cve.now/CVE-2022-48964.md): ravb: Fix potential use-after-free in ravb\_rx\_gbeth() (CVSS 8.8, Linux)
- [CVE-2022-48963](https://cve.now/CVE-2022-48963.md): net: wwan: iosm: fix memory leak in ipc\_mux\_init() (no CVSS, Linux)
- [CVE-2022-48962](https://cve.now/CVE-2022-48962.md): net: hisilicon: Fix potential use-after-free in hisi\_femac\_rx() (CVSS 8.8, Linux)
- [CVE-2022-48961](https://cve.now/CVE-2022-48961.md): net: mdio: fix unbalanced fwnode reference count in mdio\_device\_release() (no CVSS, Linux)
- [CVE-2022-48960](https://cve.now/CVE-2022-48960.md): net: hisilicon: Fix potential use-after-free in hix5hd2\_rx() (CVSS 8.8, Linux)
- [CVE-2022-48959](https://cve.now/CVE-2022-48959.md): net: dsa: sja1105: fix memory leak in sja1105\_setup\_devlink\_regions() (no CVSS, Linux)
- [CVE-2022-48958](https://cve.now/CVE-2022-48958.md): ethernet: aeroflex: fix potential skb leak in greth\_init\_rings() (no CVSS, Linux)
- [CVE-2022-48957](https://cve.now/CVE-2022-48957.md): dpaa2-switch: Fix memory leak in dpaa2\_switch\_acl\_entry\_add() and dpaa2\_switch\_acl\_entry\_remove() (no CVSS, Linux)
- [CVE-2022-48956](https://cve.now/CVE-2022-48956.md): ipv6: avoid use-after-free in ip6\_fragment() (CVSS 7.8, Linux)
- [CVE-2022-48955](https://cve.now/CVE-2022-48955.md): net: thunderbolt: fix memory leak in tbnet\_open() (no CVSS, Linux)
- [CVE-2022-48954](https://cve.now/CVE-2022-48954.md): s390/qeth: fix use-after-free in hsci (CVSS 8.8, Linux)
- [CVE-2022-48953](https://cve.now/CVE-2022-48953.md): rtc: cmos: Fix event handler registration ordering issue (no CVSS, Linux)
- [CVE-2022-48952](https://cve.now/CVE-2022-48952.md): PCI: mt7621: Add sentinel to quirks table (no CVSS, Linux)
- [CVE-2022-48951](https://cve.now/CVE-2022-48951.md): ASoC: ops: Check bounds for second channel in snd\_soc\_put\_volsw\_sx() (no CVSS, Linux)
- [CVE-2022-48950](https://cve.now/CVE-2022-48950.md): perf: Fix perf\_pending\_task() UaF (CVSS 7.8, Linux)
- [CVE-2022-48949](https://cve.now/CVE-2022-48949.md): igb: Initialize mailbox message for VF reset (no CVSS, Linux)
- [CVE-2022-48948](https://cve.now/CVE-2022-48948.md): usb: gadget: uvc: Prevent buffer overflow in setup handler (no CVSS, Linux)
- [CVE-2022-48947](https://cve.now/CVE-2022-48947.md): Bluetooth: L2CAP: Fix u8 overflow (no CVSS, Linux)
- [CVE-2022-48946](https://cve.now/CVE-2022-48946.md): udf: Fix preallocation discarding at indirect extent boundary (no CVSS, Linux)
- [CVE-2024-50065](https://cve.now/CVE-2024-50065.md): ntfs3: Change to non-blocking allocation in ntfs\_d\_hash (no CVSS, Linux)
- [CVE-2024-50064](https://cve.now/CVE-2024-50064.md): zram: free secondary algorithms names (no CVSS, Linux)
- [CVE-2024-50063](https://cve.now/CVE-2024-50063.md): bpf: Prevent tail call between progs attached to different hooks (CVSS 7.8, Linux)
- [CVE-2024-50062](https://cve.now/CVE-2024-50062.md): RDMA/rtrs-srv: Avoid null pointer deref during path establishment (CVSS 7.5, Linux)
- [CVE-2024-50061](https://cve.now/CVE-2024-50061.md): i3c: master: cdns: Fix use after free vulnerability in cdns\_i3c\_master Driver Due to Race Condition (no CVSS, Linux)
- [CVE-2024-50060](https://cve.now/CVE-2024-50060.md): io\_uring: check if we need to reschedule during overflow flush (no CVSS, Linux)
- [CVE-2024-50059](https://cve.now/CVE-2024-50059.md): ntb: ntb\_hw\_switchtec: Fix use after free vulnerability in switchtec\_ntb\_remove due to race condition (CVSS 7.8, Linux)
- [CVE-2024-50058](https://cve.now/CVE-2024-50058.md): serial: protect uart\_port\_dtr\_rts() in uart\_shutdown() too (no CVSS, Linux)
- [CVE-2024-50057](https://cve.now/CVE-2024-50057.md): usb: typec: tipd: Free IRQ only if it was requested before (no CVSS, Linux)
- [CVE-2024-50056](https://cve.now/CVE-2024-50056.md): usb: gadget: uvc: Fix ERR\_PTR dereference in uvc\_v4l2.c (no CVSS, Linux)
- [CVE-2024-50055](https://cve.now/CVE-2024-50055.md): driver core: bus: Fix double free in driver API bus\_register() (CVSS 7.8, Linux)
- [CVE-2024-50049](https://cve.now/CVE-2024-50049.md): drm/amd/display: Check null pointer before dereferencing se (no CVSS, Linux)
- [CVE-2024-50048](https://cve.now/CVE-2024-50048.md): fbcon: Fix a NULL pointer dereference issue in fbcon\_putcs (no CVSS, Linux)
- [CVE-2024-50047](https://cve.now/CVE-2024-50047.md): smb: client: fix UAF in async decryption (CVSS 9.8, Linux)
- [CVE-2024-50046](https://cve.now/CVE-2024-50046.md): NFSv4: Prevent NULL-pointer dereference in nfs42\_complete\_copies() (CVSS 9.8, Linux)
- [CVE-2024-50045](https://cve.now/CVE-2024-50045.md): netfilter: br\_netfilter: fix panic with metadata\_dst skb (CVSS 7.5, Linux)
- [CVE-2024-50044](https://cve.now/CVE-2024-50044.md): Bluetooth: RFCOMM: FIX possible deadlock in rfcomm\_sk\_state\_change (no CVSS, Linux)
- [CVE-2024-50043](https://cve.now/CVE-2024-50043.md): nfsd: fix possible badness in FREE\_STATEID (CVSS 9.8, Linux)
- [CVE-2024-50042](https://cve.now/CVE-2024-50042.md): ice: Fix increasing MSI-X on VF (no CVSS, Linux)
- [CVE-2024-50041](https://cve.now/CVE-2024-50041.md): i40e: Fix macvlan leak by synchronizing access to mac\_filter\_hash (CVSS 8.8, Linux)
- [CVE-2024-50040](https://cve.now/CVE-2024-50040.md): igb: Do not bring the device up after non-fatal error (no CVSS, Linux)
- [CVE-2024-50039](https://cve.now/CVE-2024-50039.md): net/sched: accept TCA\_STAB only for root qdisc (CVSS 7.8, Linux)
- [CVE-2024-50038](https://cve.now/CVE-2024-50038.md): netfilter: xtables: avoid NFPROTO\_UNSPEC where needed (no CVSS, Linux)
- [CVE-2024-50037](https://cve.now/CVE-2024-50037.md): drm/fbdev-dma: Only cleanup deferred I/O if necessary (no CVSS, Linux)
- [CVE-2024-50036](https://cve.now/CVE-2024-50036.md): net: do not delay dst\_entries\_add() in dst\_release() (CVSS 7.8, Linux)
- [CVE-2024-50035](https://cve.now/CVE-2024-50035.md): ppp: fix ppp\_async\_encode() illegal access (no CVSS, Linux)
- [CVE-2024-50034](https://cve.now/CVE-2024-50034.md): net/smc: fix lacks of icsk\_syn\_mss with IPPROTO\_SMC (no CVSS, Linux)
- [CVE-2024-50033](https://cve.now/CVE-2024-50033.md): slip: make slhc\_remember() more robust against malicious packets (CVSS 9.8, Linux)
- [CVE-2024-50031](https://cve.now/CVE-2024-50031.md): drm/v3d: Stop the active perfmon before being destroyed (CVSS 7.8, Linux)
