# CVEs published 2024-12-27

283 CVEs were published on December 27, 2024: 17 critical, 111 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-56732](https://cve.now/CVE-2024-56732.md): HarfBuzz heap-buffer-overflow on hb\_cairo\_glyphs\_from\_buffer (CVSS 9.3, harfbuzz)
- [CVE-2024-12991](https://cve.now/CVE-2024-12991.md): Beijing Longda Jushang Technology DBShop商城系统 home-order cross site scripting (CVSS 5.3, Beijing Longda Jushang Technology DBShop商城系统)
- [CVE-2024-12990](https://cve.now/CVE-2024-12990.md): ruifang-tech Rebuild Admin Verification Page admin-verify redirect (CVSS 5.3, ruifang-tech Rebuild)
- [CVE-2024-12989](https://cve.now/CVE-2024-12989.md): WISI Tangram GT31 HTTP Request server-side request forgery (CVSS 6.9, WISI Tangram GT31)
- [CVE-2024-12988](https://cve.now/CVE-2024-12988.md): Netgear R6900P/R7000P HTTP Header sub\_16C4C buffer overflow (CVSS 6.9, Netgear R6900P · Netgear R7000P)
- [CVE-2024-12856](https://cve.now/CVE-2024-12856.md): Four-Faith Industrial Router adjust\_sys\_time OS Command Injection (CVSS 7.2, Four-Faith F3x24 · Four-Faith F3x36)
- [CVE-2024-12987](https://cve.now/CVE-2024-12987.md): DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection (CVSS 6.9, KEV, DrayTek Vigor2960 · DrayTek Vigor300B)
- [CVE-2024-56509](https://cve.now/CVE-2024-56509.md): changedetection.io has Improper Input Validation Leading to LFR/Path Traversal (CVSS 8.6, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2024-56508](https://cve.now/CVE-2024-56508.md): File Upload Vulnerability Leading to XSS in LinkAce v1.15.5 (CVSS 7.6, Kovah LinkAce)
- [CVE-2024-56507](https://cve.now/CVE-2024-56507.md): Reflected Cross-Site Scripting (XSS) Vulnerability in LinkAce (CVSS 4.6, Kovah LinkAce)
- [CVE-2024-12986](https://cve.now/CVE-2024-12986.md): DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection (CVSS 6.9, DrayTek Vigor2960 · DrayTek Vigor300B)
- [CVE-2024-56675](https://cve.now/CVE-2024-56675.md): bpf: Fix UAF via mismatching bpf\_prog/attachment RCU flavors (CVSS 7.8, Linux)
- [CVE-2024-56674](https://cve.now/CVE-2024-56674.md): virtio\_net: correct netdev\_tx\_reset\_queue() invocation point (CVSS 5.5, Linux)
- [CVE-2024-56673](https://cve.now/CVE-2024-56673.md): riscv: mm: Do not call pmd dtor on vmemmap page table teardown (CVSS 5.5, Linux)
- [CVE-2024-56672](https://cve.now/CVE-2024-56672.md): blk-cgroup: Fix UAF in blkcg\_unpin\_online() (CVSS 7.8, Linux)
- [CVE-2024-56671](https://cve.now/CVE-2024-56671.md): gpio: graniterapids: Fix vGPIO driver crash (CVSS 5.5, Linux)
- [CVE-2024-56670](https://cve.now/CVE-2024-56670.md): usb: gadget: u\_serial: Fix the issue that gs\_start\_io crashed due to accessing null pointer (CVSS 5.5, Linux)
- [CVE-2024-56669](https://cve.now/CVE-2024-56669.md): iommu/vt-d: Remove cache tags before disabling ATS (CVSS 8.8, Linux)
- [CVE-2024-56668](https://cve.now/CVE-2024-56668.md): iommu/vt-d: Fix qi\_batch NULL pointer with nested parent domain (CVSS 5.5, Linux)
- [CVE-2024-56667](https://cve.now/CVE-2024-56667.md): drm/i915: Fix NULL pointer dereference in capture\_engine (CVSS 5.5, Linux)
- [CVE-2024-56666](https://cve.now/CVE-2024-56666.md): drm/amdkfd: Dereference null return value (CVSS 5.5, Linux)
- [CVE-2024-56665](https://cve.now/CVE-2024-56665.md): bpf,perf: Fix invalid prog\_array access in perf\_event\_detach\_bpf\_prog (CVSS 5.5, Linux)
- [CVE-2024-56664](https://cve.now/CVE-2024-56664.md): bpf, sockmap: Fix race between element replace and close() (CVSS 7.8, Linux)
