# CVEs published 2024-12-06

169 CVEs were published on December 6, 2024: 33 critical, 52 high. Days are UTC.

- [CVE-2024-54138](https://cve.now/CVE-2024-54138.md): XSS Vulnerability in NuGetGallery's Markdown Autolinks Processing (CVSS 6.9, NuGetGallery)
- [CVE-2024-7875](https://cve.now/CVE-2024-7875.md): XSS in Tungsten Automation TotalAgility (CVSS 5.3, Tungsten Automation TotalAgility)
- [CVE-2024-7874](https://cve.now/CVE-2024-7874.md): XSS in Tungsten Automation TotalAgility (CVSS 5.3, Tungsten Automation TotalAgility)
- [CVE-2024-12326](https://cve.now/CVE-2024-12326.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Jirafeau (CVSS 6.1, Jirafeau project Jirafeau)
- [CVE-2024-0130](https://cve.now/CVE-2024-0130.md): NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI contain a vulnerability where an attacker can cause an improper authentication issue b (CVSS 8.8, NVIDIA UFM Enterprise GA · NVIDIA UFM Enterprise LTS23 +6)
- [CVE-2024-0139](https://cve.now/CVE-2024-0139.md): NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability. (CVSS 4.4, NVIDIA Base Command Manager · NVIDIA Bright Cluster Manager)
- [CVE-2024-47146](https://cve.now/CVE-2024-47146.md): Ruijie Reyee OS Resource Leak (CVSS 6.5, Ruijie Reyee OS)
- [CVE-2024-52324](https://cve.now/CVE-2024-52324.md): Ruijie Reyee OS Use of Inherently Dangerous Function (CVSS 9.8, Ruijie Reyee OS)
- [CVE-2024-48874](https://cve.now/CVE-2024-48874.md): Ruijie Reyee OS Server-Side Request Forgery (CVSS 9.8, Ruijie Reyee OS)
- [CVE-2024-46874](https://cve.now/CVE-2024-46874.md): Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges (CVSS 8.1, Ruijie Reyee OS)
- [CVE-2024-47791](https://cve.now/CVE-2024-47791.md): Ruijie Reyee OS Improper Neutralization of Wildcards or Matching Symbols (CVSS 7.5, Ruijie Reyee OS)
- [CVE-2024-45722](https://cve.now/CVE-2024-45722.md): Ruijie Reyee OS Use of Weak Credentials (CVSS 7.5, Ruijie Reyee OS)
- [CVE-2024-47043](https://cve.now/CVE-2024-47043.md): Ruijie Reyee OS Insecure Storage of Sensitive Information (CVSS 7.5, Ruijie Reyee OS)
- [CVE-2024-51727](https://cve.now/CVE-2024-51727.md): Ruijie Reyee OS Premature Release of Resource During Expected Lifetime (CVSS 6.5, Ruijie Reyee OS)
- [CVE-2024-42494](https://cve.now/CVE-2024-42494.md): Ruijie Reyee OS Exposure of Private Personal Information to an Unauthorized Actor (CVSS 6.5, Ruijie Reyee OS)
- [CVE-2024-47547](https://cve.now/CVE-2024-47547.md): Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password (CVSS 9.4, Ruijie Reyee OS)
- [CVE-2024-11220](https://cve.now/CVE-2024-11220.md): Open Automation Software Incorrect Execution-Assigned Permissions (CVSS 7.8, Open Automation Software)
- [CVE-2024-52558](https://cve.now/CVE-2024-52558.md): Planet Technology Planet WGS-804HPT Integer Underflow (CVSS 5.3, Planet Technology Planet WGS-804HPT)
- [CVE-2024-52320](https://cve.now/CVE-2024-52320.md): Planet Technology Planet WGS-804HPT Command Injection (CVSS 9.8, Planet Technology Planet WGS-804HPT)
- [CVE-2024-48871](https://cve.now/CVE-2024-48871.md): Planet Technology Planet WGS-804HPT Stack-based Buffer Overflow (CVSS 9.8, Planet Technology Planet WGS-804HPT)
- [CVE-2024-48863](https://cve.now/CVE-2024-48863.md): License Center (CVSS 7.7, QNAP Systems License Center)
- [CVE-2024-50403](https://cve.now/CVE-2024-50403.md): QTS, QuTS hero (CVSS 2.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-50402](https://cve.now/CVE-2024-50402.md): QTS, QuTS hero (CVSS 2.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-50393](https://cve.now/CVE-2024-50393.md): QTS, QuTS hero (CVSS 8.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-48868](https://cve.now/CVE-2024-48868.md): QTS, QuTS hero (CVSS 8.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-48867](https://cve.now/CVE-2024-48867.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-48866](https://cve.now/CVE-2024-48866.md): QTS, QuTS hero (CVSS 2.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-48865](https://cve.now/CVE-2024-48865.md): QTS, QuTS hero (CVSS 7.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-48859](https://cve.now/CVE-2024-48859.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-50404](https://cve.now/CVE-2024-50404.md): Qsync Central (CVSS 6.8, QNAP Systems Qsync Central)
