# CVEs published 2024-10-26

44 CVEs were published on October 26, 2024: 5 critical, 22 high. Days are UTC.

- [CVE-2024-10407](https://cve.now/CVE-2024-10407.md): SourceCodester Petrol Pump Management Software edit\_customer.php sql injection (CVSS 5.3, SourceCodester Petrol Pump Management Software)
- [CVE-2024-10406](https://cve.now/CVE-2024-10406.md): SourceCodester Petrol Pump Management Software edit\_fuel.php sql injection (CVSS 5.3, SourceCodester Petrol Pump Management Software)
- [CVE-2020-26311](https://cve.now/CVE-2020-26311.md): GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent (CVSS 8.7, 3rd-Eden useragent · useragent)
- [CVE-2020-26310](https://cve.now/CVE-2020-26310.md): GHSL-2020-305: Regular Expression Denial of Service (ReDoS) in Pure JavaScript HTML5 Parser (CVSS 8.7, blowsie Pure-JavaScript-HTML5-Parser)
- [CVE-2020-26309](https://cve.now/CVE-2020-26309.md): GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validator (CVSS 8.7, ftonato nope-validator · nope-validator)
- [CVE-2020-26308](https://cve.now/CVE-2020-26308.md): GHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.js (CVSS 8.7, ansman validate.js · validate.js)
- [CVE-2020-26307](https://cve.now/CVE-2020-26307.md): GHSL-2020-301: Regular Expression Denial of Service (ReDoS) in HTML2Markdown (CVSS 8.7, kates html2markdown)
- [CVE-2020-26306](https://cve.now/CVE-2020-26306.md): GHSL-2020-296: Regular Expression Denial of Service (ReDoS) in Knwl.js (CVSS 8.7, benhmoore Knwl · knwl.js)
- [CVE-2020-26305](https://cve.now/CVE-2020-26305.md): GHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJS (CVSS 8.7, talyssonoc CommonRegexJS · commonregex)
- [CVE-2020-26304](https://cve.now/CVE-2020-26304.md): GHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sites (CVSS 8.7, foundation-sites)
- [CVE-2020-26303](https://cve.now/CVE-2020-26303.md): GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insane (CVSS 8.7, bevacqua insane · insane)
- [CVE-2024-9501](https://cve.now/CVE-2024-9501.md): Wp Social Login and Register Social Counter \<= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider (CVSS 9.8, roxnor Wp Social Login and Register Social Counter)
- [CVE-2024-10402](https://cve.now/CVE-2024-10402.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation (CVSS 7.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-10117](https://cve.now/CVE-2024-10117.md): WP Crowdfunding \<= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf\_donate Shortcode (CVSS 6.4, themeum WP Crowdfunding)
- [CVE-2024-10357](https://cve.now/CVE-2024-10357.md): Clever Addons for Elementor \<= 2.2.1 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates (CVSS 4.3, zootemplate Clever Addons for Elementor)
- [CVE-2024-9116](https://cve.now/CVE-2024-9116.md): Monkee-Boy Essentials \<= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, monkeeboy Monkee-Boy Essentials)
- [CVE-2024-9772](https://cve.now/CVE-2024-9772.md): Uix Shortcodes – Compatible with Gutenberg \<= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, uiuxlab Uix Shortcodes)
- [CVE-2024-9642](https://cve.now/CVE-2024-9642.md): Editor Custom Color Palette \<= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, rock4temps Editor Custom Color Palette)
- [CVE-2024-8392](https://cve.now/CVE-2024-8392.md): WordPress Post Grid Layouts with Pagination – Sogrid \<= 1.5.6 - Authenticated (Admin+) Local File Inclusion (CVSS 7.2, delabon WordPress Post Grid Layouts with Pagination – Sogrid)
- [CVE-2024-9637](https://cve.now/CVE-2024-9637.md): School Management System – WPSchoolPress \<= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation (CVSS 8.8, jdsofttech School Management System – WPSchoolPress)
- [CVE-2024-9967](https://cve.now/CVE-2024-9967.md): WP show more \<= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show\_more Shortcode (CVSS 6.4, renemaurer WP show more)
- [CVE-2024-9853](https://cve.now/CVE-2024-9853.md): ID-SK Toolkit \<= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, idsk ID-SK Toolkit)
