CVEs published November 9, 2024
195 CVEs were published on November 9, 2024: 11 critical, 86 high.
- Published
- 195
- Critical
- 11
- High
- 86
- Medium
- 88
- Low
- 2
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Linux
- 49
- amazon data.all
- 5
- ce21com CE21 Suite
- 3
- Mattermost
- 3
- vanquish WooCommerce Support Ticket System
- 3
- codelessthemes Cowidgets – Elementor Addons
- 2
- eugenbobrowski Debug Tool
- 2
- Aajoda Testimonials
- 1
- Aakif Kadiwala Emoji Shortcode
- 1
- arsdehnel Simple Modal
- 1
Critical 11
- CVE-2024-10508RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recoverymetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2024-10589Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatenouthemes Leopard - WordPress Offload Media
- CVE-2024-10801WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Uploadvanquish WordPress User Extra Fields
- CVE-2024-10547WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Uploade-plugins WP Membership
- CVE-2024-10871Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusiontrustyplugins Category AJAX Filter – Advanced Filter for Po…
- CVE-2024-10470WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and DeletionVibeThemes WPLMS Learning Management System for WordPress,…
- CVE-2024-10627WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Uploadvanquish WooCommerce Support Ticket System
- CVE-2024-10625WooCommerce Support Ticket System <= 17.7 - Unauthenticated Arbitrary File Deletionvanquish WooCommerce Support Ticket System
- CVE-2024-10285CE21 Suite <= 2.2.0 - JWT Token Disclosurece21com CE21 Suite
- CVE-2024-10586Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creationeugenbobrowski Debug Tool
- CVE-2024-10284CE21 Suite <= 2.2.0 - Authentication Bypassce21com CE21 Suite
High 86
- CVE-2024-51606WordPress Blrt WP Embed plugin <= 1.6.9 - SQL Injection vulnerabilityBlrt WP Embed
- CVE-2024-51608WordPress AmaDiscount Plugin plugin <= 1.0 - SQL Injection vulnerabilitycolinph970 AmaDiscount
- CVE-2024-51623WordPress WP EIS plugin <= 1.3.3 - SQL Injection vulnerabilitymehral WP EIS
- CVE-2024-51630WordPress Responsive Flickr Gallery plugin <= 1.3.1 - CSRF to Stored XSS vulnerabilityLars Schenk Responsive Flickr Gallery
- CVE-2024-51647WordPress Featured Posts Scroll plugin <= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerabilityChaser324 Featured Posts Scroll
- CVE-2024-51689WordPress CF7 WOW Styler plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilitySaleswonder Team: Tobias CF7 WOW Styler
- CVE-2024-51690WordPress Wp Slide Categorywise plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityneelam.samariya Wp Slide Categorywise
- CVE-2024-51691WordPress Admin Amplify plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityaryanduntley Admin Amplify
- CVE-2024-51692WordPress Bing Search API Integration plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityaskewbrook Bing Search API Integration
- CVE-2024-51693WordPress Search order by product SKU for WooCommerce plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitylabdav Search order by product SKU for WooCommerce
- CVE-2024-51694WordPress Geotagged Media plugin <= 0.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilitydigitalfisherman Geotagged Media
- CVE-2024-51695WordPress Fabrica Synced Pattern Instances plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityYes We Work Fabrica Synced Pattern Instances
- CVE-2024-51696WordPress Content Syndication Toolkit Reader plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityben.moody Content Syndication Toolkit Reader
- CVE-2024-51697WordPress Doofinder plugin <= 0.5.4 - Reflected Cross Site Scripting (XSS) vulnerabilityDoofinder
- CVE-2024-51698WordPress Master Bar plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityLuis Rock Master Bar
- CVE-2024-51699WordPress Buooy Sticky Header plugin <= 0.5.2 - Reflected Cross Site Scripting (XSS) vulnerabilityBuooy Sticky Header
- CVE-2024-51701WordPress MG Post Contributors plugin <= 1.3. - Reflected Cross Site Scripting (XSS) vulnerabilityMahesh Waghmare MG Post Contributors
- CVE-2024-51702WordPress SrcSet Responsive Images for WordPress plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityben.moody SrcSet Responsive Images for WordPress
- CVE-2024-51703WordPress WP-Basics plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitylaura20 WP-Basics
- CVE-2024-51704WordPress imPress plugin <= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityJohn Hanusek imPress
- CVE-2024-51705WordPress WP MMenu Lite plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityjamesdbruner WP MMenu Lite
- CVE-2024-51706WordPress UW Freelancer plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityUpeksha Wisidagama UW Freelancer