- [CVE-2024-50030](https://cve.now/CVE-2024-50030.md): drm/xe/ct: prevent UAF in send\_recv() (CVSS 7.8, Linux)
- [CVE-2024-50029](https://cve.now/CVE-2024-50029.md): Bluetooth: hci\_conn: Fix UAF in hci\_enhanced\_setup\_sync (CVSS 8.8, Linux)
- [CVE-2024-50028](https://cve.now/CVE-2024-50028.md): thermal: core: Reference count the zone in thermal\_zone\_get\_by\_id() (CVSS 7.8, Linux)
- [CVE-2024-50027](https://cve.now/CVE-2024-50027.md): thermal: core: Free tzp copy along with the thermal zone (CVSS 7.8, Linux)
- [CVE-2024-50026](https://cve.now/CVE-2024-50026.md): scsi: wd33c93: Don't use stale scsi\_pointer value (no CVSS, Linux)
- [CVE-2024-50025](https://cve.now/CVE-2024-50025.md): scsi: fnic: Move flush\_work initialization out of if block (no CVSS, Linux)
- [CVE-2024-50024](https://cve.now/CVE-2024-50024.md): net: Fix an unsafe loop on the list (CVSS 7.3, Linux)
- [CVE-2024-50023](https://cve.now/CVE-2024-50023.md): net: phy: Remove LED entry from LEDs list on unregister (no CVSS, Linux)
- [CVE-2024-50022](https://cve.now/CVE-2024-50022.md): device-dax: correct pgoff align in dax\_set\_mapping() (no CVSS, Linux)
- [CVE-2024-50021](https://cve.now/CVE-2024-50021.md): ice: Fix improper handling of refcount in ice\_dpll\_init\_rclk\_pins() (no CVSS, Linux)
- [CVE-2024-50020](https://cve.now/CVE-2024-50020.md): ice: Fix improper handling of refcount in ice\_sriov\_set\_msix\_vec\_count() (no CVSS, Linux)
- [CVE-2024-50019](https://cve.now/CVE-2024-50019.md): kthread: unpark only parked kthread (no CVSS, Linux)
- [CVE-2024-47825](https://cve.now/CVE-2024-47825.md): CIDR deny policies may not take effect when a more narrow CIDR allow is present (CVSS 4.0, cilium · github.com/cilium/cilium)
- [CVE-2024-50017](https://cve.now/CVE-2024-50017.md): x86/mm/ident\_map: Use gbpages only where full GB page should be mapped. (no CVSS, Linux)
- [CVE-2024-50015](https://cve.now/CVE-2024-50015.md): ext4: dax: fix overflowing extents beyond inode size when partially writing (no CVSS, Linux)
- [CVE-2024-50014](https://cve.now/CVE-2024-50014.md): ext4: fix access to uninitialised lock in fc replay path (no CVSS, Linux)
- [CVE-2024-50013](https://cve.now/CVE-2024-50013.md): exfat: fix memory leak in exfat\_load\_bitmap() (no CVSS, Linux)
- [CVE-2024-50012](https://cve.now/CVE-2024-50012.md): cpufreq: Avoid a bad reference count on CPU node (no CVSS, Linux)
- [CVE-2024-50011](https://cve.now/CVE-2024-50011.md): ASoC: Intel: soc-acpi-intel-rpl-match: add missing empty item (no CVSS, Linux)
- [CVE-2024-50010](https://cve.now/CVE-2024-50010.md): exec: don't WARN for racy path\_noexec check (no CVSS, Linux)
- [CVE-2024-50009](https://cve.now/CVE-2024-50009.md): cpufreq: amd-pstate: add check for cpufreq\_cpu\_get's return value (no CVSS, Linux)
- [CVE-2024-50008](https://cve.now/CVE-2024-50008.md): wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex\_cmd\_802\_11\_scan\_ext() (no CVSS, Linux)
- [CVE-2024-50007](https://cve.now/CVE-2024-50007.md): ALSA: asihpi: Fix potential OOB array access (no CVSS, Linux)
- [CVE-2024-50006](https://cve.now/CVE-2024-50006.md): ext4: fix i\_data\_sem unlock order in ext4\_ind\_migrate() (no CVSS, Linux)
- [CVE-2024-50005](https://cve.now/CVE-2024-50005.md): mac802154: Fix potential RCU dereference issue in mac802154\_scan\_worker (no CVSS, Linux)
- [CVE-2024-50004](https://cve.now/CVE-2024-50004.md): drm/amd/display: update DML2 policy EnhancedPrefetchScheduleAccelerationFinal DCN35 (no CVSS, Linux)
- [CVE-2024-50003](https://cve.now/CVE-2024-50003.md): drm/amd/display: Fix system hang while resume with TBT monitor (no CVSS, Linux)
- [CVE-2024-50002](https://cve.now/CVE-2024-50002.md): static\_call: Handle module init failure correctly in static\_call\_del\_module() (no CVSS, Linux)
- [CVE-2024-50001](https://cve.now/CVE-2024-50001.md): net/mlx5: Fix error path in multi-packet WQE transmit (CVSS 7.8, Linux)
- [CVE-2024-50000](https://cve.now/CVE-2024-50000.md): net/mlx5e: Fix NULL deref in mlx5e\_tir\_builder\_alloc() (no CVSS, Linux)
- [CVE-2024-49999](https://cve.now/CVE-2024-49999.md): afs: Fix the setting of the server responding flag (CVSS 7.5, Linux)
- [CVE-2024-49998](https://cve.now/CVE-2024-49998.md): net: dsa: improve shutdown sequence (no CVSS, Linux)
- [CVE-2024-49997](https://cve.now/CVE-2024-49997.md): net: ethernet: lantiq\_etop: fix memory disclosure (no CVSS, Linux)
- [CVE-2024-49996](https://cve.now/CVE-2024-49996.md): cifs: Fix buffer overflow when parsing NFS reparse points (CVSS 9.4, Linux)
- [CVE-2024-49994](https://cve.now/CVE-2024-49994.md): block: fix integer overflow in BLKSECDISCARD (no CVSS, Linux)
- [CVE-2024-49992](https://cve.now/CVE-2024-49992.md): drm/stm: Avoid use-after-free issues with crtc and plane (CVSS 7.8, Linux)
- [CVE-2024-49991](https://cve.now/CVE-2024-49991.md): drm/amdkfd: amdkfd\_free\_gtt\_mem clear the correct pointer (CVSS 7.8, Linux)
- [CVE-2024-49990](https://cve.now/CVE-2024-49990.md): drm/xe/hdcp: Check GSC structure validity (no CVSS, Linux)
- [CVE-2024-49989](https://cve.now/CVE-2024-49989.md): drm/amd/display: fix double free issue during amdgpu module unload (no CVSS, Linux)
- [CVE-2024-49988](https://cve.now/CVE-2024-49988.md): ksmbd: add refcnt to ksmbd\_conn struct (CVSS 8.8, Linux)
- [CVE-2024-49987](https://cve.now/CVE-2024-49987.md): bpftool: Fix undefined behavior in qsort(NULL, 0, ...) (no CVSS, Linux)
- [CVE-2024-49986](https://cve.now/CVE-2024-49986.md): platform/x86: x86-android-tablets: Fix use after free on platform\_device\_register() errors (CVSS 7.8, Linux)
- [CVE-2024-49985](https://cve.now/CVE-2024-49985.md): i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume (no CVSS, Linux)
- [CVE-2024-49984](https://cve.now/CVE-2024-49984.md): drm/v3d: Prevent out of bounds access in performance query extensions (CVSS 7.8, Linux)
- [CVE-2024-49983](https://cve.now/CVE-2024-49983.md): ext4: drop ppath from ext4\_ext\_replay\_update\_ex() to avoid double-free (CVSS 7.8, Linux)
- [CVE-2024-49982](https://cve.now/CVE-2024-49982.md): aoe: fix the potential use-after-free problem in more places (CVSS 8.8, Linux)
- [CVE-2024-49981](https://cve.now/CVE-2024-49981.md): media: venus: fix use after free bug in venus\_remove due to race condition (CVSS 7.8, Linux)