- [CVE-2024-56663](https://cve.now/CVE-2024-56663.md): wifi: nl80211: fix NL80211\_ATTR\_MLO\_LINK\_ID off-by-one (CVSS 7.8, Linux)
- [CVE-2024-56662](https://cve.now/CVE-2024-56662.md): acpi: nfit: vmalloc-out-of-bounds Read in acpi\_nfit\_ctl (CVSS 7.8, Linux)
- [CVE-2024-56661](https://cve.now/CVE-2024-56661.md): tipc: fix NULL deref in cleanup\_bearer() (CVSS 5.5, Linux)
- [CVE-2024-56660](https://cve.now/CVE-2024-56660.md): net/mlx5: DR, prevent potential error pointer dereference (CVSS 5.5, Linux)
- [CVE-2024-56659](https://cve.now/CVE-2024-56659.md): net: lapb: increase LAPB\_HEADER\_LEN (CVSS 5.5, Linux)
- [CVE-2024-56658](https://cve.now/CVE-2024-56658.md): net: defer final 'struct net' free in netns dismantle (CVSS 7.8, Linux)
- [CVE-2024-56657](https://cve.now/CVE-2024-56657.md): ALSA: control: Avoid WARN() for symlink errors (CVSS 5.5, Linux)
- [CVE-2024-56656](https://cve.now/CVE-2024-56656.md): bnxt\_en: Fix aggregation ID mask to prevent oops on 5760X chips (CVSS 9.8, Linux)
- [CVE-2024-56655](https://cve.now/CVE-2024-56655.md): netfilter: nf\_tables: do not defer rule destruction via call\_rcu (CVSS 7.8, Linux)
- [CVE-2024-56654](https://cve.now/CVE-2024-56654.md): Bluetooth: hci\_event: Fix using rcu\_read\_(un)lock while iterating (CVSS 7.8, Linux)
- [CVE-2024-56653](https://cve.now/CVE-2024-56653.md): Bluetooth: btmtk: avoid UAF in btmtk\_process\_coredump (CVSS 8.8, Linux)
- [CVE-2024-56652](https://cve.now/CVE-2024-56652.md): drm/xe/reg\_sr: Remove register pool (CVSS 7.8, Linux)
- [CVE-2024-56651](https://cve.now/CVE-2024-56651.md): can: hi311x: hi3110\_can\_ist(): fix potential use-after-free (CVSS 8.8, Linux)
- [CVE-2024-56650](https://cve.now/CVE-2024-56650.md): netfilter: x\_tables: fix LED ID check in led\_tg\_check() (CVSS 7.1, Linux)
- [CVE-2024-56649](https://cve.now/CVE-2024-56649.md): net: enetc: Do not configure preemptible TCs if SIs do not support (CVSS 5.5, Linux)
- [CVE-2024-56648](https://cve.now/CVE-2024-56648.md): net: hsr: avoid potential out-of-bound access in fill\_frame\_info() (CVSS 5.5, Linux)
- [CVE-2024-56647](https://cve.now/CVE-2024-56647.md): net: Fix icmp host relookup triggering ip\_rt\_bug (CVSS 5.5, Linux)
- [CVE-2024-56646](https://cve.now/CVE-2024-56646.md): ipv6: avoid possible NULL deref in modify\_prefix\_route() (CVSS 5.5, Linux)
- [CVE-2024-56645](https://cve.now/CVE-2024-56645.md): can: j1939: j1939\_session\_new(): fix skb reference counting (CVSS 9.8, Linux)
- [CVE-2024-56644](https://cve.now/CVE-2024-56644.md): net/ipv6: release expired exception dst cached in socket (CVSS 7.5, Linux)
- [CVE-2024-56643](https://cve.now/CVE-2024-56643.md): dccp: Fix memory leak in dccp\_feat\_change\_recv (CVSS 3.3, Linux)
- [CVE-2024-56642](https://cve.now/CVE-2024-56642.md): tipc: Fix use-after-free of kernel socket in cleanup\_bearer(). (CVSS 7.8, Linux)
- [CVE-2024-56641](https://cve.now/CVE-2024-56641.md): net/smc: initialize close\_work early to avoid warning (CVSS 7.5, Linux)
- [CVE-2024-56640](https://cve.now/CVE-2024-56640.md): net/smc: fix LGR and link use-after-free issue (CVSS 9.8, Linux)
- [CVE-2024-56639](https://cve.now/CVE-2024-56639.md): net: hsr: must allocate more bytes for RedBox support (no CVSS, Linux)
- [CVE-2024-56638](https://cve.now/CVE-2024-56638.md): netfilter: nft\_inner: incorrect percpu area handling under softirq (no CVSS, Linux)
- [CVE-2024-56637](https://cve.now/CVE-2024-56637.md): netfilter: ipset: Hold module reference while requesting a module (CVSS 7.3, Linux)