- [CVE-2024-50389](https://cve.now/CVE-2024-50389.md): QuRouter (CVSS 9.5, QNAP Systems QuRouter)
- [CVE-2024-50387](https://cve.now/CVE-2024-50387.md): SMB Service (CVSS 10.0, QNAP Systems SMB Service)
- [CVE-2024-50388](https://cve.now/CVE-2024-50388.md): HBS 3 Hybrid Backup Sync (CVSS 9.5, QNAP Systems HBS 3 Hybrid Backup Sync)
- [CVE-2024-53691](https://cve.now/CVE-2024-53691.md): QTS, QuTS hero (CVSS 8.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-54143](https://cve.now/CVE-2024-54143.md): openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection (CVSS 9.3, openwrt asu)
- [CVE-2024-54137](https://cve.now/CVE-2024-54137.md): liboqs has a correctness error in HQC decapsulation (CVSS 7.4, open-quantum-safe liboqs)
- [CVE-2024-30129](https://cve.now/CVE-2024-30129.md): HCL Nomad server on Domino is affected by a host header injection vulnerability (CVSS 5.3, HCL Software Nomad server on Domino)
- [CVE-2024-12254](https://cve.now/CVE-2024-12254.md): Unbounded memory buffering in SelectorSocketTransport.writelines() (CVSS 8.7, Python Software Foundation CPython)
- [CVE-2024-54135](https://cve.now/CVE-2024-54135.md): Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199 (CVSS 9.8, MacWarrior clipbucket-v5)
- [CVE-2024-54136](https://cve.now/CVE-2024-54136.md): Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below (CVSS 9.8, MacWarrior clipbucket-v5)
- [CVE-2024-54141](https://cve.now/CVE-2024-54141.md): phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available (CVSS 8.6, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2024-11738](https://cve.now/CVE-2024-11738.md): Rustls: rustls network-reachable panic in \`acceptor::accept\` (CVSS 5.3, rustls · Red Hat Trusted Artifact Signer)
- [CVE-2024-42196](https://cve.now/CVE-2024-42196.md): HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability (CVSS 6.2, HCL Software Launch)
- [CVE-2024-4633](https://cve.now/CVE-2024-4633.md): Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel \<= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, averta Depicter — Popup & Slider Builder)
- [CVE-2024-10516](https://cve.now/CVE-2024-10516.md): Swift Performance Lite \<= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify' (CVSS 8.1, swte Swift Performance Lite)
- [CVE-2024-11321](https://cve.now/CVE-2024-11321.md): Reflected XSS in Hi e-learning's Learning Management System (LMS) (CVSS 5.4, Hi e-learning Learning Management System)
- [CVE-2024-21571](https://cve.now/CVE-2024-21571.md): Snyk has identified a remote code execution (RCE) vulnerability in all versions of Code Agent. (CVSS 8.1, Snyk Code Agent)
- [CVE-2024-53826](https://cve.now/CVE-2024-53826.md): WordPress WPCasa plugin \<= 1.2.13 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3, WPSight WPCasa)
- [CVE-2024-52335](https://cve.now/CVE-2024-52335.md): A vulnerability has been identified in syngo.plaza VB30E (All versions \< VB30E\_HF05). (CVSS 9.8, Siemens syngo.plaza VB30E)
- [CVE-2024-53795](https://cve.now/CVE-2024-53795.md): WordPress Church Admin plugin \<= 5.0.8 - Broken Access Control vulnerability (CVSS 5.3, andy\_moyle Church Admin)
- [CVE-2024-53799](https://cve.now/CVE-2024-53799.md): WordPress FloristPress plugin \<= 7.3.0 - Broken Access Control vulnerability (CVSS 4.3, BAKKBONE Australia FloristPress)
- [CVE-2024-53803](https://cve.now/CVE-2024-53803.md): WordPress WP Mailster plugin \<= 1.8.16.0 - Broken Access Control vulnerability (CVSS 6.5, brandtoss WP Mailster)