- CVE-2024-51707WordPress WP Visual Adverts plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityWebCodin WP Visual Adverts
- CVE-2024-51708WordPress Narnoo Commerce Manager plugin <= 1.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityNarnoo Commerce Manager
- CVE-2024-51709WordPress TeleAdmin plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymariandz TeleAdmin
- CVE-2024-51710WordPress Responsive Data Table plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMinerva Infotech Responsive Data Table
- CVE-2024-51711WordPress Saragna plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityHitesh Khunt Saragna
- CVE-2024-51712WordPress Jigoshop plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMichael Visser Jigoshop – Store Toolkit
- CVE-2024-51713WordPress HQ60 Fidelity Card plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityTRe Technology And Research S.r.l. HQ60 Fidelity Card
- CVE-2024-51714WordPress User Password Reset plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitytechdabang User Password Reset
- CVE-2024-51716WordPress Twitter real time search scrolling plugin <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerabilitygopiplus Twitter real time search scrolling
- CVE-2024-51717WordPress Ajax Content Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityPerception System System Pvt. Ajax Content Filter
- CVE-2024-51718WordPress Simple Modal plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerabilityarsdehnel Simple Modal
- CVE-2024-51719WordPress Simplistic SEO plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerabilityRoman Peterhans Simplistic SEO
- CVE-2024-51759WordPress SVT Simple plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDetlef Beyer SVT Simple
- CVE-2024-51760WordPress Dashing Memberships plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityRistretto Apps Dashing Memberships
- CVE-2024-51761WordPress WPHelpful plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityzackgilbert WPHelpful
- CVE-2024-10261Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Executioncozmoslabs Paid Membership Subscriptions – Effortless Membe…
- CVE-2024-10640The FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Executionrealmag777 FOX – Currency Switcher Professional for WooComm…
- CVE-2024-50262bpf: Fix out-of-bounds write in trie_get_next_key()Linux
- CVE-2024-50261macsec: Fix use-after-free while sending the offloading packetLinux
- CVE-2024-50257netfilter: Fix use-after-free in get_info()Linux
- CVE-2024-50256netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()Linux
- CVE-2024-50253bpf: Check the validity of nr_words in bpf_iter_bits_new()Linux
- CVE-2024-50250fsdax: dax_unshare_iter needs to copy entire blocksLinux
- CVE-2024-50248ntfs3: Add bounds checking to mi_enum_attr()Linux
- CVE-2024-50247fs/ntfs3: Check if more than chunk-size bytes are writtenLinux
- CVE-2024-50246fs/ntfs3: Add rough attr alloc_size checkLinux
- CVE-2024-50241NFSD: Initialize struct nfsd4_copy earlierLinux
- CVE-2024-50237wifi: mac80211: do not pass a stopped vif to the driver in .get_txpowerLinux
- CVE-2024-50235wifi: cfg80211: clear wdev->cqm_config pointer on freeLinux
- CVE-2024-50234wifi: iwlegacy: Clear stale interrupts before resuming deviceLinux
- CVE-2024-50230nilfs2: fix kernel bug due to missing clearing of checked flagLinux
- CVE-2024-50227thunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan()Linux
- CVE-2024-50226cxl/port: Fix use-after-free, permit out-of-order decoder shutdownLinux
- CVE-2024-50225btrfs: fix error propagation of split biosLinux
- CVE-2024-50222iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAPLinux
- CVE-2024-50221drm/amd/pm: Vangogh: Fix kernel memory out of bounds writeLinux
- CVE-2024-50217btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()Linux
- CVE-2024-50215nvmet-auth: assign dh_key to NULL after kfree_sensitiveLinux
- CVE-2024-51762WordPress PropertyShift plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityChris Gipple PropertyShift
- CVE-2024-51763WordPress Team Showcase and Slider plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitybiplob018 Team Showcase and Slider – Team Members Builder
- CVE-2024-10676WordPress Conversion Helper plugin <= 1.12 - Reflected Cross Site Scripting (XSS) vulnerabilitywojciechborowicz Conversion Helper
- CVE-2024-51776WordPress Daily Image plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySam Hotchkiss Daily Image
- CVE-2024-51778WordPress Satisfaction Reports from Help Scout plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityTevya Satisfaction Reports from Help Scout