- [CVE-2024-49980](https://cve.now/CVE-2024-49980.md): vrf: revert "vrf: Remove unnecessary RCU-bh critical section" (no CVSS, Linux)
- [CVE-2024-49979](https://cve.now/CVE-2024-49979.md): net: gso: fix tcp fraglist segmentation after pull from frag\_list (CVSS 7.5, Linux)
- [CVE-2024-49978](https://cve.now/CVE-2024-49978.md): gso: fix udp gso fraglist segmentation after pull from frag\_list (CVSS 7.5, Linux)
- [CVE-2024-49977](https://cve.now/CVE-2024-49977.md): net: stmmac: Fix zero-division error when disabling tc cbs (no CVSS, Linux)
- [CVE-2024-49976](https://cve.now/CVE-2024-49976.md): tracing/timerlat: Drop interface\_lock in stop\_kthread() (no CVSS, Linux)
- [CVE-2024-49975](https://cve.now/CVE-2024-49975.md): uprobes: fix kernel info leak via "\[uprobes\]" vma (no CVSS, Linux)
- [CVE-2024-49974](https://cve.now/CVE-2024-49974.md): NFSD: Limit the number of concurrent async COPY operations (no CVSS, Linux)
- [CVE-2024-49973](https://cve.now/CVE-2024-49973.md): r8169: add tally counter fields added with RTL8125 (CVSS 7.8, Linux)
- [CVE-2024-49972](https://cve.now/CVE-2024-49972.md): drm/amd/display: Deallocate DML memory if allocation fails (no CVSS, Linux)
- [CVE-2024-49971](https://cve.now/CVE-2024-49971.md): drm/amd/display: Increase array size of dummy\_boolean (no CVSS, Linux)
- [CVE-2024-49970](https://cve.now/CVE-2024-49970.md): drm/amd/display: Implement bounds check for stream encoder creation in DCN401 (no CVSS, Linux)
- [CVE-2024-49969](https://cve.now/CVE-2024-49969.md): drm/amd/display: Fix index out of bounds in DCN30 color transformation (CVSS 7.8, Linux)
- [CVE-2024-49968](https://cve.now/CVE-2024-49968.md): ext4: filesystems without casefold feature cannot be mounted with siphash (no CVSS, Linux)
- [CVE-2024-49966](https://cve.now/CVE-2024-49966.md): ocfs2: cancel dqi\_sync\_work before freeing oinfo (CVSS 7.8, Linux)
- [CVE-2024-49965](https://cve.now/CVE-2024-49965.md): ocfs2: remove unreasonable unlock in ocfs2\_read\_blocks (CVSS 7.8, Linux)
- [CVE-2024-49964](https://cve.now/CVE-2024-49964.md): mm/hugetlb: fix memfd\_pin\_folios free\_huge\_pages leak (no CVSS, Linux)
- [CVE-2024-49963](https://cve.now/CVE-2024-49963.md): mailbox: bcm2835: Fix timeout during suspend mode (no CVSS, Linux)
- [CVE-2024-49962](https://cve.now/CVE-2024-49962.md): ACPICA: check null return of ACPI\_ALLOCATE\_ZEROED() in acpi\_db\_convert\_to\_package() (no CVSS, Linux)
- [CVE-2024-49961](https://cve.now/CVE-2024-49961.md): media: i2c: ar0521: Use cansleep version of gpiod\_set\_value() (no CVSS, Linux)
- [CVE-2024-49960](https://cve.now/CVE-2024-49960.md): ext4: fix timer use-after-free on failed mount (CVSS 7.8, Linux)
- [CVE-2024-49959](https://cve.now/CVE-2024-49959.md): jbd2: stop waiting for space when jbd2\_cleanup\_journal\_tail() returns error (no CVSS, Linux)
- [CVE-2024-49958](https://cve.now/CVE-2024-49958.md): ocfs2: reserve space for inline xattr before attaching reflink tree (CVSS 7.8, Linux)
- [CVE-2024-49957](https://cve.now/CVE-2024-49957.md): ocfs2: fix null-ptr-deref when journal load failed. (no CVSS, Linux)
- [CVE-2024-49956](https://cve.now/CVE-2024-49956.md): gfs2: fix double destroy\_workqueue error (CVSS 7.8, Linux)
- [CVE-2024-49955](https://cve.now/CVE-2024-49955.md): ACPI: battery: Fix possible crash when unregistering a battery hook (no CVSS, Linux)
- [CVE-2024-49954](https://cve.now/CVE-2024-49954.md): static\_call: Replace pointless WARN\_ON() in static\_call\_module\_notify() (no CVSS, Linux)
- [CVE-2024-49953](https://cve.now/CVE-2024-49953.md): net/mlx5e: Fix crash caused by calling \_\_xfrm\_state\_delete() twice (no CVSS, Linux)
- [CVE-2024-49952](https://cve.now/CVE-2024-49952.md): netfilter: nf\_tables: prevent nf\_skb\_duplicated corruption (CVSS 7.8, Linux)
- [CVE-2024-49951](https://cve.now/CVE-2024-49951.md): Bluetooth: MGMT: Fix possible crash on mgmt\_index\_removed (CVSS 7.8, Linux)
- [CVE-2024-49950](https://cve.now/CVE-2024-49950.md): Bluetooth: L2CAP: Fix uaf in l2cap\_connect (CVSS 8.8, Linux)
- [CVE-2024-49949](https://cve.now/CVE-2024-49949.md): net: avoid potential underflow in qdisc\_pkt\_len\_init() with UFO (no CVSS, Linux)
- [CVE-2024-49948](https://cve.now/CVE-2024-49948.md): net: add more sanity checks to qdisc\_pkt\_len\_init() (no CVSS, Linux)
- [CVE-2024-49947](https://cve.now/CVE-2024-49947.md): net: test for not too small csum\_start in virtio\_net\_hdr\_to\_skb() (no CVSS, Linux)
- [CVE-2024-49946](https://cve.now/CVE-2024-49946.md): ppp: do not assume bh is held in ppp\_channel\_bridge\_input() (no CVSS, Linux)
- [CVE-2024-49945](https://cve.now/CVE-2024-49945.md): net/ncsi: Disable the ncsi work before freeing the associated structure (no CVSS, Linux)
- [CVE-2024-49944](https://cve.now/CVE-2024-49944.md): sctp: set sk\_state back to CLOSED if autobind fails in sctp\_listen\_start (no CVSS, Linux)
- [CVE-2024-49943](https://cve.now/CVE-2024-49943.md): drm/xe/guc\_submit: add missing locking in wedged\_fini (CVSS 7.8, Linux)
- [CVE-2024-49942](https://cve.now/CVE-2024-49942.md): drm/xe: Prevent null pointer access in xe\_migrate\_copy (no CVSS, Linux)
- [CVE-2024-49941](https://cve.now/CVE-2024-49941.md): gpiolib: Fix potential NULL pointer dereference in gpiod\_get\_label() (no CVSS, Linux)
- [CVE-2024-49940](https://cve.now/CVE-2024-49940.md): l2tp: prevent possible tunnel refcount underflow (CVSS 7.8, Linux)
- [CVE-2024-49939](https://cve.now/CVE-2024-49939.md): wifi: rtw89: avoid to add interface to list twice when SER (CVSS 8.8, Linux)
- [CVE-2024-49938](https://cve.now/CVE-2024-49938.md): wifi: ath9k\_htc: Use \_\_skb\_set\_length() for resetting urb before resubmit (no CVSS, Linux)
- [CVE-2024-49937](https://cve.now/CVE-2024-49937.md): wifi: cfg80211: Set correct chandef when starting CAC (no CVSS, Linux)
- [CVE-2024-49936](https://cve.now/CVE-2024-49936.md): net/xen-netback: prevent UAF in xenvif\_flush\_hash() (CVSS 8.8, Linux)
- [CVE-2024-49935](https://cve.now/CVE-2024-49935.md): ACPI: PAD: fix crash in exit\_round\_robin() (no CVSS, Linux)
- [CVE-2024-49934](https://cve.now/CVE-2024-49934.md): fs/inode: Prevent dump\_mapping() accessing invalid dentry.d\_name.name (CVSS 7.1, Linux)