- [CVE-2024-0128](https://cve.now/CVE-2024-0128.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. (CVSS 7.1, NVIDIA vGPU and Cloud Gaming)
- [CVE-2024-0127](https://cve.now/CVE-2024-0127.md): NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of th (CVSS 7.8, NVIDIA vGPU and Cloud Gaming)
- [CVE-2024-0121](https://cve.now/CVE-2024-0121.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-o (CVSS 7.8, NVIDIA GPU, vGPU, and Cloud Gaming)
- [CVE-2024-0120](https://cve.now/CVE-2024-0120.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-o (CVSS 7.8, NVIDIA GPU, vGPU, and Cloud Gaming)
- [CVE-2024-0119](https://cve.now/CVE-2024-0119.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-o (CVSS 7.8, NVIDIA GPU, vGPU, and Cloud Gaming)
- [CVE-2024-0118](https://cve.now/CVE-2024-0118.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-o (CVSS 7.8, NVIDIA GPU, vGPU, and Cloud Gaming)
- [CVE-2024-0117](https://cve.now/CVE-2024-0117.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-o (CVSS 7.8, NVIDIA GPU, vGPU, and Cloud Gaming)
- [CVE-2024-0126](https://cve.now/CVE-2024-0126.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. (CVSS 8.2, NVIDIA GPU, vGPU, and Cloud Gaming)
- [CVE-2024-10092](https://cve.now/CVE-2024-10092.md): Download Monitor \<= 5.0.12 - Missing Authorization to API Key Manipulation (CVSS 4.3, wpchill Download Monitor)
- [CVE-2024-9456](https://cve.now/CVE-2024-9456.md): WP Awesome Login \<= 0.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, elvishp2006 WP Awesome Login)
- [CVE-2024-8870](https://cve.now/CVE-2024-8870.md): Forms for Mailchimp by Optin Cat – Grow Your MailChimp List \<= 2.5.7 - Reflected Cross-Site Scripting (CVSS 6.1, fatcatapps Forms for Mailchimp by Optin Cat – Grow Your Mai…)
- [CVE-2024-9613](https://cve.now/CVE-2024-9613.md): FormFacade – WordPress plugin for Google Forms \<= 1.3.6 - Reflected Cross-Site Scripting (CVSS 6.1, manidoraisamy FormFacade – Embed Google Forms in your websi…)
- [CVE-2024-9454](https://cve.now/CVE-2024-9454.md): PriPre \<= 0.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, miyabe PriPre)
- [CVE-2024-10091](https://cve.now/CVE-2024-10091.md): ElementsKit Elementor addons \<= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget (CVSS 6.4, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2024-9930](https://cve.now/CVE-2024-9930.md): Extensions by HocWP Team \<= 0.2.3.2 - Authentication Bypass (CVSS 9.8, skylarkcob Extensions by HocWP Team)
- [CVE-2024-9932](https://cve.now/CVE-2024-9932.md): Wux Blog Editor \<= 3.0.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, jurredeklijn Wux Blog Editor)
- [CVE-2024-9462](https://cve.now/CVE-2024-9462.md): Poll Maker – Versus Polls, Anonymous Polls, Image Polls \<= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings (CVSS 5.5, ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…)
- [CVE-2024-9475](https://cve.now/CVE-2024-9475.md): Poll Maker – Versus Polls, Anonymous Polls, Image Polls \<= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order\_by Parameter (CVSS 4.9, ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…)
- [CVE-2024-9626](https://cve.now/CVE-2024-9626.md): Editorial Assistant by Sovrn \<= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image (CVSS 4.3, zemanta Editorial Assistant by Sovrn)
- [CVE-2024-9890](https://cve.now/CVE-2024-9890.md): User Toolkit \<= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass (CVSS 8.8, deryck User Toolkit)
- [CVE-2024-9933](https://cve.now/CVE-2024-9933.md): WatchTowerHQ \<= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check (CVSS 9.8, WatchTowerHQ)
- [CVE-2024-9931](https://cve.now/CVE-2024-9931.md): Wux Blog Editor \<= 3.0.0 - Authentication Bypass to Administrator (CVSS 9.8, jurredeklijn Wux Blog Editor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-10-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.