- CVE-2024-51779WordPress Don't Break The Code plugin <= .3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityJason Coleman Don't Break The Code
- CVE-2024-51780WordPress eewee admin custom plugin <= 1.8.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityeewee admin custom
- CVE-2024-51781WordPress Firework Shoppable Live Video plugin <= 6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityStefan Backor Firework Shoppable Live Video
- CVE-2024-50524WordPress Administrator Z plugin < 2024.10.21 - SQL Injection vulnerabilityQuý Lê 91 Administrator Z
- CVE-2024-50539WordPress Lodgix.com Vacation Rental Website Builder plugin <= 3.9.73 - SQL Injection vulnerabilityLodgix.com Vacation Rental Website Builder
- CVE-2024-50544WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerabilityMicahBlu RSVP ME
- CVE-2024-51570WordPress Easy Gallery plugin <= 1.4 - SQL Injection vulnerabilityodihost Easy Gallery
- CVE-2024-51579WordPress 5 Stars Rating Funnel plugin <=1.4.01 - SQL Injection vulnerabilitySaleswonder Team: Tobias 5 Stars Rating Funnel
- CVE-2024-51601WordPress Website price calculator plugin <= 4.1 - SQL Injection vulnerabilityMaksym Marko Website price calculator
- CVE-2024-51602WordPress Simple Job Manager plugin <= 1.1 - SQL Injection vulnerabilityoleksandr87 Simple Job Manager
- CVE-2024-51607WordPress Golf Tracker plugin <= 0.7 - SQL Injection vulnerabilitypercent20 Golf Tracker
- CVE-2024-51619WordPress Market 360 Viewer plugin <= 1.01 - SQL Injection vulnerabilitymarket360 Market 360 Viewer
- CVE-2024-51620WordPress Porsline plugin <= 1.0.2 - SQL Injection vulnerabilityPorsline
- CVE-2024-51621WordPress Download-Mirror-Counter plugin <= 1.1 - SQL Injection vulnerabilityreza19 Download-Mirror-Counter
- CVE-2024-51625WordPress Quran Shortcode plugin <= 1.5 - SQL Injection vulnerabilityedckwt Quran Shortcode
- CVE-2024-51782WordPress Loginplus plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilitySanjay Prasad Loginplus
- CVE-2024-51783WordPress Forms: 3rd-Party Post Again plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityzaus Forms: 3rd-Party Post Again
- CVE-2024-51784WordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityVietFriend team FriendStore for WooCommerce
- CVE-2024-10626WooCommerce Support Ticket System <= 17.7 - Authenticated (Subscriber+) Arbitrary File Deletionvanquish WooCommerce Support Ticket System
- CVE-2024-10674Th Shop Mania <= 1.4.9 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationthemehunk Th Shop Mania
- CVE-2024-10673Top Store <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activationthemehunk Top Store
Medium, low and unrated 98
- CVE-2024-52032Private channel names leaking when Elasticsearch is enabledMattermost
- CVE-2024-36250MFA Code ReplayMattermost
- CVE-2024-42000Unauthorized Access to view channels' detailsMattermost
- CVE-2024-51585WordPress Sales Page Addon plugin <= 1.4.5 - Stored Cross Site Scripting (XSS) vulnerabilitynicheaddons Sales Page Addon – Elementor & Beaver Builder
- CVE-2024-51586WordPress Elementary Addons plugin <= 2.0.4 - Stored Cross Site Scripting (XSS) vulnerabilitycamilluskillus Elementary Addons
- CVE-2024-51587WordPress Definitive Addons for Elementor plugin <= 1.5.16 - Stored Cross Site Scripting (XSS) vulnerabilitysoftfirm Definitive Addons for Elementor
- CVE-2024-51588WordPress Super Addons for Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityriponhossain Super Addons for Elementor
- CVE-2024-51589WordPress Bigmart Elements plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilitywpcirqle Bigmart Elements
- CVE-2024-51590WordPress Hoo Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityHooThemes Hoo Addons for Elementor
- CVE-2024-51591WordPress Slicko plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityWP Grids Slicko
- CVE-2024-51592WordPress Meta Store Elements plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilityMystical Themes Meta Store Elements
- CVE-2024-51593WordPress Курс валют UAH plugin <= 2.0 - Stored Cross Site Scripting (XSS) vulnerabilityGlopium Курс валют UAH
- CVE-2024-51594WordPress Gmap Point List plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerabilityRafel.sanso Gmap Point List
- CVE-2024-51595WordPress SKSDEV Toolkit plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilitySKSDEV Toolkit
- CVE-2024-51596WordPress Business plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityNilesh Shiragave Business
- CVE-2024-51597WordPress ThemeShark Templates & Widgets for Elementor plugin <= 1.1.7 - Stored Cross Site Scripting (XSS) vulnerabilityThemeShark Templates & Widgets for Elementor
- CVE-2024-51598WordPress Selar.co Widget plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilitykendysond Selar.co Widget