- [CVE-2024-49933](https://cve.now/CVE-2024-49933.md): blk\_iocost: fix more out of bound shifts (no CVSS, Linux)
- [CVE-2024-49932](https://cve.now/CVE-2024-49932.md): btrfs: don't readahead the relocation inode on RST (CVSS 7.0, Linux)
- [CVE-2024-49931](https://cve.now/CVE-2024-49931.md): wifi: ath12k: fix array out-of-bound access in SoC stats (no CVSS, Linux)
- [CVE-2024-49930](https://cve.now/CVE-2024-49930.md): wifi: ath11k: fix array out-of-bound access in SoC stats (CVSS 8.8, Linux)
- [CVE-2024-49929](https://cve.now/CVE-2024-49929.md): wifi: iwlwifi: mvm: avoid NULL pointer dereference (no CVSS, Linux)
- [CVE-2024-49928](https://cve.now/CVE-2024-49928.md): wifi: rtw89: avoid reading out of bounds when loading TX power FW elements (no CVSS, Linux)
- [CVE-2024-49927](https://cve.now/CVE-2024-49927.md): x86/ioapic: Handle allocation failures gracefully (no CVSS, Linux)
- [CVE-2024-49926](https://cve.now/CVE-2024-49926.md): rcu-tasks: Fix access non-existent percpu rtpcp variable in rcu\_tasks\_need\_gpcb() (no CVSS, Linux)
- [CVE-2024-49925](https://cve.now/CVE-2024-49925.md): fbdev: efifb: Register sysfs groups through driver core (CVSS 7.1, Linux)
- [CVE-2024-49924](https://cve.now/CVE-2024-49924.md): fbdev: pxafb: Fix possible use after free in pxafb\_task() (CVSS 7.8, Linux)
- [CVE-2024-49923](https://cve.now/CVE-2024-49923.md): drm/amd/display: Pass non-null to dcn20\_validate\_apply\_pipe\_split\_flags (no CVSS, Linux)
- [CVE-2024-49922](https://cve.now/CVE-2024-49922.md): drm/amd/display: Check null pointers before using them (no CVSS, Linux)
- [CVE-2024-49921](https://cve.now/CVE-2024-49921.md): drm/amd/display: Check null pointers before used (no CVSS, Linux)
- [CVE-2024-49920](https://cve.now/CVE-2024-49920.md): drm/amd/display: Check null pointers before multiple uses (no CVSS, Linux)
- [CVE-2024-49919](https://cve.now/CVE-2024-49919.md): drm/amd/display: Add null check for head\_pipe in dcn201\_acquire\_free\_pipe\_for\_layer (no CVSS, Linux)
- [CVE-2024-49918](https://cve.now/CVE-2024-49918.md): drm/amd/display: Add null check for head\_pipe in dcn32\_acquire\_idle\_pipe\_for\_head\_pipe\_in\_layer (no CVSS, Linux)
- [CVE-2024-49917](https://cve.now/CVE-2024-49917.md): drm/amd/display: Add NULL check for clk\_mgr and clk\_mgr-\>funcs in dcn30\_init\_hw (no CVSS, Linux)
- [CVE-2024-49916](https://cve.now/CVE-2024-49916.md): drm/amd/display: Add NULL check for clk\_mgr and clk\_mgr-\>funcs in dcn401\_init\_hw (no CVSS, Linux)
- [CVE-2024-49915](https://cve.now/CVE-2024-49915.md): drm/amd/display: Add NULL check for clk\_mgr in dcn32\_init\_hw (no CVSS, Linux)
- [CVE-2024-49914](https://cve.now/CVE-2024-49914.md): drm/amd/display: Add null check for pipe\_ctx-\>plane\_state in dcn20\_program\_pipe (no CVSS, Linux)
- [CVE-2024-49913](https://cve.now/CVE-2024-49913.md): drm/amd/display: Add null check for top\_pipe\_to\_program in commit\_planes\_for\_stream (no CVSS, Linux)
- [CVE-2024-49912](https://cve.now/CVE-2024-49912.md): drm/amd/display: Handle null 'stream\_status' in 'planes\_changed\_for\_existing\_stream' (no CVSS, Linux)
- [CVE-2024-49911](https://cve.now/CVE-2024-49911.md): drm/amd/display: Add NULL check for function pointer in dcn20\_set\_output\_transfer\_func (no CVSS, Linux)
- [CVE-2024-49910](https://cve.now/CVE-2024-49910.md): drm/amd/display: Add NULL check for function pointer in dcn401\_set\_output\_transfer\_func (no CVSS, Linux)
- [CVE-2024-49909](https://cve.now/CVE-2024-49909.md): drm/amd/display: Add NULL check for function pointer in dcn32\_set\_output\_transfer\_func (no CVSS, Linux)
- [CVE-2024-49908](https://cve.now/CVE-2024-49908.md): drm/amd/display: Add null check for 'afb' in amdgpu\_dm\_update\_cursor (v2) (no CVSS, Linux)
- [CVE-2024-49907](https://cve.now/CVE-2024-49907.md): drm/amd/display: Check null pointers before using dc-\>clk\_mgr (no CVSS, Linux)
- [CVE-2024-49906](https://cve.now/CVE-2024-49906.md): drm/amd/display: Check null pointer before try to access it (no CVSS, Linux)
- [CVE-2024-49905](https://cve.now/CVE-2024-49905.md): drm/amd/display: Add null check for 'afb' in amdgpu\_dm\_plane\_handle\_cursor\_update (v2) (no CVSS, Linux)
- [CVE-2024-49904](https://cve.now/CVE-2024-49904.md): drm/amdgpu: add list empty check to avoid null pointer issue (no CVSS, Linux)
- [CVE-2024-49903](https://cve.now/CVE-2024-49903.md): jfs: Fix uaf in dbFreeBits (no CVSS, Linux)
- [CVE-2024-49902](https://cve.now/CVE-2024-49902.md): jfs: check if leafidx greater than num leaves per dmap tree (CVSS 7.8, Linux)
- [CVE-2024-49901](https://cve.now/CVE-2024-49901.md): drm/msm/adreno: Assign msm\_gpu-\>pdev earlier to avoid nullptrs (no CVSS, Linux)
- [CVE-2024-49900](https://cve.now/CVE-2024-49900.md): jfs: Fix uninit-value access of new\_ea in ea\_buffer (no CVSS, Linux)
- [CVE-2024-49899](https://cve.now/CVE-2024-49899.md): drm/amd/display: Initialize denominators' default to 1 (no CVSS, Linux)
- [CVE-2024-49898](https://cve.now/CVE-2024-49898.md): drm/amd/display: Check null-initialized variables (no CVSS, Linux)
- [CVE-2024-49897](https://cve.now/CVE-2024-49897.md): drm/amd/display: Check phantom\_stream before it is used (no CVSS, Linux)
- [CVE-2024-49896](https://cve.now/CVE-2024-49896.md): drm/amd/display: Check stream before comparing them (no CVSS, Linux)
- [CVE-2024-49895](https://cve.now/CVE-2024-49895.md): drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation (no CVSS, Linux)
- [CVE-2024-49894](https://cve.now/CVE-2024-49894.md): drm/amd/display: Fix index out of bounds in degamma hardware format translation (CVSS 7.1, Linux)
- [CVE-2024-49893](https://cve.now/CVE-2024-49893.md): drm/amd/display: Check stream\_status before it is used (no CVSS, Linux)
- [CVE-2024-49892](https://cve.now/CVE-2024-49892.md): drm/amd/display: Initialize get\_bytes\_per\_element's default to 1 (no CVSS, Linux)
- [CVE-2024-49891](https://cve.now/CVE-2024-49891.md): scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (no CVSS, Linux)
- [CVE-2024-49890](https://cve.now/CVE-2024-49890.md): drm/amd/pm: ensure the fw\_info is not null before using it (no CVSS, Linux)
- [CVE-2024-49889](https://cve.now/CVE-2024-49889.md): ext4: avoid use-after-free in ext4\_ext\_show\_leaf() (CVSS 7.8, Linux)