- [CVE-2024-56636](https://cve.now/CVE-2024-56636.md): geneve: do not assume mac header is set in geneve\_xmit\_skb() (no CVSS, Linux)
- [CVE-2024-56635](https://cve.now/CVE-2024-56635.md): net: avoid potential UAF in default\_operstate() (CVSS 7.8, Linux)
- [CVE-2024-56634](https://cve.now/CVE-2024-56634.md): gpio: grgpio: Add NULL check in grgpio\_probe (CVSS 5.5, Linux)
- [CVE-2024-56633](https://cve.now/CVE-2024-56633.md): tcp\_bpf: Fix the sk\_mem\_uncharge logic in tcp\_bpf\_sendmsg (no CVSS, Linux)
- [CVE-2024-56632](https://cve.now/CVE-2024-56632.md): nvme-tcp: fix the memleak while create new ctrl failed (CVSS 7.5, Linux)
- [CVE-2024-56631](https://cve.now/CVE-2024-56631.md): scsi: sg: Fix slab-use-after-free read in sg\_release() (CVSS 7.8, Linux)
- [CVE-2024-12985](https://cve.now/CVE-2024-12985.md): Overtek OT-E801G passwd os command injection (CVSS 5.3, Overtek OT-E801G)
- [CVE-2024-56630](https://cve.now/CVE-2024-56630.md): ocfs2: free inode when ocfs2\_get\_init\_inode() fails (no CVSS, Linux)
- [CVE-2024-56629](https://cve.now/CVE-2024-56629.md): HID: wacom: fix when get product name maybe null pointer (CVSS 5.5, Linux)
- [CVE-2024-56628](https://cve.now/CVE-2024-56628.md): LoongArch: Add architecture specific huge\_pte\_clear() (CVSS 7.8, Linux)
- [CVE-2024-56627](https://cve.now/CVE-2024-56627.md): ksmbd: fix Out-of-Bounds Read in ksmbd\_vfs\_stream\_read (CVSS 8.1, Linux)
- [CVE-2024-56626](https://cve.now/CVE-2024-56626.md): ksmbd: fix Out-of-Bounds Write in ksmbd\_vfs\_stream\_write (CVSS 8.8, Linux)
- [CVE-2024-56625](https://cve.now/CVE-2024-56625.md): can: dev: can\_set\_termination(): allow sleeping GPIOs (no CVSS, Linux)
- [CVE-2024-56624](https://cve.now/CVE-2024-56624.md): iommufd: Fix out\_fput in iommufd\_fault\_alloc() (CVSS 7.8, Linux)
- [CVE-2024-56623](https://cve.now/CVE-2024-56623.md): scsi: qla2xxx: Fix use after free on unload (CVSS 7.8, Linux)
- [CVE-2024-56622](https://cve.now/CVE-2024-56622.md): scsi: ufs: core: sysfs: Prevent div by zero (CVSS 5.5, Linux)
- [CVE-2024-56621](https://cve.now/CVE-2024-56621.md): scsi: ufs: core: Cancel RTC work during ufshcd\_remove() (no CVSS, Linux)
- [CVE-2024-56620](https://cve.now/CVE-2024-56620.md): scsi: ufs: qcom: Only free platform MSIs when ESI is enabled (no CVSS, Linux)
- [CVE-2024-56619](https://cve.now/CVE-2024-56619.md): nilfs2: fix potential out-of-bounds memory access in nilfs\_find\_entry() (CVSS 7.8, Linux)
- [CVE-2024-56618](https://cve.now/CVE-2024-56618.md): pmdomain: imx: gpcv2: Adjust delay after power up handshake (CVSS 5.5, Linux)
- [CVE-2024-56617](https://cve.now/CVE-2024-56617.md): cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU (CVSS 5.5, Linux)
- [CVE-2024-56616](https://cve.now/CVE-2024-56616.md): drm/dp\_mst: Fix MST sideband message body length check (no CVSS, Linux)
- [CVE-2024-56615](https://cve.now/CVE-2024-56615.md): bpf: fix OOB devmap writes when deleting elements (CVSS 7.8, Linux)
- [CVE-2024-56614](https://cve.now/CVE-2024-56614.md): xsk: fix OOB map writes when deleting elements (CVSS 7.8, Linux)
- [CVE-2024-56613](https://cve.now/CVE-2024-56613.md): sched/numa: fix memory leak due to the overwritten vma-\>numab\_state (CVSS 5.5, Linux)
- [CVE-2024-56612](https://cve.now/CVE-2024-56612.md): mm/gup: handle NULL pages in unpin\_user\_pages() (CVSS 5.5, Linux)
- [CVE-2024-56611](https://cve.now/CVE-2024-56611.md): mm/mempolicy: fix migrate\_to\_node() assuming there is at least one VMA in a MM (CVSS 5.5, Linux)