- CVE-2024-51599WordPress Simple Business Manager plugin <= 4.6.7.4 - Cross Site Scripting (XSS) vulnerabilityrussell.albin Simple Business Manager
- CVE-2024-51603WordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilitymirceatm NMR Strava activities
- CVE-2024-51604WordPress Media Modal plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilitycmabugay Media Modal
- CVE-2024-51605WordPress Genoo plugin <= 6.0.10 - Cross Site Scripting (XSS) vulnerabilityGenoo
- CVE-2024-51609WordPress Emoji Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityAakif Kadiwala Emoji Shortcode
- CVE-2024-51610WordPress Display Terms Shortcode plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityseothemes Display Terms Shortcode
- CVE-2024-51611WordPress WP Feature Box plugin <= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerabilityMiguel Peixe WP Feature Box
- CVE-2024-51612WordPress Reftagger Shortcode plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerabilitydesignerken Reftagger Shortcode
- CVE-2024-51613WordPress TradeMe widgets plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerabilitybidbud TradeMe widgets
- CVE-2024-51614WordPress Aajoda Testimonials plugin <= 2.2.2 - Stored Cross Site Scripting (XSS) vulnerabilityAajoda Testimonials
- CVE-2024-51616WordPress AwesomePress plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerabilityRupok AwesomePress
- CVE-2024-51618WordPress Custom Admin Menu plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityDuoGeek Custom Admin Menu
- CVE-2024-51622WordPress WP EASY RECIPE plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityWP-EXPERTS.IN WP EASY RECIPE
- CVE-2024-51627WordPress Audio Comparison Lite plugin <= 3.4 - Stored Cross Site Scripting (XSS) vulnerabilitykaedinger Audio Comparison Lite
- CVE-2024-51628WordPress EzyOnlineBookings Online Booking System Widget plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityEzyOnlineBookings Online Booking System Widget
- CVE-2024-51629WordPress Header Footer Composer for Elementor plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilityMetricThemes Header Footer Composer for Elementor
- CVE-2024-51662WordPress Black Widgets For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityModernaweb Studio Black Widgets For Elementor
- CVE-2024-51663WordPress Bricksable for Bricks Builder plugin <= 1.6.59 - Cross Site Scripting (XSS) vulnerabilityBricksable for Bricks Builder
- CVE-2024-51664WordPress Beds24 Online Booking plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerabilitymarkkinchin Beds24 Online Booking
- CVE-2024-51668WordPress MyCurator Content Curation plugin <= 3.78 - Cross Site Scripting (XSS) vulnerabilitymtilly MyCurator Content Curation
- CVE-2024-51670WordPress JS Help Desk plugin <= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerabilityJoomSky JS Help Desk
- CVE-2024-51673WordPress HT Politic plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerabilityDevItems HT Politic
- CVE-2024-51674WordPress Sastra Essential Addons for Elementor plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityFast Themes Sastra Essential Addons for Elementor
- CVE-2024-51675WordPress aThemes Addons for Elementor plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerabilitySyed Balkhi aThemes Addons for Elementor
- CVE-2024-51676WordPress Delisho plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityWP Delicious Delisho
- CVE-2024-10837SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameterphppoet SysBasics Customize My Account for WooCommerce
- CVE-2024-10352Magical Addons For Elementor <= 1.2.4 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templatenalam-1 Magical Addons For Elementor
- CVE-2024-50260sock_map: fix a NULL pointer dereference in sock_map_link_update_prog()Linux
- CVE-2024-50259netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write()Linux
- CVE-2024-50258net: fix crash when config small gso_max_size/gso_ipv4_max_sizeLinux
- CVE-2024-50255Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecsLinux
- CVE-2024-50254bpf: Free dynamically allocated bits in bpf_iter_bits_destroy()Linux
- CVE-2024-50252mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 addressLinux
- CVE-2024-50251netfilter: nft_payload: sanitize offset and length before calling skb_checksum()Linux
- CVE-2024-50249ACPI: CPPC: Make rmw_lock a raw_spin_lockLinux
- CVE-2024-50245fs/ntfs3: Fix possible deadlock in mi_readLinux
- CVE-2024-50244fs/ntfs3: Additional check in ni_clear()Linux
- CVE-2024-50243fs/ntfs3: Fix general protection fault in run_is_mapped_fullLinux
- CVE-2024-50242fs/ntfs3: Additional check in ntfs_file_releaseLinux