- [CVE-2024-49888](https://cve.now/CVE-2024-49888.md): bpf: Fix a sdiv overflow issue (no CVSS, Linux)
- [CVE-2024-49887](https://cve.now/CVE-2024-49887.md): f2fs: fix to don't panic system for no free segment fault injection (no CVSS, Linux)
- [CVE-2024-49886](https://cve.now/CVE-2024-49886.md): platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (CVSS 7.8, Linux)
- [CVE-2024-49885](https://cve.now/CVE-2024-49885.md): mm, slub: avoid zeroing kmalloc redzone (no CVSS, Linux)
- [CVE-2024-49884](https://cve.now/CVE-2024-49884.md): ext4: fix slab-use-after-free in ext4\_split\_extent\_at() (CVSS 7.8, Linux)
- [CVE-2024-49883](https://cve.now/CVE-2024-49883.md): ext4: aovid use-after-free in ext4\_ext\_insert\_extent() (CVSS 7.8, Linux)
- [CVE-2024-49882](https://cve.now/CVE-2024-49882.md): ext4: fix double brelse() the buffer of the extents path (CVSS 7.8, Linux)
- [CVE-2024-49881](https://cve.now/CVE-2024-49881.md): ext4: update orig\_path in ext4\_find\_extent() (no CVSS, Linux)
- [CVE-2024-49880](https://cve.now/CVE-2024-49880.md): ext4: fix off by one issue in alloc\_flex\_gd() (no CVSS, Linux)
- [CVE-2024-49879](https://cve.now/CVE-2024-49879.md): drm: omapdrm: Add missing check for alloc\_ordered\_workqueue (no CVSS, Linux)
- [CVE-2024-49878](https://cve.now/CVE-2024-49878.md): resource: fix region\_intersects() vs add\_memory\_driver\_managed() (no CVSS, Linux)
- [CVE-2024-49877](https://cve.now/CVE-2024-49877.md): ocfs2: fix possible null-ptr-deref in ocfs2\_set\_buffer\_uptodate (no CVSS, Linux)
- [CVE-2024-49876](https://cve.now/CVE-2024-49876.md): drm/xe: fix UAF around queue destruction (CVSS 7.8, Linux)
- [CVE-2024-49875](https://cve.now/CVE-2024-49875.md): nfsd: map the EBADMSG to nfserr\_io to avoid warning (CVSS 7.5, Linux)
- [CVE-2024-49874](https://cve.now/CVE-2024-49874.md): i3c: master: svc: Fix use after free vulnerability in svc\_i3c\_master Driver Due to Race Condition (CVSS 7.8, Linux)
- [CVE-2024-49873](https://cve.now/CVE-2024-49873.md): mm/filemap: fix filemap\_get\_folios\_contig THP panic (no CVSS, Linux)
- [CVE-2024-49872](https://cve.now/CVE-2024-49872.md): mm/gup: fix memfd\_pin\_folios alloc race panic (no CVSS, Linux)
- [CVE-2024-49871](https://cve.now/CVE-2024-49871.md): Input: adp5589-keys - fix NULL pointer dereference (no CVSS, Linux)
- [CVE-2024-49870](https://cve.now/CVE-2024-49870.md): cachefiles: fix dentry leak in cachefiles\_open\_file() (no CVSS, Linux)
- [CVE-2024-49869](https://cve.now/CVE-2024-49869.md): btrfs: send: fix buffer overflow detection when copying path to cache entry (no CVSS, Linux)
- [CVE-2024-49868](https://cve.now/CVE-2024-49868.md): btrfs: fix a NULL pointer dereference when failed to start a new trasacntion (no CVSS, Linux)
- [CVE-2024-49867](https://cve.now/CVE-2024-49867.md): btrfs: wait for fixup workers before stopping cleaner kthread during umount (CVSS 7.8, Linux)
- [CVE-2024-49866](https://cve.now/CVE-2024-49866.md): tracing/timerlat: Fix a race during cpuhp processing (CVSS 7.8, Linux)
- [CVE-2024-49865](https://cve.now/CVE-2024-49865.md): drm/xe/vm: move xa\_alloc to prevent UAF (CVSS 7.8, Linux)
- [CVE-2024-49864](https://cve.now/CVE-2024-49864.md): rxrpc: Fix a race between socket set up and I/O thread creation (CVSS 7.5, Linux)
- [CVE-2024-49863](https://cve.now/CVE-2024-49863.md): vhost/scsi: null-ptr-dereference in vhost\_scsi\_get\_req() (no CVSS, Linux)
- [CVE-2024-49368](https://cve.now/CVE-2024-49368.md): Unchecked logrotate settings lead to arbitrary command execution (CVSS 8.9, 0xJacky nginx-ui)
- [CVE-2024-49367](https://cve.now/CVE-2024-49367.md): Nginx UI's log path can be controlled (CVSS 5.5, 0xJacky nginx-ui)
- [CVE-2024-40746](https://cve.now/CVE-2024-40746.md): Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla \< 5.1.1 (CVSS 5.4, hikashop.com HikaShop component for Joomla)
- [CVE-2024-49366](https://cve.now/CVE-2024-49366.md): Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written (CVSS 7.7, 0xJacky nginx-ui)
- [CVE-2024-48930](https://cve.now/CVE-2024-48930.md): secp256k1-node vulnerable to private key extraction over ECDH (CVSS 8.7, cryptocoinjs secp256k1-node · secp256k1)
- [CVE-2024-45309](https://cve.now/CVE-2024-45309.md): OneDev vulnerable to arbitrary file reading for unauthenticated user (CVSS 8.7, theonedev onedev)
- [CVE-2024-6519](https://cve.now/CVE-2024-6519.md): Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability (CVSS 8.2, qemu · Red Hat Enterprise Linux)
- [CVE-2024-8305](https://cve.now/CVE-2024-8305.md): MongoDB Server secondaries may crash due to forced index constraints (CVSS 6.5, MongoDB Server)
- [CVE-2024-49862](https://cve.now/CVE-2024-49862.md): powercap: intel\_rapl: Fix off by one in get\_rpi() (CVSS 7.1, Linux)
- [CVE-2024-49861](https://cve.now/CVE-2024-49861.md): bpf: Fix helper writes to read-only maps (CVSS 7.8, Linux)
- [CVE-2024-49860](https://cve.now/CVE-2024-49860.md): ACPI: sysfs: validate return type of \_STR method (CVSS 7.3, Linux)
- [CVE-2024-49859](https://cve.now/CVE-2024-49859.md): f2fs: fix to check atomic\_file in f2fs ioctl interfaces (CVSS 7.8, Linux)
- [CVE-2024-49858](https://cve.now/CVE-2024-49858.md): efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption (no CVSS, Linux)
- [CVE-2024-49857](https://cve.now/CVE-2024-49857.md): wifi: iwlwifi: mvm: set the cipher for secured NDP ranging (CVSS 7.1, Linux)
- [CVE-2024-49856](https://cve.now/CVE-2024-49856.md): x86/sgx: Fix deadlock in SGX NUMA node search (no CVSS, Linux)
- [CVE-2024-49855](https://cve.now/CVE-2024-49855.md): nbd: fix race between timeout and normal completion (CVSS 9.8, Linux)
- [CVE-2024-49854](https://cve.now/CVE-2024-49854.md): block, bfq: fix uaf for accessing waker\_bfqq after splitting (CVSS 7.8, Linux)
- [CVE-2024-49853](https://cve.now/CVE-2024-49853.md): firmware: arm\_scmi: Fix double free in OPTEE transport (no CVSS, Linux)
- [CVE-2024-49852](https://cve.now/CVE-2024-49852.md): scsi: elx: libefc: Fix potential use after free in efc\_nport\_vport\_del() (no CVSS, Linux)
- [CVE-2024-49851](https://cve.now/CVE-2024-49851.md): tpm: Clean up TPM space after command failure (no CVSS, Linux)
- [CVE-2024-49850](https://cve.now/CVE-2024-49850.md): bpf: correctly handle malformed BPF\_CORE\_TYPE\_ID\_LOCAL relos (no CVSS, Linux)
