CVEs published December 6, 2024
169 CVEs were published on December 6, 2024: 33 critical, 52 high.
- Published
- 169
- Critical
- 33
- High
- 52
- Medium
- 80
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 48
Most affected products
- Ruijie Reyee OS
- 10
- QNAP Systems QTS · QNAP Systems QuTS hero
- 9
- brandtoss WP Mailster
- 4
- SICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x
- 4
- iqonicdesign KiviCare – Clinic & Patient Management System
- 3
- Planet Technology Planet WGS-804HPT
- 3
- django
- 2
- Linux
- 2
- MacWarrior clipbucket-v5
- 2
- rstheme2017 Ultimate Coming Soon & Maintenance
- 2
Critical 33
- CVE-2024-52324Ruijie Reyee OS Use of Inherently Dangerous FunctionRuijie Reyee OS
- CVE-2024-48874Ruijie Reyee OS Server-Side Request ForgeryRuijie Reyee OS
- CVE-2024-47547Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten PasswordRuijie Reyee OS
- CVE-2024-52320Planet Technology Planet WGS-804HPT Command InjectionPlanet Technology Planet WGS-804HPT
- CVE-2024-48871Planet Technology Planet WGS-804HPT Stack-based Buffer OverflowPlanet Technology Planet WGS-804HPT
- CVE-2024-50389QuRouterQNAP Systems QuRouter
- CVE-2024-50387SMB ServiceQNAP Systems SMB Service
- CVE-2024-50388HBS 3 Hybrid Backup SyncQNAP Systems HBS 3 Hybrid Backup Sync
- CVE-2024-54143openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injectionopenwrt asu
- CVE-2024-54135Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199MacWarrior clipbucket-v5
- CVE-2024-54136Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and BelowMacWarrior clipbucket-v5
- CVE-2024-52335A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF05).Siemens syngo.plaza VB30E
- CVE-2024-53810WordPress Simple User Registration plugin <= 5.5 - Broken Access Control on User Deletion vulnerabilityN-Media Simple User Registration
- CVE-2024-51615WordPress WordPress Auction Plugin plugin <= 3.7 - SQL Injection vulnerabilityWP Marka WordPress Auction Plugin
- CVE-2024-54214WordPress Revy plugin <= 1.18 - Unauthenticated Arbitrary File Upload vulnerabilityroninwp Revy
- CVE-2024-51815WordPress s2Member plugin <= 241114 - Remote Code Execution (RCE) vulnerabilityCristián Lávaque s2Member
- CVE-2024-10773SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacksSICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x +1
- CVE-2024-12155SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Updatematthias-reuter SV100 Companion
- CVE-2024-38921Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl proce
- CVE-2024-38923Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl proce
- CVE-2024-38924Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl proce
- CVE-2024-38925Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl proce
- CVE-2024-38926Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl proce
- CVE-2024-38927Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl proce
- CVE-2024-41644Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit
- CVE-2024-41645Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit
- CVE-2024-41646Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit
- CVE-2024-41647Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit
- CVE-2024-41649Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit
- CVE-2024-53908An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.django
- CVE-2024-54745WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in
- CVE-2024-54747WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root
- CVE-2024-54750Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
High 52
- CVE-2024-0130NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue bNVIDIA UFM Enterprise GA · NVIDIA UFM Enterprise LTS23 +6
- CVE-2024-46874Ruijie Reyee OS Improper Handling of Insufficient Permissions or PrivilegesRuijie Reyee OS
- CVE-2024-47791Ruijie Reyee OS Improper Neutralization of Wildcards or Matching SymbolsRuijie Reyee OS
- CVE-2024-45722Ruijie Reyee OS Use of Weak CredentialsRuijie Reyee OS
- CVE-2024-47043Ruijie Reyee OS Insecure Storage of Sensitive InformationRuijie Reyee OS