- CVE-2024-50240phy: qcom: qmp-usb: fix NULL-deref on runtime suspendLinux
- CVE-2024-50239phy: qcom: qmp-usb-legacy: fix NULL-deref on runtime suspendLinux
- CVE-2024-50238phy: qcom: qmp-usbc: fix NULL-deref on runtime suspendLinux
- CVE-2024-50236wifi: ath10k: Fix memory leak in management txLinux
- CVE-2024-50233staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()Linux
- CVE-2024-50232iio: adc: ad7124: fix division by zero in ad7124_set_channel_odr()Linux
- CVE-2024-50231iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()Linux
- CVE-2024-50229nilfs2: fix potential deadlock with newly created symlinksLinux
- CVE-2024-50224spi: spi-fsl-dspi: Fix crash when not using GPIO chip selectLinux
- CVE-2024-50223sched/numa: Fix the potential null pointer dereference in task_numa_work()Linux
- CVE-2024-50220fork: do not invoke uffd on fork if error occursLinux
- CVE-2024-50218ocfs2: pass u64 to ocfs2_truncate_inline maybe overflowLinux
- CVE-2024-50216xfs: fix finding a last resort AG in xfs_filestream_pick_agLinux
- CVE-2024-50214drm/connector: hdmi: Fix memory leak in drm_display_mode_from_cea_vic()Linux
- CVE-2024-50213drm/tests: hdmi: Fix memory leaks in drm_display_mode_from_cea_vic()Linux
- CVE-2024-50212lib: alloc_tag_module_unload must wait for pending kfree_rcu callsLinux
- CVE-2024-51786WordPress Realty by BestWebSoft plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerabilitybestweblayout Realty by BestWebSoft
- CVE-2024-51787WordPress ElementsReady Addons for Elementor plugin <= 6.4.3 - Cross Site Scripting (XSS) vulnerabilityquomodosoft ElementsReady Addons for Elementor
- CVE-2024-51785WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerabilityNks Responsive Filterable Portfolio
- CVE-2024-10688Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosurecrestaproject Attesa Extra
- CVE-2024-10876Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scriptingsmub Charitable – Donation Plugin for WordPress – Fundraisi…
- CVE-2024-9874WordPress Poll Maker Plugin <= 5.4.6 - Authenticated (Administrator+) Time-Based SQL Injectionays-pro Poll Maker – Versus Polls, Anonymous Polls, Image P…
- CVE-2024-10683Contact Form 7 - PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scriptingscottpaterson Contact Form 7 – PayPal & Stripe Add-on
- CVE-2024-8756Quform - WordPress Form Builder <= 2.20.0 - Unauthenticated Sensitive Information ExposureThemeCatcher Quform - WordPress Form Builder
- CVE-2024-10667Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosurebplugins Content Slider Block – Slide Through Text or Media…
- CVE-2024-10669Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosurebplugins Countdown Timer Block – Animated Countdown for Eve…
- CVE-2024-10814Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgerydartiss Code Embed
- CVE-2024-10770Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosureenvothemes Envo Extra
- CVE-2024-10693SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosuresonalsinha21 SKT Addons for Elementor
- CVE-2024-9226Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.6 - Reflected Cross-Site Scriptingfatcatapps Landing Page Cat – Coming Soon & Maintenance Pag…
- CVE-2024-8960Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadcodelessthemes Cowidgets – Elementor Addons
- CVE-2024-10779Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosurecodelessthemes Cowidgets – Elementor Addons
- CVE-2024-10294CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Changece21com CE21 Suite
- CVE-2024-9775Anih - Creative Agency WordPress Theme <= 2024 - Authenticated (Administrator+) Stored Cross-Site Scriptingshtheme Anih - Creative Agency WordPress Theme
- CVE-2024-10588Debug Tool <= 2.2 - Missing Authorization to Information Exposureeugenbobrowski Debug Tool
- CVE-2024-9262User Meta – User Profile Builder and User management plugin <= 3.1.1 - Insecure Direct Object Reference to Sensitive Information Exposurekhaledsaikat User Meta – User Profile Builder and User mana…
- CVE-2024-9270Lenxel Core for Lenxel(LNX) LMS <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadogunlab Lenxel AI LMS – Course Lesson Generator
- CVE-2024-52314data.all admin user may access potentially sensitive data stored by producers via logsamazon data.all
- CVE-2024-52312data.all authenticated users can perform restricted operations against DataSets and Environmentsamazon data.all
- CVE-2024-52313data.all authenticated users can obtain incorrect object level authorizationsamazon data.all
- CVE-2024-10953data.all authenticated users can perform mutating update operations on persisted notification recordsamazon data.all
- CVE-2024-52311data.all does not invalidate authentication token upon user logoutamazon data.all