- [CVE-2024-53810](https://cve.now/CVE-2024-53810.md): WordPress Simple User Registration plugin \<= 5.5 - Broken Access Control on User Deletion vulnerability (CVSS 9.1, N-Media Simple User Registration)
- [CVE-2024-53813](https://cve.now/CVE-2024-53813.md): WordPress WP Travel plugin \<= 9.6.0 - Broken Access Control vulnerability (CVSS 6.5, WP Travel)
- [CVE-2024-53825](https://cve.now/CVE-2024-53825.md): WordPress FileBird Lite plugin \<= 6.3.2 - Broken Access Control vulnerability (CVSS 4.7, Ninja Team Filebird)
- [CVE-2024-53794](https://cve.now/CVE-2024-53794.md): WordPress Arkhe Blocks plugin \<= 2.27.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ryo Arkhe Blocks)
- [CVE-2024-53796](https://cve.now/CVE-2024-53796.md): WordPress Themesflat Addons For Elementor plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themesflat-addons-for-elementor)
- [CVE-2024-53797](https://cve.now/CVE-2024-53797.md): WordPress Beaver Builder plugin \<= 2.8.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Beaver Builder)
- [CVE-2024-53801](https://cve.now/CVE-2024-53801.md): WordPress Bold Page Builder plugin \<= 5.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2024-53802](https://cve.now/CVE-2024-53802.md): WordPress Futurio Extra plugin \<= 2.0.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FuturioWP Futurio Extra)
- [CVE-2024-53812](https://cve.now/CVE-2024-53812.md): WordPress WP GeoNames plugin \<= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jacques Malgrange WP GeoNames)
- [CVE-2024-53820](https://cve.now/CVE-2024-53820.md): WordPress Captivate Sync plugin \<= 2.0.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, captivateaudio Captivate Sync)
- [CVE-2024-53821](https://cve.now/CVE-2024-53821.md): WordPress Pie Register Premium plugin \< 3.8.3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Genetech Pie Register Premium)
- [CVE-2024-53823](https://cve.now/CVE-2024-53823.md): WordPress The Plus Addons for Elementor plugin \<= 5.6.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite)
- [CVE-2024-54206](https://cve.now/CVE-2024-54206.md): WordPress Z-Downloads plugin \<= 1.11.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, URBAN BASE Z-Downloads)
- [CVE-2024-54207](https://cve.now/CVE-2024-54207.md): WordPress WordPress Auction Plugin plugin \<= 3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Marka WordPress Auction Plugin)
- [CVE-2024-54208](https://cve.now/CVE-2024-54208.md): WordPress Block Controller plugin \<= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Joni Halabi Block Controller)
- [CVE-2024-54209](https://cve.now/CVE-2024-54209.md): WordPress Awesome Shortcodes plugin \<= 1.7.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPFactory Awesome Shortcodes)
- [CVE-2024-54210](https://cve.now/CVE-2024-54210.md): WordPress Advanced Element Bucket Addons for Elementor plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, codexshaper Advanced Element Bucket Addons for Elementor)
- [CVE-2024-54211](https://cve.now/CVE-2024-54211.md): WordPress Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin \<= 1.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Visualmodo Borderless)
- [CVE-2024-54212](https://cve.now/CVE-2024-54212.md): WordPress Magical Addons For Elementor plugin \<= 1.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Noor Alam Magical Addons For Elementor)
- [CVE-2024-54213](https://cve.now/CVE-2024-54213.md): WordPress WordPress Page Builder – Zion Builder plugin \<= 3.6.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, ZionBuilder)
- [CVE-2024-54205](https://cve.now/CVE-2024-54205.md): WordPress Paloma Widget plugin \<= 1.14 - CSRF to Stored XSS vulnerability (CVSS 7.1, Paloma Widget)
- [CVE-2024-51615](https://cve.now/CVE-2024-51615.md): WordPress WordPress Auction Plugin plugin \<= 3.7 - SQL Injection vulnerability (CVSS 9.3, WP Marka WordPress Auction Plugin)