- [CVE-2024-56610](https://cve.now/CVE-2024-56610.md): kcsan: Turn report\_filterlist\_lock into a raw\_spinlock (no CVSS, Linux)
- [CVE-2024-56609](https://cve.now/CVE-2024-56609.md): wifi: rtw88: use ieee80211\_purge\_tx\_queue() to purge TX skb (no CVSS, Linux)
- [CVE-2024-56608](https://cve.now/CVE-2024-56608.md): drm/amd/display: Fix out-of-bounds access in 'dcn21\_link\_encoder\_create' (CVSS 7.8, Linux)
- [CVE-2024-56607](https://cve.now/CVE-2024-56607.md): wifi: ath12k: fix atomic calls in ath12k\_mac\_op\_set\_bitrate\_mask() (no CVSS, Linux)
- [CVE-2024-56606](https://cve.now/CVE-2024-56606.md): af\_packet: avoid erroring out after sock\_init\_data() in packet\_create() (CVSS 7.8, Linux)
- [CVE-2024-56605](https://cve.now/CVE-2024-56605.md): Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap\_sock\_create() (CVSS 7.8, Linux)
- [CVE-2024-56604](https://cve.now/CVE-2024-56604.md): Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm\_sock\_alloc() (CVSS 7.8, Linux)
- [CVE-2024-56603](https://cve.now/CVE-2024-56603.md): net: af\_can: do not leave a dangling sk pointer in can\_create() (CVSS 7.8, Linux)
- [CVE-2024-56602](https://cve.now/CVE-2024-56602.md): net: ieee802154: do not leave a dangling sk pointer in ieee802154\_create() (CVSS 7.0, Linux)
- [CVE-2024-56601](https://cve.now/CVE-2024-56601.md): net: inet: do not leave a dangling sk pointer in inet\_create() (CVSS 7.8, Linux)
- [CVE-2024-56600](https://cve.now/CVE-2024-56600.md): net: inet6: do not leave a dangling sk pointer in inet6\_create() (CVSS 7.8, Linux)
- [CVE-2024-56599](https://cve.now/CVE-2024-56599.md): wifi: ath10k: avoid NULL pointer error during sdio remove (no CVSS, Linux)
- [CVE-2024-56598](https://cve.now/CVE-2024-56598.md): jfs: array-index-out-of-bounds fix in dtReadFirst (CVSS 7.1, Linux)
- [CVE-2024-56597](https://cve.now/CVE-2024-56597.md): jfs: fix shift-out-of-bounds in dbSplit (CVSS 7.8, Linux)
- [CVE-2024-56596](https://cve.now/CVE-2024-56596.md): jfs: fix array-index-out-of-bounds in jfs\_readdir (CVSS 7.8, Linux)
- [CVE-2024-56595](https://cve.now/CVE-2024-56595.md): jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree (CVSS 7.8, Linux)
- [CVE-2024-56594](https://cve.now/CVE-2024-56594.md): drm/amdgpu: set the right AMDGPU sg segment limitation (no CVSS, Linux)
- [CVE-2024-56593](https://cve.now/CVE-2024-56593.md): wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf\_sdiod\_sglist\_rw() (CVSS 5.5, Linux)
- [CVE-2024-56592](https://cve.now/CVE-2024-56592.md): bpf: Call free\_htab\_elem() after htab\_unlock\_bucket() (no CVSS, Linux)
- [CVE-2024-56591](https://cve.now/CVE-2024-56591.md): Bluetooth: hci\_conn: Use disable\_delayed\_work\_sync (CVSS 8.8, Linux)
- [CVE-2024-56590](https://cve.now/CVE-2024-56590.md): Bluetooth: hci\_core: Fix not checking skb length on hci\_acldata\_packet (CVSS 7.6, Linux)
- [CVE-2024-56589](https://cve.now/CVE-2024-56589.md): scsi: hisi\_sas: Add cond\_resched() for no forced preemption model (no CVSS, Linux)
- [CVE-2024-56588](https://cve.now/CVE-2024-56588.md): scsi: hisi\_sas: Create all dump files during debugfs initialization (no CVSS, Linux)
- [CVE-2024-56587](https://cve.now/CVE-2024-56587.md): leds: class: Protect brightness\_show() with led\_cdev-\>led\_access mutex (CVSS 5.5, Linux)
- [CVE-2024-56586](https://cve.now/CVE-2024-56586.md): f2fs: fix f2fs\_bug\_on when uninstalling filesystem call f2fs\_evict\_inode. (no CVSS, Linux)
- [CVE-2024-56585](https://cve.now/CVE-2024-56585.md): LoongArch: Fix sleeping in atomic context for PREEMPT\_RT (no CVSS, Linux)