- CVE-2024-11220Open Automation Software Incorrect Execution-Assigned PermissionsOpen Automation Software
- CVE-2024-48863License CenterQNAP Systems License Center
- CVE-2024-50393QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-48868QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-48865QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-53691QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-54137liboqs has a correctness error in HQC decapsulationopen-quantum-safe liboqs
- CVE-2024-12254Unbounded memory buffering in SelectorSocketTransport.writelines()Python Software Foundation CPython
- CVE-2024-54141phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not availablethorsten phpMyFAQ · thorsten/phpmyfaq
- CVE-2024-10516Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'swte Swift Performance Lite
- CVE-2024-21571Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent.Snyk Code Agent
- CVE-2024-53812WordPress WP GeoNames plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityJacques Malgrange WP GeoNames
- CVE-2024-53821WordPress Pie Register Premium plugin < 3.8.3.3 - Cross Site Scripting (XSS) vulnerabilityGenetech Pie Register Premium
- CVE-2024-54208WordPress Block Controller plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityJoni Halabi Block Controller
- CVE-2024-54209WordPress Awesome Shortcodes plugin <= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerabilityWPFactory Awesome Shortcodes
- CVE-2024-54205WordPress Paloma Widget plugin <= 1.14 - CSRF to Stored XSS vulnerabilityPaloma Widget
- CVE-2024-54216WordPress ARForms plugin < 7.0.2 - Path Traversal vulnerabilityreputeinfosystems ARForms
- CVE-2024-53807WordPress WP Mailster plugin <= 1.8.16.0 - SQL Injection vulnerabilitybrandtoss WP Mailster
- CVE-2024-53808WordPress NEX-Forms plugin <= 8.7.8 - SQL Injection vulnerabilityBasix NEX-Forms
- CVE-2024-53815WordPress Pinpoint Booking System plugin <= 2.9.9.5.2 - SQL Injection vulnerabilityDOTonPAPER Pinpoint Booking System
- CVE-2024-53817WordPress Acowebs Product Labels For Woocommerce plugin <= 1.5.8 - SQL Injection vulnerabilityacowebs Product Labels For Woocommerce
- CVE-2024-53804WordPress WP Mailster plugin <= 1.8.16.0 - Sensitive Data Exposure vulnerabilitybrandtoss WP Mailster
- CVE-2024-53824WordPress All Bootstrap Blocks plugin <= 1.3.20 - Local File Inclusion vulnerabilityall_bootstrap_blocks All Bootstrap Blocks
- CVE-2024-53805WordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerabilitybrandtoss WP Mailster
- CVE-2024-10776SICK InspectorP61x and SICK InspectorP62x: missing authenticationSICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x
- CVE-2024-10774SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIsSICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x
- CVE-2024-10772SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modificationSICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x
- CVE-2024-10771SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code executionSICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x +2
- CVE-2024-53141netfilter: ipset: add missing range check in bitmap_ip_uadtLinux
- CVE-2024-11460Verowa Connect <= 3.0.1 - Unauthenticated SQL Injectionpictureplanet Verowa Connect
- CVE-2024-11289Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusionpencidesign Soledad
- CVE-2024-11728KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injectioniqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2024-11323AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updatekekotron AI Quiz | Quiz Maker
- CVE-2024-11178Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTPindia-web-developer Login with OTP
- CVE-2024-10578Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installationblazethemes Pubnews
- CVE-2024-11585WP Hide & Security Enhancer <= 2.5.1 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletionnsp-code WP Hide & Security Enhancer
- CVE-2024-10247YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injectiontotalsoft Video Gallery – YouTube Gallery, Vimeo, Video Por…
- CVE-2024-38922Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2_amcl process.