- [CVE-2024-54214](https://cve.now/CVE-2024-54214.md): WordPress Revy plugin \<= 1.18 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0, roninwp Revy)
- [CVE-2024-54216](https://cve.now/CVE-2024-54216.md): WordPress ARForms plugin \< 7.0.2 - Path Traversal vulnerability (CVSS 7.7, reputeinfosystems ARForms)
- [CVE-2024-51815](https://cve.now/CVE-2024-51815.md): WordPress s2Member plugin \<= 241114 - Remote Code Execution (RCE) vulnerability (CVSS 9.0, Cristián Lávaque s2Member)
- [CVE-2024-53806](https://cve.now/CVE-2024-53806.md): WordPress Maspik plugin \<= 2.2.7 - CSRF to Settings Change vulnerability (CVSS 5.4, yonifre Maspik – Spam blacklist)
- [CVE-2024-53809](https://cve.now/CVE-2024-53809.md): WordPress Namaste! LMS plugin \<= 2.6.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Bob Namaste! LMS)
- [CVE-2024-53807](https://cve.now/CVE-2024-53807.md): WordPress WP Mailster plugin \<= 1.8.16.0 - SQL Injection vulnerability (CVSS 8.5, brandtoss WP Mailster)
- [CVE-2024-53808](https://cve.now/CVE-2024-53808.md): WordPress NEX-Forms plugin \<= 8.7.8 - SQL Injection vulnerability (CVSS 8.5, Basix NEX-Forms)
- [CVE-2024-53815](https://cve.now/CVE-2024-53815.md): WordPress Pinpoint Booking System plugin \<= 2.9.9.5.2 - SQL Injection vulnerability (CVSS 8.5, DOTonPAPER Pinpoint Booking System)
- [CVE-2024-53817](https://cve.now/CVE-2024-53817.md): WordPress Acowebs Product Labels For Woocommerce plugin \<= 1.5.8 - SQL Injection vulnerability (CVSS 7.6, acowebs Product Labels For Woocommerce)
- [CVE-2024-53804](https://cve.now/CVE-2024-53804.md): WordPress WP Mailster plugin \<= 1.8.16.0 - Sensitive Data Exposure vulnerability (CVSS 7.5, brandtoss WP Mailster)
- [CVE-2024-53811](https://cve.now/CVE-2024-53811.md): WordPress WDesignKit plugin \<= 1.0.40 - Arbitrary File Upload vulnerability (CVSS 6.6, POSIMYTH WDesignkit)
- [CVE-2024-53824](https://cve.now/CVE-2024-53824.md): WordPress All Bootstrap Blocks plugin \<= 1.3.20 - Local File Inclusion vulnerability (CVSS 7.5, all\_bootstrap\_blocks All Bootstrap Blocks)
- [CVE-2024-53805](https://cve.now/CVE-2024-53805.md): WordPress WP Mailster plugin \<= 1.8.16.0 - Broken Access Control vulnerability (CVSS 7.5, brandtoss WP Mailster)
- [CVE-2024-10776](https://cve.now/CVE-2024-10776.md): SICK InspectorP61x and SICK InspectorP62x: missing authentication (CVSS 8.2, SICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x)
- [CVE-2024-10774](https://cve.now/CVE-2024-10774.md): SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs (CVSS 7.3, SICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x)
- [CVE-2024-10773](https://cve.now/CVE-2024-10773.md): SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks (CVSS 9.0, SICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x +1)
- [CVE-2024-10772](https://cve.now/CVE-2024-10772.md): SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification (CVSS 8.8, SICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x)
- [CVE-2024-10771](https://cve.now/CVE-2024-10771.md): SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution (CVSS 8.8, SICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x +2)
- [CVE-2024-11022](https://cve.now/CVE-2024-11022.md): SICK InspectorP61x and SICK InspectorP62x are vulnerable for a replay attack (CVSS 5.6, SICK AG SICK InspectorP61x · SICK AG SICK InspectorP62x)
- [CVE-2024-11729](https://cve.now/CVE-2024-11729.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.4 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2024-11730](https://cve.now/CVE-2024-11730.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection (CVSS 6.5, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2024-53142](https://cve.now/CVE-2024-53142.md): initramfs: avoid filename buffer overrun (no CVSS, Linux)
- [CVE-2024-53141](https://cve.now/CVE-2024-53141.md): netfilter: ipset: add missing range check in bitmap\_ip\_uadt (CVSS 7.8, Linux)