- [CVE-2024-56584](https://cve.now/CVE-2024-56584.md): io\_uring/tctx: work around xa\_store() allocation error issue (no CVSS, Linux)
- [CVE-2024-56583](https://cve.now/CVE-2024-56583.md): sched/deadline: Fix warning in migrate\_enable for boosted tasks (no CVSS, Linux)
- [CVE-2024-12984](https://cve.now/CVE-2024-12984.md): Amcrest IP2M-841B Web Interface webCapsConfig information disclosure (CVSS 6.9, Amcrest IP2M-841B · Amcrest IP2M-841W +5)
- [CVE-2024-56582](https://cve.now/CVE-2024-56582.md): btrfs: fix use-after-free in btrfs\_encoded\_read\_endio() (CVSS 7.8, Linux)
- [CVE-2024-56581](https://cve.now/CVE-2024-56581.md): btrfs: ref-verify: fix use-after-free after invalid ref action (CVSS 7.0, Linux)
- [CVE-2024-56580](https://cve.now/CVE-2024-56580.md): media: qcom: camss: fix error path on configuration of power domains (CVSS 5.5, Linux)
- [CVE-2024-56579](https://cve.now/CVE-2024-56579.md): media: amphion: Set video drvdata before register video device (CVSS 5.5, Linux)
- [CVE-2024-56578](https://cve.now/CVE-2024-56578.md): media: imx-jpeg: Set video drvdata before register video device (CVSS 5.5, Linux)
- [CVE-2024-56577](https://cve.now/CVE-2024-56577.md): media: mtk-jpeg: Fix null-ptr-deref during unload module (CVSS 5.5, Linux)
- [CVE-2024-56576](https://cve.now/CVE-2024-56576.md): media: i2c: tc358743: Fix crash in the probe error path when using polling (CVSS 7.8, Linux)
- [CVE-2024-56575](https://cve.now/CVE-2024-56575.md): media: imx-jpeg: Ensure power suppliers be suspended before detach them (CVSS 5.5, Linux)
- [CVE-2024-56574](https://cve.now/CVE-2024-56574.md): media: ts2020: fix null-ptr-deref in ts2020\_probe() (CVSS 5.5, Linux)
- [CVE-2024-56573](https://cve.now/CVE-2024-56573.md): efi/libstub: Free correct pointer on failure (CVSS 7.0, Linux)
- [CVE-2024-56572](https://cve.now/CVE-2024-56572.md): media: platform: allegro-dvt: Fix possible memory leak in allocate\_buffers\_internal() (CVSS 3.3, Linux)
- [CVE-2024-56570](https://cve.now/CVE-2024-56570.md): ovl: Filter invalid inodes with missing lookup function (no CVSS, Linux)
- [CVE-2024-56569](https://cve.now/CVE-2024-56569.md): ftrace: Fix regression with module command in stack\_trace\_filter (CVSS 5.5, Linux)
- [CVE-2024-56568](https://cve.now/CVE-2024-56568.md): iommu/arm-smmu: Defer probe of clients after smmu device bound (CVSS 4.7, Linux)
- [CVE-2024-56567](https://cve.now/CVE-2024-56567.md): ad7780: fix division by zero in ad7780\_write\_raw() (CVSS 5.5, Linux)
- [CVE-2024-56566](https://cve.now/CVE-2024-56566.md): mm/slub: Avoid list corruption when removing a slab from the full list (no CVSS, Linux)
- [CVE-2024-56565](https://cve.now/CVE-2024-56565.md): f2fs: fix to drop all discards after creating snapshot on lvm device (no CVSS, Linux)
- [CVE-2024-56564](https://cve.now/CVE-2024-56564.md): ceph: pass cred pointer to ceph\_mds\_auth\_match() (no CVSS, Linux)
- [CVE-2024-56563](https://cve.now/CVE-2024-56563.md): ceph: fix cred leak in ceph\_mds\_check\_access() (CVSS 7.8, Linux)
- [CVE-2024-56562](https://cve.now/CVE-2024-56562.md): i3c: master: Fix miss free init\_dyn\_addr at i3c\_master\_put\_i3c\_addrs() (no CVSS, Linux)
- [CVE-2024-56561](https://cve.now/CVE-2024-56561.md): PCI: endpoint: Fix PCI domain ID release in pci\_epc\_destroy() (CVSS 7.8, Linux)
- [CVE-2024-56560](https://cve.now/CVE-2024-56560.md): slab: Fix too strict alignment check in create\_cache() (no CVSS, Linux)
- [CVE-2024-56559](https://cve.now/CVE-2024-56559.md): mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation (no CVSS, Linux)