- CVE-2024-41648Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit
- CVE-2024-41650Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit
- CVE-2024-44852Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component thet
- CVE-2024-44853Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component co
- CVE-2024-44854Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component sm
- CVE-2024-44855Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component na
- CVE-2024-44856Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component na
- CVE-2024-53907An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.django
- CVE-2024-54749Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root
Medium, low and unrated 84
- CVE-2024-54138XSS Vulnerability in NuGetGallery's Markdown Autolinks ProcessingNuGetGallery
- CVE-2024-7875XSS in Tungsten Automation TotalAgilityTungsten Automation TotalAgility
- CVE-2024-7874XSS in Tungsten Automation TotalAgilityTungsten Automation TotalAgility
- CVE-2024-12326Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in JirafeauJirafeau project Jirafeau
- CVE-2024-0139NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability.NVIDIA Base Command Manager · NVIDIA Bright Cluster Manager
- CVE-2024-47146Ruijie Reyee OS Resource LeakRuijie Reyee OS
- CVE-2024-51727Ruijie Reyee OS Premature Release of Resource During Expected LifetimeRuijie Reyee OS
- CVE-2024-42494Ruijie Reyee OS Exposure of Private Personal Information to an Unauthorized ActorRuijie Reyee OS
- CVE-2024-52558Planet Technology Planet WGS-804HPT Integer UnderflowPlanet Technology Planet WGS-804HPT
- CVE-2024-50403QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-50402QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-48867QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-48866QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-48859QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2024-50404Qsync CentralQNAP Systems Qsync Central
- CVE-2024-30129HCL Nomad server on Domino is affected by a host header injection vulnerabilityHCL Software Nomad server on Domino
- CVE-2024-11738Rustls: rustls network-reachable panic in `acceptor::accept`rustls · Red Hat Trusted Artifact Signer
- CVE-2024-42196HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerabilityHCL Software Launch
- CVE-2024-4633Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scriptingaverta Depicter — Popup & Slider Builder
- CVE-2024-11321Reflected XSS in Hi e-learning's Learning Management System (LMS)Hi e-learning Learning Management System
- CVE-2024-53826WordPress WPCasa plugin <= 1.2.13 - Insecure Direct Object References (IDOR) vulnerabilityWPSight WPCasa
- CVE-2024-53795WordPress Church Admin plugin <= 5.0.8 - Broken Access Control vulnerabilityandy_moyle Church Admin
- CVE-2024-53799WordPress FloristPress plugin <= 7.3.0 - Broken Access Control vulnerabilityBAKKBONE Australia FloristPress
- CVE-2024-53803WordPress WP Mailster plugin <= 1.8.16.0 - Broken Access Control vulnerabilitybrandtoss WP Mailster
- CVE-2024-53813WordPress WP Travel plugin <= 9.6.0 - Broken Access Control vulnerabilityWP Travel
- CVE-2024-53825WordPress FileBird Lite plugin <= 6.3.2 - Broken Access Control vulnerabilityNinja Team Filebird
- CVE-2024-53794WordPress Arkhe Blocks plugin <= 2.27.0 - Cross Site Scripting (XSS) vulnerabilityRyo Arkhe Blocks
- CVE-2024-53796WordPress Themesflat Addons For Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilitythemesflat-addons-for-elementor
- CVE-2024-53797WordPress Beaver Builder plugin <= 2.8.4.3 - Cross Site Scripting (XSS) vulnerabilityBeaver Builder
- CVE-2024-53801WordPress Bold Page Builder plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
- CVE-2024-53802WordPress Futurio Extra plugin <= 2.0.14 - Cross Site Scripting (XSS) vulnerabilityFuturioWP Futurio Extra
- CVE-2024-53820WordPress Captivate Sync plugin <= 2.0.22 - Cross Site Scripting (XSS) vulnerabilitycaptivateaudio Captivate Sync
- CVE-2024-53823WordPress The Plus Addons for Elementor plugin <= 5.6.14 - Cross Site Scripting (XSS) vulnerabilityPOSIMYTH The Plus Addons for Elementor Page Builder Lite
- CVE-2024-54206WordPress Z-Downloads plugin <= 1.11.7 - Cross Site Scripting (XSS) vulnerabilityURBAN BASE Z-Downloads
- CVE-2024-54207WordPress WordPress Auction Plugin plugin <= 3.7 - Cross Site Scripting (XSS) vulnerabilityWP Marka WordPress Auction Plugin
- CVE-2024-54210WordPress Advanced Element Bucket Addons for Elementor plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilitycodexshaper Advanced Element Bucket Addons for Elementor
- CVE-2024-54211WordPress Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerabilityVisualmodo Borderless
- CVE-2024-54212WordPress Magical Addons For Elementor plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerabilityNoor Alam Magical Addons For Elementor
- CVE-2024-54213WordPress WordPress Page Builder – Zion Builder plugin <= 3.6.16 - Cross Site Scripting (XSS) vulnerabilityZionBuilder