- [CVE-2024-10681](https://cve.now/CVE-2024-10681.md): ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup \<= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 6.3, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2024-11460](https://cve.now/CVE-2024-11460.md): Verowa Connect \<= 3.0.1 - Unauthenticated SQL Injection (CVSS 7.5, pictureplanet Verowa Connect)
- [CVE-2024-11289](https://cve.now/CVE-2024-11289.md): Soledad \<= 8.5.9 - Unauthenticated Limited Local File Inclusion (CVSS 8.1, pencidesign Soledad)
- [CVE-2024-11728](https://cve.now/CVE-2024-11728.md): KiviCare – Clinic & Patient Management System (EHR) \<= 3.6.4 - Unauthenticated SQL Injection (CVSS 7.5, iqonicdesign KiviCare – Clinic & Patient Management System)
- [CVE-2024-10909](https://cve.now/CVE-2024-10909.md): Pojo Forms \<= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form\_preview\_shortcode (CVSS 6.3, kingyes Pojo Forms)
- [CVE-2024-11339](https://cve.now/CVE-2024-11339.md): Smart PopUp Blaster \<= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, devnethr Smart PopUp Blaster)
- [CVE-2024-10689](https://cve.now/CVE-2024-10689.md): XLTab – Accordions and Tabs for Elementor Page Builder \<= 1.4 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, webangon XLTab – Accordions and Tabs for Elementor Page Bui…)
- [CVE-2024-10692](https://cve.now/CVE-2024-10692.md): PowerPack Elementor Addons (Free Widgets, Extensions and Templates) \<= 2.8.1 - Authenticated (Contributor+) Post Disclosure (CVSS 4.3, ideaboxcreations PowerPack Addons for Elementor)
- [CVE-2024-11204](https://cve.now/CVE-2024-11204.md): ForumWP – Forum & Discussion Board \<= 2.1.2 - Reflected Cross-Site Scripting via url Parameter (CVSS 6.1, ultimatemember ForumWP – Forum & Discussion Board)
- [CVE-2024-12155](https://cve.now/CVE-2024-12155.md): SV100 Companion \<= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update (CVSS 9.8, matthias-reuter SV100 Companion)
- [CVE-2024-11823](https://cve.now/CVE-2024-11823.md): Folder Gallery \<= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.1, vjalby Folder Gallery)
- [CVE-2024-11687](https://cve.now/CVE-2024-11687.md): Next-Cart Store to WooCommerce Migration \<= 3.9.2 - Reflected Cross-Site Scripting (CVSS 6.1, martinnguyen1990 Next-Cart Store to WooCommerce Migration)
- [CVE-2024-9706](https://cve.now/CVE-2024-9706.md): Ultimate Coming Soon & Maintenance \<= 1.0.9 - Missing Authorization to Unauthenticated Template Activation (CVSS 5.3, rstheme2017 Ultimate Coming Soon & Maintenance)
- [CVE-2024-11352](https://cve.now/CVE-2024-11352.md): TwentyTwenty \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cs123 TwentyTwenty)
- [CVE-2024-12028](https://cve.now/CVE-2024-12028.md): Friends \<= 3.2.1 - Missing Authorization (CVSS 5.3, akirk Friends)
- [CVE-2024-9872](https://cve.now/CVE-2024-9872.md): Online Booking & Scheduling Calendar for WordPress by vcita \<= 4.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2024-12110](https://cve.now/CVE-2024-12110.md): Gold Addons for Elementor \<= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation (CVSS 4.3, jerryscg Gold Addons for Elementor)
- [CVE-2024-10320](https://cve.now/CVE-2024-10320.md): Cookielay \<= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode (CVSS 6.4, iamjonasmarlo Cookielay)
- [CVE-2024-11450](https://cve.now/CVE-2024-11450.md): ONLYOFFICE Docs \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ONLYOFFICE Docs)
- [CVE-2024-11276](https://cve.now/CVE-2024-11276.md): PDF Builder for WooCommerce. Create invoices,packing slips and more \<= 1.2.136 - Reflected Cross-Site Scripting (CVSS 6.1, edgarrojas PDF Builder for WooCommerce. Create invoices,pac…)
- [CVE-2024-11368](https://cve.now/CVE-2024-11368.md): Splash Sync \<= 2.0.7 - Reflected Cross-Site Scripting (CVSS 6.1, nanard33 Splash Sync)
