CVEs published October 26, 2024
44 CVEs were published on October 26, 2024: 5 critical, 22 high.
- Published
- 44
- Critical
- 5
- High
- 22
- Medium
- 17
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- NVIDIA GPU, vGPU, and Cloud Gaming
- 6
- ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- 2
- jurredeklijn Wux Blog Editor
- 2
- NVIDIA vGPU and Cloud Gaming
- 2
- SourceCodester Petrol Pump Management Software
- 2
- 3rd-Eden useragent · useragent
- 1
- ansman validate.js · validate.js
- 1
- benhmoore Knwl · knwl.js
- 1
- bevacqua insane · insane
- 1
- blowsie Pure-JavaScript-HTML5-Parser
- 1
Critical 5
- CVE-2024-9501Wp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth providerroxnor Wp Social Login and Register Social Counter
- CVE-2024-9930Extensions by HocWP Team <= 0.2.3.2 - Authentication Bypassskylarkcob Extensions by HocWP Team
- CVE-2024-9932Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Uploadjurredeklijn Wux Blog Editor
- CVE-2024-9933WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value CheckWatchTowerHQ
- CVE-2024-9931Wux Blog Editor <= 3.0.0 - Authentication Bypass to Administratorjurredeklijn Wux Blog Editor
High 22
- CVE-2020-26311GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent3rd-Eden useragent · useragent
- CVE-2020-26310GHSL-2020-305: Regular Expression Denial of Service (ReDoS) in Pure JavaScript HTML5 Parserblowsie Pure-JavaScript-HTML5-Parser
- CVE-2020-26309GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validatorftonato nope-validator · nope-validator
- CVE-2020-26308GHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.jsansman validate.js · validate.js
- CVE-2020-26307GHSL-2020-301: Regular Expression Denial of Service (ReDoS) in HTML2Markdownkates html2markdown
- CVE-2020-26306GHSL-2020-296: Regular Expression Denial of Service (ReDoS) in Knwl.jsbenhmoore Knwl · knwl.js
- CVE-2020-26305GHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJStalyssonoc CommonRegexJS · commonregex
- CVE-2020-26304GHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sitesfoundation-sites
- CVE-2020-26303GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insanebevacqua insane · insane
- CVE-2024-10402Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creationwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2024-9772Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Executionuiuxlab Uix Shortcodes
- CVE-2024-8392WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusiondelabon WordPress Post Grid Layouts with Pagination – Sogrid
- CVE-2024-9637School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalationjdsofttech School Management System – WPSchoolPress
- CVE-2024-0128NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources.NVIDIA vGPU and Cloud Gaming
- CVE-2024-0127NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of thNVIDIA vGPU and Cloud Gaming
- CVE-2024-0121NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-oNVIDIA GPU, vGPU, and Cloud Gaming
- CVE-2024-0120NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-oNVIDIA GPU, vGPU, and Cloud Gaming
- CVE-2024-0119NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-oNVIDIA GPU, vGPU, and Cloud Gaming
- CVE-2024-0118NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-oNVIDIA GPU, vGPU, and Cloud Gaming
- CVE-2024-0117NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-oNVIDIA GPU, vGPU, and Cloud Gaming
- CVE-2024-0126NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions.NVIDIA GPU, vGPU, and Cloud Gaming
- CVE-2024-9890User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypassderyck User Toolkit
Medium, low and unrated 17
- CVE-2024-10407SourceCodester Petrol Pump Management Software edit_customer.php sql injectionSourceCodester Petrol Pump Management Software
- CVE-2024-10406SourceCodester Petrol Pump Management Software edit_fuel.php sql injectionSourceCodester Petrol Pump Management Software
- CVE-2024-10117WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcodethemeum WP Crowdfunding
- CVE-2024-10357Clever Addons for Elementor <= 2.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templateszootemplate Clever Addons for Elementor
- CVE-2024-9116Monkee-Boy Essentials <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmonkeeboy Monkee-Boy Essentials
- CVE-2024-9642Editor Custom Color Palette <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadrock4temps Editor Custom Color Palette
- CVE-2024-9967WP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcoderenemaurer WP show more
- CVE-2024-9853ID-SK Toolkit <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadidsk ID-SK Toolkit
- CVE-2024-10092Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulationwpchill Download Monitor
- CVE-2024-9456WP Awesome Login <= 0.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadelvishp2006 WP Awesome Login
- CVE-2024-8870Forms for Mailchimp by Optin Cat – Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scriptingfatcatapps Forms for Mailchimp by Optin Cat – Grow Your Mai…
- CVE-2024-9613FormFacade – WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scriptingmanidoraisamy FormFacade – Embed Google Forms in your websi…
- CVE-2024-9454PriPre <= 0.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadmiyabe PriPre
- CVE-2024-10091ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widgetroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2024-9462Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settingsays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- CVE-2024-9475Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by Parameterays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- CVE-2024-9626Editorial Assistant by Sovrn <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Imagezemanta Editorial Assistant by Sovrn