- [CVE-2024-56558](https://cve.now/CVE-2024-56558.md): nfsd: make sure exp active before svc\_export\_show (CVSS 7.8, Linux)
- [CVE-2024-56557](https://cve.now/CVE-2024-56557.md): iio: adc: ad7923: Fix buffer overflow for tx\_buf and ring\_xfer (CVSS 7.8, Linux)
- [CVE-2024-56556](https://cve.now/CVE-2024-56556.md): binder: fix node UAF in binder\_add\_freeze\_work() (CVSS 7.8, Linux)
- [CVE-2024-56555](https://cve.now/CVE-2024-56555.md): binder: fix OOB in binder\_add\_freeze\_work() (CVSS 7.8, Linux)
- [CVE-2024-56554](https://cve.now/CVE-2024-56554.md): binder: fix freeze UAF in binder\_release\_work() (CVSS 7.8, Linux)
- [CVE-2024-56553](https://cve.now/CVE-2024-56553.md): binder: fix memleak of proc-\>delivered\_freeze (CVSS 3.3, Linux)
- [CVE-2024-56552](https://cve.now/CVE-2024-56552.md): drm/xe/guc\_submit: fix race around suspend\_pending (CVSS 7.8, Linux)
- [CVE-2024-56551](https://cve.now/CVE-2024-56551.md): drm/amdgpu: fix usage slab after free (CVSS 7.8, Linux)
- [CVE-2024-56550](https://cve.now/CVE-2024-56550.md): s390/stacktrace: Use break instead of return statement (no CVSS, Linux)
- [CVE-2024-56549](https://cve.now/CVE-2024-56549.md): cachefiles: Fix NULL pointer dereference in object-\>file (CVSS 7.8, Linux)
- [CVE-2024-56548](https://cve.now/CVE-2024-56548.md): hfsplus: don't query the device logical block size multiple times (CVSS 7.8, Linux)
- [CVE-2024-56547](https://cve.now/CVE-2024-56547.md): rcu/nocb: Fix missed RCU barrier on deoffloading (no CVSS, Linux)
- [CVE-2024-56546](https://cve.now/CVE-2024-56546.md): drivers: soc: xilinx: add the missing kfree in xlnx\_add\_cb\_for\_suspend() (no CVSS, Linux)
- [CVE-2024-56545](https://cve.now/CVE-2024-56545.md): HID: hyperv: streamline driver probe to avoid devres issues (no CVSS, Linux)
- [CVE-2024-56544](https://cve.now/CVE-2024-56544.md): udmabuf: change folios array from kmalloc to kvmalloc (CVSS 5.5, Linux)
- [CVE-2024-56543](https://cve.now/CVE-2024-56543.md): wifi: ath12k: Skip Rx TID cleanup for self peer (no CVSS, Linux)
- [CVE-2024-56542](https://cve.now/CVE-2024-56542.md): drm/amd/display: fix a memleak issue when driver is removed (CVSS 5.5, Linux)
- [CVE-2024-56541](https://cve.now/CVE-2024-56541.md): wifi: ath12k: fix use-after-free in ath12k\_dp\_cc\_cleanup() (CVSS 7.8, Linux)
- [CVE-2024-56540](https://cve.now/CVE-2024-56540.md): accel/ivpu: Prevent recovery invocation during probe and resume (CVSS 7.8, Linux)
- [CVE-2024-56539](https://cve.now/CVE-2024-56539.md): wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex\_config\_scan() (no CVSS, Linux)
- [CVE-2024-56538](https://cve.now/CVE-2024-56538.md): drm: zynqmp\_kms: Unplug DRM device before removal (CVSS 7.8, Linux)
- [CVE-2024-56537](https://cve.now/CVE-2024-56537.md): drm: xlnx: zynqmp\_disp: layer may be null while releasing (CVSS 5.5, Linux)
- [CVE-2024-56536](https://cve.now/CVE-2024-56536.md): wifi: cw1200: Fix potential NULL dereference (CVSS 5.5, Linux)
- [CVE-2024-56535](https://cve.now/CVE-2024-56535.md): wifi: rtw89: coex: check NULL return of kmalloc in btc\_fw\_set\_monreg() (CVSS 5.5, Linux)
- [CVE-2024-56534](https://cve.now/CVE-2024-56534.md): isofs: avoid memory leak in iocharset (CVSS 5.5, Linux)
- [CVE-2024-56533](https://cve.now/CVE-2024-56533.md): ALSA: usx2y: Use snd\_card\_free\_when\_closed() at disconnection (CVSS 5.5, Linux)
- [CVE-2024-56532](https://cve.now/CVE-2024-56532.md): ALSA: us122l: Use snd\_card\_free\_when\_closed() at disconnection (CVSS 5.5, Linux)