- [CVE-2024-11336](https://cve.now/CVE-2024-11336.md): Clickbank WordPress Plugin (Storefront) \<= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, dactum Clickbank WordPress Plugin)
- [CVE-2024-12027](https://cve.now/CVE-2024-12027.md): Message Filter for Contact Form 7 \<= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions (CVSS 4.3, kofimokome Message Filter for Contact Form)
- [CVE-2024-11323](https://cve.now/CVE-2024-11323.md): AI Quiz | Quiz Maker \<= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, kekotron AI Quiz | Quiz Maker)
- [CVE-2024-9866](https://cve.now/CVE-2024-9866.md): Event Tickets with Ticket Scanner \<= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, sasonikolov Event Tickets with Ticket Scanner)
- [CVE-2024-9705](https://cve.now/CVE-2024-9705.md): Ultimate Coming Soon & Maintenance \<= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update (CVSS 4.3, rstheme2017 Ultimate Coming Soon & Maintenance)
- [CVE-2024-10849](https://cve.now/CVE-2024-10849.md): NewsMash \<= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, desertthemes NewsMash)
- [CVE-2024-11292](https://cve.now/CVE-2024-11292.md): WP Private Content Plus \<= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3, nimeshrmr WP Private Content Plus)
- [CVE-2024-11444](https://cve.now/CVE-2024-11444.md): CLUEVO LMS, E-Learning Platform \<= 1.13.2 - Cross-Site Request Forgery to Module Deletion (CVSS 4.3, CLUEVO LMS, E-Learning Platform)
- [CVE-2024-12060](https://cve.now/CVE-2024-12060.md): WP Media Optimizer (.webp) \<= 1.4.0 - Reflected Cross-Site Scripting via wpmowebp-css-resources and wpmowebp-js-resources Parameters (CVSS 6.1, francescosganga WP Media Optimizer)
- [CVE-2024-10879](https://cve.now/CVE-2024-10879.md): ForumWP – Forum & Discussion Board \<= 2.1.2 - Reflected Cross-Site Scripting (CVSS 6.1, ultimatemember ForumWP – Forum & Discussion Board)
- [CVE-2024-12003](https://cve.now/CVE-2024-12003.md): WP System \<= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, mikeyott WP System)
- [CVE-2024-11178](https://cve.now/CVE-2024-11178.md): Login With OTP \<= 1.4.2 - Authentication Bypass via Weak OTP (CVSS 8.1, india-web-developer Login with OTP)
- [CVE-2024-10551](https://cve.now/CVE-2024-10551.md): Sticky Social Icons \<= 1.2.1 - Admin+ Stored XSS (CVSS 4.8, Sticky Social Icons)
- [CVE-2024-10480](https://cve.now/CVE-2024-10480.md): 3DPrint Lite \< 2.1 - Settings Update via CSRF (CVSS 4.3, 3DPrint Lite)
- [CVE-2024-10578](https://cve.now/CVE-2024-10578.md): Pubnews \<= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8, blazethemes Pubnews)
- [CVE-2024-11585](https://cve.now/CVE-2024-11585.md): WP Hide & Security Enhancer \<= 2.5.1 - Missing Authorization to Unauthenticated Arbitrary File Contents Deletion (CVSS 7.5, nsp-code WP Hide & Security Enhancer)
- [CVE-2024-11201](https://cve.now/CVE-2024-11201.md): myCred – Loyalty Points and Rewards plugin \<= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred\_send Shortcode (CVSS 6.4, saadiqbal Points Management System For Gamification, Ranks,…)
- [CVE-2024-11379](https://cve.now/CVE-2024-11379.md): Broadcast \<= 51.01 - Reflected Cross-Site Scripting (CVSS 6.1, edward\_plainview Broadcast)
- [CVE-2024-10247](https://cve.now/CVE-2024-10247.md): YouTube Gallery and Vimeo Gallery Plugin \<= 2.4.2 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, totalsoft Video Gallery – YouTube Gallery, Vimeo, Video Por…)
- [CVE-2024-9769](https://cve.now/CVE-2024-9769.md): Video Gallery \<= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, totalsoft Video Gallery – YouTube Gallery, Vimeo, Video Por…)
- [CVE-2024-10836](https://cve.now/CVE-2024-10836.md): Flixita \<= 1.0.82 - Reflected Cross-Site Scripting via id Parameter (CVSS 6.1, themesdaddy Flixita)
- [CVE-2024-11149](https://cve.now/CVE-2024-11149.md): OpenBSD vmm GDTR limits (CVSS 6.2, OpenBSD)