- CVE-2024-53806WordPress Maspik plugin <= 2.2.7 - CSRF to Settings Change vulnerabilityyonifre Maspik – Spam blacklist
- CVE-2024-53809WordPress Namaste! LMS plugin <= 2.6.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityBob Namaste! LMS
- CVE-2024-53811WordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerabilityPOSIMYTH WDesignkit
- CVE-2024-11022SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attackSICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x
- CVE-2024-11729KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injectioniqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2024-11730KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injectioniqonicdesign KiviCare – Clinic & Patient Management System
- CVE-2024-53142initramfs: avoid filename buffer overrunLinux
- CVE-2024-10681ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Executionreputeinfosystems ARMember – Membership Plugin, Content Res…
- CVE-2024-10909Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcodekingyes Pojo Forms
- CVE-2024-11339Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingdevnethr Smart PopUp Blaster
- CVE-2024-10689XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosurewebangon XLTab – Accordions and Tabs for Elementor Page Bui…
- CVE-2024-10692PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosureideaboxcreations PowerPack Addons for Elementor
- CVE-2024-11204ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameterultimatemember ForumWP – Forum & Discussion Board
- CVE-2024-11823Folder Gallery <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingvjalby Folder Gallery
- CVE-2024-11687Next-Cart Store to WooCommerce Migration <= 3.9.2 - Reflected Cross-Site Scriptingmartinnguyen1990 Next-Cart Store to WooCommerce Migration
- CVE-2024-9706Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activationrstheme2017 Ultimate Coming Soon & Maintenance
- CVE-2024-11352TwentyTwenty <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingcs123 TwentyTwenty
- CVE-2024-12028Friends <= 3.2.1 - Missing Authorizationakirk Friends
- CVE-2024-9872Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site ScriptingOnline Booking & Scheduling Calendar for WordPress by vcita
- CVE-2024-12110Gold Addons for Elementor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivationjerryscg Gold Addons for Elementor
- CVE-2024-10320Cookielay <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcodeiamjonasmarlo Cookielay
- CVE-2024-11450ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingONLYOFFICE Docs
- CVE-2024-11276PDF Builder for WooCommerce. Create invoices,packing slips and more <= 1.2.136 - Reflected Cross-Site Scriptingedgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2024-11368Splash Sync <= 2.0.7 - Reflected Cross-Site Scriptingnanard33 Splash Sync
- CVE-2024-11336Clickbank WordPress Plugin (Storefront) <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scriptingdactum Clickbank WordPress Plugin
- CVE-2024-12027Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletionskofimokome Message Filter for Contact Form
- CVE-2024-9866Event Tickets with Ticket Scanner <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingsasonikolov Event Tickets with Ticket Scanner
- CVE-2024-9705Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Updaterstheme2017 Ultimate Coming Soon & Maintenance
- CVE-2024-10849NewsMash <= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scriptingdesertthemes NewsMash
- CVE-2024-11292WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposurenimeshrmr WP Private Content Plus
- CVE-2024-11444CLUEVO LMS, E-Learning Platform <= 1.13.2 - Cross-Site Request Forgery to Module DeletionCLUEVO LMS, E-Learning Platform
- CVE-2024-12060WP Media Optimizer (.webp) <= 1.4.0 - Reflected Cross-Site Scripting via wpmowebp-css-resources and wpmowebp-js-resources Parametersfrancescosganga WP Media Optimizer
- CVE-2024-10879ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scriptingultimatemember ForumWP – Forum & Discussion Board
- CVE-2024-12003WP System <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingmikeyott WP System
- CVE-2024-10551Sticky Social Icons <= 1.2.1 - Admin+ Stored XSSSticky Social Icons
- CVE-2024-104803DPrint Lite < 2.1 - Settings Update via CSRF3DPrint Lite
- CVE-2024-11201myCred – Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcodesaadiqbal Points Management System For Gamification, Ranks,…
- CVE-2024-11379Broadcast <= 51.01 - Reflected Cross-Site Scriptingedward_plainview Broadcast
- CVE-2024-9769Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingtotalsoft Video Gallery – YouTube Gallery, Vimeo, Video Por…
- CVE-2024-10836Flixita <= 1.0.82 - Reflected Cross-Site Scripting via id Parameterthemesdaddy Flixita
- CVE-2024-11149OpenBSD vmm GDTR limitsOpenBSD
- CVE-2024-49041Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-48703PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchda
- CVE-2024-50677A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2024-55268A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Manag