- [CVE-2024-47757](https://cve.now/CVE-2024-47757.md): nilfs2: fix potential oob read in nilfs\_btree\_check\_delete() (no CVSS, Linux)
- [CVE-2024-47756](https://cve.now/CVE-2024-47756.md): PCI: keystone: Fix if-statement expression in ks\_pcie\_quirk() (no CVSS, Linux)
- [CVE-2024-47754](https://cve.now/CVE-2024-47754.md): media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning (no CVSS, Linux)
- [CVE-2024-47753](https://cve.now/CVE-2024-47753.md): media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning (no CVSS, Linux)
- [CVE-2024-47752](https://cve.now/CVE-2024-47752.md): media: mediatek: vcodec: Fix H264 stateless decoder smatch warning (no CVSS, Linux)
- [CVE-2024-47751](https://cve.now/CVE-2024-47751.md): PCI: kirin: Fix buffer overflow in kirin\_pcie\_parse\_port() (no CVSS, Linux)
- [CVE-2024-47750](https://cve.now/CVE-2024-47750.md): RDMA/hns: Fix Use-After-Free of rsv\_qp on HIP08 (CVSS 7.8, Linux)
- [CVE-2024-47749](https://cve.now/CVE-2024-47749.md): RDMA/cxgb4: Added NULL check for lookup\_atid (CVSS 7.5, Linux)
- [CVE-2024-47748](https://cve.now/CVE-2024-47748.md): vhost\_vdpa: assign irq bypass producer token correctly (CVSS 7.8, Linux)
- [CVE-2024-47747](https://cve.now/CVE-2024-47747.md): net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition (CVSS 7.8, Linux)
- [CVE-2024-47746](https://cve.now/CVE-2024-47746.md): fuse: use exclusive lock when FUSE\_I\_CACHE\_IO\_MODE is set (no CVSS, Linux)
- [CVE-2024-47745](https://cve.now/CVE-2024-47745.md): mm: call the security\_mmap\_file() LSM hook in remap\_file\_pages() (CVSS 7.8, Linux)
- [CVE-2024-47744](https://cve.now/CVE-2024-47744.md): KVM: Use dedicated mutex to protect kvm\_usage\_count to avoid deadlock (no CVSS, Linux)
- [CVE-2024-47743](https://cve.now/CVE-2024-47743.md): KEYS: prevent NULL pointer dereference in find\_asymmetric\_key() (no CVSS, Linux)
- [CVE-2024-47742](https://cve.now/CVE-2024-47742.md): firmware\_loader: Block path traversal (CVSS 7.8, Linux)
- [CVE-2024-47741](https://cve.now/CVE-2024-47741.md): btrfs: fix race setting file private on concurrent lseek using same fd (CVSS 7.8, Linux)
- [CVE-2024-47740](https://cve.now/CVE-2024-47740.md): f2fs: Require FMODE\_WRITE for atomic write ioctls (CVSS 7.1, Linux)
- [CVE-2024-47739](https://cve.now/CVE-2024-47739.md): padata: use integer wrap around to prevent deadlock on seq\_nr overflow (CVSS 7.5, Linux)
- [CVE-2024-47738](https://cve.now/CVE-2024-47738.md): wifi: mac80211: don't use rate mask for offchannel TX either (no CVSS, Linux)
- [CVE-2024-47737](https://cve.now/CVE-2024-47737.md): nfsd: call cache\_put if xdr\_reserve\_space returns NULL (no CVSS, Linux)
- [CVE-2024-47736](https://cve.now/CVE-2024-47736.md): erofs: handle overlapped pclusters out of crafted images properly (no CVSS, Linux)
- [CVE-2024-47735](https://cve.now/CVE-2024-47735.md): RDMA/hns: Fix spin\_unlock\_irqrestore() called with IRQs enabled (no CVSS, Linux)
- [CVE-2024-47734](https://cve.now/CVE-2024-47734.md): bonding: Fix unnecessary warnings and logs from bond\_xdp\_get\_xmit\_slave() (no CVSS, Linux)
- [CVE-2024-47733](https://cve.now/CVE-2024-47733.md): netfs: Delete subtree of 'fs/netfs' when netfs module exits (no CVSS, Linux)
- [CVE-2024-47732](https://cve.now/CVE-2024-47732.md): crypto: iaa - Fix potential use after free bug (CVSS 7.0, Linux)
- [CVE-2024-47731](https://cve.now/CVE-2024-47731.md): drivers/perf: Fix ali\_drw\_pmu driver interrupt status clearing (no CVSS, Linux)
- [CVE-2024-47730](https://cve.now/CVE-2024-47730.md): crypto: hisilicon/qm - inject error before stopping queue (CVSS 7.0, Linux)
- [CVE-2024-47729](https://cve.now/CVE-2024-47729.md): drm/xe: Use reserved copy engine for user binds on faulting devices (no CVSS, Linux)
- [CVE-2024-47728](https://cve.now/CVE-2024-47728.md): bpf: Zero former ARG\_PTR\_TO\_{LONG,INT} args in case of error (no CVSS, Linux)
- [CVE-2024-47727](https://cve.now/CVE-2024-47727.md): x86/tdx: Fix "in-kernel MMIO" check (CVSS 7.8, Linux)
- [CVE-2024-47726](https://cve.now/CVE-2024-47726.md): f2fs: fix to wait dio completion (CVSS 7.8, Linux)
- [CVE-2024-47724](https://cve.now/CVE-2024-47724.md): wifi: ath11k: use work queue to process beacon tx event (CVSS 8.8, Linux)
- [CVE-2024-47723](https://cve.now/CVE-2024-47723.md): jfs: fix out-of-bounds in dbNextAG() and diAlloc() (CVSS 7.8, Linux)
- [CVE-2024-47721](https://cve.now/CVE-2024-47721.md): wifi: rtw89: remove unused C2H event ID RTW89\_MAC\_C2H\_FUNC\_READ\_WOW\_CAM to prevent out-of-bounds reading (CVSS 8.8, Linux)
- [CVE-2024-47720](https://cve.now/CVE-2024-47720.md): drm/amd/display: Add null check for set\_output\_gamma in dcn30\_set\_output\_transfer\_func (no CVSS, Linux)
- [CVE-2024-47719](https://cve.now/CVE-2024-47719.md): iommufd: Protect against overflow of ALIGN() during iova allocation (no CVSS, Linux)
- [CVE-2024-47718](https://cve.now/CVE-2024-47718.md): wifi: rtw88: always wait for both firmware loading attempts (no CVSS, Linux)
- [CVE-2024-47717](https://cve.now/CVE-2024-47717.md): RISC-V: KVM: Don't zero-out PMU snapshot area before freeing data (no CVSS, Linux)
- [CVE-2024-47716](https://cve.now/CVE-2024-47716.md): ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros (no CVSS, Linux)
- [CVE-2024-47715](https://cve.now/CVE-2024-47715.md): wifi: mt76: mt7915: fix oops on non-dbdc mt7986 (no CVSS, Linux)
- [CVE-2024-47714](https://cve.now/CVE-2024-47714.md): wifi: mt76: mt7996: use hweight16 to get correct tx antenna (CVSS 7.6, Linux)
- [CVE-2024-47713](https://cve.now/CVE-2024-47713.md): wifi: mac80211: use two-phase skb reclamation in ieee80211\_do\_stop() (no CVSS, Linux)
- [CVE-2024-47712](https://cve.now/CVE-2024-47712.md): wifi: wilc1000: fix potential RCU dereference issue in wilc\_parse\_join\_bss\_param (CVSS 8.3, Linux)
- [CVE-2024-47711](https://cve.now/CVE-2024-47711.md): af\_unix: Don't return OOB skb in manage\_oob(). (CVSS 7.8, Linux)
- [CVE-2024-47710](https://cve.now/CVE-2024-47710.md): sock\_map: Add a cond\_resched() in sock\_hash\_free() (no CVSS, Linux)
- [CVE-2024-47709](https://cve.now/CVE-2024-47709.md): can: bcm: Clear bo-\>bcm\_proc\_read after remove\_proc\_entry(). (no CVSS, Linux)