- [CVE-2024-56531](https://cve.now/CVE-2024-56531.md): ALSA: caiaq: Use snd\_card\_free\_when\_closed() at disconnection (CVSS 7.8, Linux)
- [CVE-2024-53239](https://cve.now/CVE-2024-53239.md): ALSA: 6fire: Release resources at card release (CVSS 7.8, Linux)
- [CVE-2024-53238](https://cve.now/CVE-2024-53238.md): Bluetooth: btmtk: adjust the position to init iso data anchor (CVSS 5.5, Linux)
- [CVE-2024-53237](https://cve.now/CVE-2024-53237.md): Bluetooth: fix use-after-free in device\_for\_each\_child() (CVSS 8.8, Linux)
- [CVE-2024-53236](https://cve.now/CVE-2024-53236.md): xsk: Free skb when TX metadata options are invalid (no CVSS, Linux)
- [CVE-2024-53235](https://cve.now/CVE-2024-53235.md): erofs: fix file-backed mounts over FUSE (CVSS 5.5, Linux)
- [CVE-2024-53234](https://cve.now/CVE-2024-53234.md): erofs: handle NONHEAD !delta\[1\] lclusters gracefully (no CVSS, Linux)
- [CVE-2024-53233](https://cve.now/CVE-2024-53233.md): unicode: Fix utf8\_load() error path (CVSS 5.5, Linux)
- [CVE-2024-53232](https://cve.now/CVE-2024-53232.md): iommu/s390: Implement blocking domain (CVSS 7.8, Linux)
- [CVE-2024-53231](https://cve.now/CVE-2024-53231.md): cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq\_cpu\_get\_raw() (CVSS 5.5, Linux)
- [CVE-2024-53230](https://cve.now/CVE-2024-53230.md): cpufreq: CPPC: Fix possible null-ptr-deref for cppc\_get\_cpu\_cost() (CVSS 5.5, Linux)
- [CVE-2024-53229](https://cve.now/CVE-2024-53229.md): RDMA/rxe: Fix the qp flush warnings in req (no CVSS, Linux)
- [CVE-2024-53228](https://cve.now/CVE-2024-53228.md): riscv: kvm: Fix out-of-bounds array access (CVSS 7.8, Linux)
- [CVE-2024-53227](https://cve.now/CVE-2024-53227.md): scsi: bfa: Fix use-after-free in bfad\_im\_module\_exit() (CVSS 7.8, Linux)
- [CVE-2024-53226](https://cve.now/CVE-2024-53226.md): RDMA/hns: Fix NULL pointer derefernce in hns\_roce\_map\_mr\_sg() (CVSS 7.5, Linux)
- [CVE-2024-53225](https://cve.now/CVE-2024-53225.md): iommu/tegra241-cmdqv: Fix alignment failure at max\_n\_shift (CVSS 5.5, Linux)
- [CVE-2024-53224](https://cve.now/CVE-2024-53224.md): RDMA/mlx5: Move events notifier registration to be after device registration (CVSS 8.8, Linux)
- [CVE-2024-53223](https://cve.now/CVE-2024-53223.md): clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs (no CVSS, Linux)
- [CVE-2024-53222](https://cve.now/CVE-2024-53222.md): zram: fix NULL pointer in comp\_algorithm\_show() (no CVSS, Linux)
- [CVE-2024-53221](https://cve.now/CVE-2024-53221.md): f2fs: fix null-ptr-deref in f2fs\_submit\_page\_bio() (no CVSS, Linux)
- [CVE-2024-53220](https://cve.now/CVE-2024-53220.md): f2fs: fix to account dirty data in \_\_get\_secs\_required() (CVSS 7.8, Linux)
- [CVE-2024-53219](https://cve.now/CVE-2024-53219.md): virtiofs: use pages instead of pointer for kernel direct IO (CVSS 5.5, Linux)
- [CVE-2024-53218](https://cve.now/CVE-2024-53218.md): f2fs: fix race in concurrent f2fs\_stop\_gc\_thread (CVSS 7.8, Linux)
- [CVE-2024-53217](https://cve.now/CVE-2024-53217.md): NFSD: Prevent NULL dereference in nfsd4\_process\_cb\_update() (CVSS 7.5, Linux)
- [CVE-2024-53216](https://cve.now/CVE-2024-53216.md): nfsd: release svc\_expkey/svc\_export with rcu\_work (CVSS 7.8, Linux)
- [CVE-2024-53215](https://cve.now/CVE-2024-53215.md): svcrdma: fix miss destroy percpu\_counter in svc\_rdma\_proc\_init() (CVSS 5.5, Linux)
- [CVE-2024-53214](https://cve.now/CVE-2024-53214.md): vfio/pci: Properly hide first-in-list PCIe extended capability (CVSS 7.8, Linux)