- [CVE-2024-49041](https://cve.now/CVE-2024-49041.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2024-38921](https://cve.now/CVE-2024-38921.md): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2\_amcl proce (CVSS 9.8)
- [CVE-2024-38922](https://cve.now/CVE-2024-38922.md): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a heap overflow in the nav2\_amcl process. (CVSS 8.8)
- [CVE-2024-38923](https://cve.now/CVE-2024-38923.md): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2\_amcl proce (CVSS 9.1)
- [CVE-2024-38924](https://cve.now/CVE-2024-38924.md): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2\_amcl proce (CVSS 9.1)
- [CVE-2024-38925](https://cve.now/CVE-2024-38925.md): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2\_amcl proce (CVSS 9.1)
- [CVE-2024-38926](https://cve.now/CVE-2024-38926.md): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2\_amcl proce (CVSS 9.1)
- [CVE-2024-38927](https://cve.now/CVE-2024-38927.md): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2\_amcl proce (CVSS 9.1)
- [CVE-2024-41644](https://cve.now/CVE-2024-41644.md): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit (CVSS 9.8)
- [CVE-2024-41645](https://cve.now/CVE-2024-41645.md): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit (CVSS 9.8)
- [CVE-2024-41646](https://cve.now/CVE-2024-41646.md): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit (CVSS 9.8)
- [CVE-2024-41647](https://cve.now/CVE-2024-41647.md): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit (CVSS 9.8)
- [CVE-2024-41648](https://cve.now/CVE-2024-41648.md): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit (CVSS 7.1)
- [CVE-2024-41649](https://cve.now/CVE-2024-41649.md): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit (CVSS 9.8)
- [CVE-2024-41650](https://cve.now/CVE-2024-41650.md): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble allows an attacker to execute arbit (CVSS 7.1)
- [CVE-2024-44852](https://cve.now/CVE-2024-44852.md): Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a segmentation violation via the component thet (CVSS 7.5)
- [CVE-2024-44853](https://cve.now/CVE-2024-44853.md): Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component co (CVSS 7.5)
- [CVE-2024-44854](https://cve.now/CVE-2024-44854.md): Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component sm (CVSS 7.5)
- [CVE-2024-44855](https://cve.now/CVE-2024-44855.md): Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component na (CVSS 7.5)
- [CVE-2024-44856](https://cve.now/CVE-2024-44856.md): Open Robotics Robotic Operating System 2 ROS2 navigation2 v.humble was discovered to contain a NULL pointer dereference via the component na (CVSS 7.5)
- [CVE-2024-48703](https://cve.now/CVE-2024-48703.md): PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchda (CVSS 4.8)
- [CVE-2024-50677](https://cve.now/CVE-2024-50677.md): A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p (CVSS 6.1)
- [CVE-2024-53907](https://cve.now/CVE-2024-53907.md): An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. (CVSS 7.5, django)
- [CVE-2024-53908](https://cve.now/CVE-2024-53908.md): An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. (CVSS 9.8, django)
- [CVE-2024-54745](https://cve.now/CVE-2024-54745.md): WAVLINK WN701AE M01AE\_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in (CVSS 9.8)
- [CVE-2024-54747](https://cve.now/CVE-2024-54747.md): WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root (CVSS 9.8)
- [CVE-2024-54749](https://cve.now/CVE-2024-54749.md): Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root (CVSS 7.5)
- [CVE-2024-54750](https://cve.now/CVE-2024-54750.md): Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. (CVSS 9.8)
- [CVE-2024-55268](https://cve.now/CVE-2024-55268.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Manag (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.