- [CVE-2024-47708](https://cve.now/CVE-2024-47708.md): netkit: Assign missing bpf\_net\_context (no CVSS, Linux)
- [CVE-2024-47707](https://cve.now/CVE-2024-47707.md): ipv6: avoid possible NULL deref in rt6\_uncached\_list\_flush\_dev() (no CVSS, Linux)
- [CVE-2024-47706](https://cve.now/CVE-2024-47706.md): block, bfq: fix possible UAF for bfqq-\>bic with merge chain (CVSS 7.8, Linux)
- [CVE-2024-47705](https://cve.now/CVE-2024-47705.md): block: fix potential invalid pointer dereference in blk\_add\_partition (no CVSS, Linux)
- [CVE-2024-47704](https://cve.now/CVE-2024-47704.md): drm/amd/display: Check link\_res-\>hpo\_dp\_link\_enc before using it (no CVSS, Linux)
- [CVE-2024-47703](https://cve.now/CVE-2024-47703.md): bpf, lsm: Add check for BPF LSM return value (CVSS 7.8, Linux)
- [CVE-2024-47702](https://cve.now/CVE-2024-47702.md): bpf: Fail verification for sign-extension of packet data/data\_end/data\_meta (CVSS 7.8, Linux)
- [CVE-2024-47701](https://cve.now/CVE-2024-47701.md): ext4: avoid OOB when system.data xattr changes underneath the filesystem (CVSS 7.8, Linux)
- [CVE-2024-47700](https://cve.now/CVE-2024-47700.md): ext4: check stripe size compatibility on remount as well (no CVSS, Linux)
- [CVE-2024-47699](https://cve.now/CVE-2024-47699.md): nilfs2: fix potential null-ptr-deref in nilfs\_btree\_insert() (no CVSS, Linux)
- [CVE-2024-47698](https://cve.now/CVE-2024-47698.md): drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (CVSS 7.8, Linux)
- [CVE-2024-47697](https://cve.now/CVE-2024-47697.md): drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (CVSS 7.8, Linux)
- [CVE-2024-47696](https://cve.now/CVE-2024-47696.md): RDMA/iwcm: Fix WARNING:at\_kernel/workqueue.c:#check\_flush\_dependency (CVSS 7.5, Linux)
- [CVE-2024-47695](https://cve.now/CVE-2024-47695.md): RDMA/rtrs-clt: Reset cid to con\_num - 1 to stay in bounds (CVSS 9.8, Linux)
- [CVE-2024-47694](https://cve.now/CVE-2024-47694.md): IB/mlx5: Fix UMR pd cleanup on error flow of driver init (no CVSS, Linux)
- [CVE-2024-47693](https://cve.now/CVE-2024-47693.md): IB/core: Fix ib\_cache\_setup\_one error flow cleanup (no CVSS, Linux)
- [CVE-2024-47692](https://cve.now/CVE-2024-47692.md): nfsd: return -EINVAL when namelen is 0 (no CVSS, Linux)
- [CVE-2024-47691](https://cve.now/CVE-2024-47691.md): f2fs: fix to avoid use-after-free in f2fs\_stop\_gc\_thread() (no CVSS, Linux)
- [CVE-2024-47690](https://cve.now/CVE-2024-47690.md): f2fs: get rid of online repaire on corrupted directory (CVSS 7.8, Linux)
- [CVE-2024-47689](https://cve.now/CVE-2024-47689.md): f2fs: fix to don't set SB\_RDONLY in f2fs\_handle\_critical\_error() (no CVSS, Linux)
- [CVE-2024-47688](https://cve.now/CVE-2024-47688.md): driver core: Fix a potential null-ptr-deref in module\_add\_driver() (no CVSS, Linux)
- [CVE-2024-47687](https://cve.now/CVE-2024-47687.md): vdpa/mlx5: Fix invalid mr resource destroy (no CVSS, Linux)
- [CVE-2024-47686](https://cve.now/CVE-2024-47686.md): ep93xx: clock: Fix off by one in ep93xx\_div\_recalc\_rate() (no CVSS, Linux)
- [CVE-2024-47685](https://cve.now/CVE-2024-47685.md): netfilter: nf\_reject\_ipv6: fix nf\_reject\_ip6\_tcphdr\_put() (no CVSS, Linux)
- [CVE-2024-47684](https://cve.now/CVE-2024-47684.md): tcp: check skb is non-NULL in tcp\_rto\_delta\_us() (no CVSS, Linux)
- [CVE-2024-47683](https://cve.now/CVE-2024-47683.md): drm/amd/display: Skip Recompute DSC Params if no Stream on Link (no CVSS, Linux)
- [CVE-2024-47682](https://cve.now/CVE-2024-47682.md): scsi: sd: Fix off-by-one error in sd\_read\_block\_characteristics() (CVSS 8.6, Linux)
- [CVE-2024-47681](https://cve.now/CVE-2024-47681.md): wifi: mt76: mt7996: fix NULL pointer dereference in mt7996\_mcu\_sta\_bfer\_he (no CVSS, Linux)
- [CVE-2024-47680](https://cve.now/CVE-2024-47680.md): f2fs: check discard support for conventional zones (no CVSS, Linux)
- [CVE-2024-47679](https://cve.now/CVE-2024-47679.md): vfs: fix race between evice\_inodes() and find\_inode()&iput() (CVSS 7.8, Linux)
- [CVE-2024-47678](https://cve.now/CVE-2024-47678.md): icmp: change the order of rate limits (CVSS 9.4, Linux)
- [CVE-2024-47677](https://cve.now/CVE-2024-47677.md): exfat: resolve memory leak from exfat\_create\_upcase\_table() (no CVSS, Linux)
- [CVE-2024-47676](https://cve.now/CVE-2024-47676.md): mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway (CVSS 7.8, Linux)
- [CVE-2024-47675](https://cve.now/CVE-2024-47675.md): bpf: Fix use-after-free in bpf\_uprobe\_multi\_link\_attach() (CVSS 7.8, Linux)
- [CVE-2024-49273](https://cve.now/CVE-2024-49273.md): WordPress ProfileGrid plugin \<= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Metagauss ProfileGrid)
- [CVE-2024-49293](https://cve.now/CVE-2024-49293.md): WordPress WP VR plugin \<= 8.5.4 - Broken Access Control vulnerability (CVSS 4.3, RexTheme WP VR)
- [CVE-2024-49321](https://cve.now/CVE-2024-49321.md): WordPress Simple Custom Post Order plugin \<= 2.5.7 - Broken Access Control vulnerability (CVSS 4.3, colorlibplugins Simple Custom Post Order)
- [CVE-2024-43945](https://cve.now/CVE-2024-43945.md): WordPress LatePoint plugin \<= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, LatePoint)
- [CVE-2024-47328](https://cve.now/CVE-2024-47328.md): WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin \<= 3.1.2 - SQL Injection vulnerability (CVSS 7.6, Aman FunnelKit Automations)
- [CVE-2024-8625](https://cve.now/CVE-2024-8625.md): TS Poll – Survey, Versus Poll, Image Poll, Video Poll \< 2.4.0 - Admin+ SQL Injection (CVSS 7.2, TS Poll)
- [CVE-2024-10202](https://cve.now/CVE-2024-10202.md): Wellchoose Administrative Management System - OS Command Injection (CVSS 8.8, Wellchoose Administrative Management System)
- [CVE-2024-10201](https://cve.now/CVE-2024-10201.md): Wellchoose Administrative Management System - Arbitrary File Upload (CVSS 8.8, Wellchoose Administrative Management System)
- [CVE-2024-10200](https://cve.now/CVE-2024-10200.md): Wellchoose Administrative Management System - Arbitrary File Read through Path Traversal (CVSS 7.5, Wellchoose Administrative Management System)
- [CVE-2024-10199](https://cve.now/CVE-2024-10199.md): code-projects Pharmacy Management System Manage Medicines Page manage\_medicine.php cross site scripting (CVSS 5.1, code-projects Pharmacy Management System)
- [CVE-2024-43689](https://cve.now/CVE-2024-43689.md): Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. (CVSS 8.8, ELECOM CO. WAB-I1750-PS · ELECOM CO. WAB-M1775-PS +3)
- [CVE-2024-10198](https://cve.now/CVE-2024-10198.md): code-projects Pharmacy Management System Manage Customer Page manage\_customer.php cross site scripting (CVSS 5.1, code-projects Pharmacy Management System)
- [CVE-2024-10197](https://cve.now/CVE-2024-10197.md): code-projects Pharmacy Management System Manage Supplier Page manage\_supplier.php cross site scripting (CVSS 5.1, code-projects Pharmacy Management System)
- [CVE-2024-10196](https://cve.now/CVE-2024-10196.md): code-projects Pharmacy Management System add\_new\_invoice.php sql injection (CVSS 5.3, code-projects Pharmacy Management System)
- [CVE-2024-30157](https://cve.now/CVE-2024-30157.md): A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with (CVSS 7.2)
- [CVE-2024-30158](https://cve.now/CVE-2024-30158.md): A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrat (CVSS 7.2)
- [CVE-2024-30159](https://cve.now/CVE-2024-30159.md): A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrat (CVSS 4.8)
- [CVE-2024-30160](https://cve.now/CVE-2024-30160.md): A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with (CVSS 4.8)
- [CVE-2024-31007](https://cve.now/CVE-2024-31007.md): Buffer Overflow vulnerability in IrfanView 32bit v.4.66 allows a local attacker to cause a denial of service via a crafted file. (CVSS 5.5)
- [CVE-2024-35285](https://cve.now/CVE-2024-35285.md): A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command inject (CVSS 9.8)
- [CVE-2024-35286](https://cve.now/CVE-2024-35286.md): A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection (CVSS 9.8)
- [CVE-2024-35287](https://cve.now/CVE-2024-35287.md): A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated at (CVSS 6.7)
- [CVE-2024-35314](https://cve.now/CVE-2024-35314.md): A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2 (CVSS 9.8)
- [CVE-2024-35315](https://cve.now/CVE-2024-35315.md): A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2 (CVSS 5.6)
- [CVE-2024-40083](https://cve.now/CVE-2024-40083.md): A Buffer Overflow vulnerabilty in the local\_app\_set\_router\_token function of Vilo 5 Mesh WiFi System \<= 5.16.1.33 allows remote, unauthentic (CVSS 9.6)
- [CVE-2024-40084](https://cve.now/CVE-2024-40084.md): A Buffer Overflow in the Boa webserver of Vilo 5 Mesh WiFi System \<= 5.16.1.33 allows remote, unauthenticated attackers to execute arbitrary (CVSS 9.6)
- [CVE-2024-40085](https://cve.now/CVE-2024-40085.md): A Buffer Overflow vulnerability in the local\_app\_set\_router\_wan function of Vilo 5 Mesh WiFi System \<= 5.16.1.33 allows remote, unauthentica (CVSS 9.6)
- [CVE-2024-40086](https://cve.now/CVE-2024-40086.md): A Buffer Overflow vulnerability in the local\_app\_set\_router\_wifi\_SSID\_PWD function of Vilo 5 Mesh WiFi System \<= 5.16.1.33 allows remote, un (CVSS 9.6)
- [CVE-2024-40087](https://cve.now/CVE-2024-40087.md): Vilo 5 Mesh WiFi System \<= 5.16.1.33 is vulnerable to Insecure Permissions. (CVSS 9.6)
- [CVE-2024-40088](https://cve.now/CVE-2024-40088.md): A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System \<= 5.16.1.33 allows remote, unauthenticated attackers to (CVSS 5.3)
- [CVE-2024-40089](https://cve.now/CVE-2024-40089.md): A Command Injection vulnerability in Vilo 5 Mesh WiFi System \<= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code b (CVSS 9.1)
- [CVE-2024-40090](https://cve.now/CVE-2024-40090.md): Vilo 5 Mesh WiFi System \<= 5.16.1.33 is vulnerable to Information Disclosure. (CVSS 4.3)
- [CVE-2024-40091](https://cve.now/CVE-2024-40091.md): Vilo 5 Mesh WiFi System \<= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve l (CVSS 5.3)
- [CVE-2024-41712](https://cve.now/CVE-2024-41712.md): A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a comma (CVSS 6.6)
- [CVE-2024-41713](https://cve.now/CVE-2024-41713.md): A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenti (CVSS 9.1, KEV)
- [CVE-2024-41714](https://cve.now/CVE-2024-41714.md): A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (M (CVSS 8.8)
- [CVE-2024-46236](https://cve.now/CVE-2024-46236.md): CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in add\_members.php and edi (CVSS 5.4)
- [CVE-2024-46238](https://cve.now/CVE-2024-46238.md): Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /admin/a (CVSS 5.9)
- [CVE-2024-46239](https://cve.now/CVE-2024-46239.md): Multiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parameter in /doctor/edit-p (CVSS 5.9)
- [CVE-2024-46326](https://cve.now/CVE-2024-46326.md): Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout functi (CVSS 6.1)
- [CVE-2024-47189](https://cve.now/CVE-2024-47189.md): The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an (CVSS 7.7)
- [CVE-2024-47223](https://cve.now/CVE-2024-47223.md): A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an un (CVSS 9.4)
- [CVE-2024-47224](https://cve.now/CVE-2024-47224.md): A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an un (CVSS 6.5)
- [CVE-2024-47912](https://cve.now/CVE-2024-47912.md): A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an u (CVSS 8.2)
- [CVE-2024-48231](https://cve.now/CVE-2024-48231.md): Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \\backend\\controller\\auth\\Auth.php. (CVSS 7.2, funadmin/funadmin)
- [CVE-2024-48509](https://cve.now/CVE-2024-48509.md): Learning with Texts (LWT) 2.0.3 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2024-48597](https://cve.now/CVE-2024-48597.md): Online Clinic Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /success/editp.php?acti (CVSS 8.1)
- [CVE-2024-48645](https://cve.now/CVE-2024-48645.md): In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization (CWE-862) allows any user to modify "functio (CVSS 7.5)
- [CVE-2024-48659](https://cve.now/CVE-2024-48659.md): An issue in DCME-320-L \<=9.3.2.114 allows a remote attacker to execute arbitrary code via the log\_u\_umount.php component. (CVSS 9.8)
- [CVE-2024-48709](https://cve.now/CVE-2024-48709.md): CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType parameter in edit\_type.php (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.