- [CVE-2024-53213](https://cve.now/CVE-2024-53213.md): net: usb: lan78xx: Fix double free issue with interrupt buffer allocation (CVSS 7.8, Linux)
- [CVE-2024-53212](https://cve.now/CVE-2024-53212.md): netlink: fix false positive warning in extack during dumps (no CVSS, Linux)
- [CVE-2024-53211](https://cve.now/CVE-2024-53211.md): net/l2tp: fix warning in l2tp\_exit\_net found by syzbot (no CVSS, Linux)
- [CVE-2024-53210](https://cve.now/CVE-2024-53210.md): s390/iucv: MSG\_PEEK causes memory leak in iucv\_sock\_destruct() (CVSS 5.5, Linux)
- [CVE-2024-53209](https://cve.now/CVE-2024-53209.md): bnxt\_en: Fix receive ring space parameters when XDP is active (CVSS 9.8, Linux)
- [CVE-2024-53208](https://cve.now/CVE-2024-53208.md): Bluetooth: MGMT: Fix slab-use-after-free Read in set\_powered\_sync (CVSS 7.8, Linux)
- [CVE-2024-53207](https://cve.now/CVE-2024-53207.md): Bluetooth: MGMT: Fix possible deadlocks (CVSS 7.8, Linux)
- [CVE-2024-53206](https://cve.now/CVE-2024-53206.md): tcp: Fix use-after-free of nreq in reqsk\_timer\_handler(). (CVSS 9.8, Linux)
- [CVE-2024-53205](https://cve.now/CVE-2024-53205.md): phy: realtek: usb: fix NULL deref in rtk\_usb2phy\_probe (no CVSS, Linux)
- [CVE-2024-53204](https://cve.now/CVE-2024-53204.md): phy: realtek: usb: fix NULL deref in rtk\_usb3phy\_probe (no CVSS, Linux)
- [CVE-2024-53203](https://cve.now/CVE-2024-53203.md): usb: typec: fix potential array underflow in ucsi\_ccg\_sync\_control() (no CVSS, Linux)
- [CVE-2024-53202](https://cve.now/CVE-2024-53202.md): firmware\_loader: Fix possible resource leak in fw\_log\_firmware\_info() (CVSS 5.5, Linux)
- [CVE-2024-53201](https://cve.now/CVE-2024-53201.md): drm/amd/display: Fix null check for pipe\_ctx-\>plane\_state in dcn20\_program\_pipe (CVSS 5.5, Linux)
- [CVE-2024-53200](https://cve.now/CVE-2024-53200.md): drm/amd/display: Fix null check for pipe\_ctx-\>plane\_state in hwss\_setup\_dpp (CVSS 5.5, Linux)
- [CVE-2024-53199](https://cve.now/CVE-2024-53199.md): ASoC: imx-audmix: Add NULL check in imx\_audmix\_probe (CVSS 5.5, Linux)
- [CVE-2024-53198](https://cve.now/CVE-2024-53198.md): xen: Fix the issue of resource not being properly released in xenbus\_dev\_probe() (CVSS 7.8, Linux)
- [CVE-2024-53197](https://cve.now/CVE-2024-53197.md): ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (CVSS 7.8, KEV, Linux)
- [CVE-2024-53196](https://cve.now/CVE-2024-53196.md): KVM: arm64: Don't retire aborted MMIO instruction (no CVSS, Linux)
- [CVE-2024-53195](https://cve.now/CVE-2024-53195.md): KVM: arm64: Get rid of userspace\_irqchip\_in\_use (no CVSS, Linux)
- [CVE-2024-53194](https://cve.now/CVE-2024-53194.md): PCI: Fix use-after-free of slot-\>bus on hot remove (CVSS 7.8, Linux)
- [CVE-2024-53193](https://cve.now/CVE-2024-53193.md): clk: clk-loongson2: Fix memory corruption bug in struct loongson2\_clk\_provider (CVSS 7.8, Linux)
- [CVE-2024-53192](https://cve.now/CVE-2024-53192.md): clk: clk-loongson2: Fix potential buffer overflow in flexible-array member access (CVSS 7.8, Linux)
- [CVE-2024-53191](https://cve.now/CVE-2024-53191.md): wifi: ath12k: fix warning when unbinding (CVSS 7.8, Linux)
- [CVE-2024-53190](https://cve.now/CVE-2024-53190.md): wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (CVSS 5.5, Linux)
- [CVE-2024-53189](https://cve.now/CVE-2024-53189.md): wifi: nl80211: fix bounds checker error in nl80211\_parse\_sched\_scan (no CVSS, Linux)
- [CVE-2024-53188](https://cve.now/CVE-2024-53188.md): wifi: ath12k: fix crash when unbinding (CVSS 7.8, Linux)
- [CVE-2024-53187](https://cve.now/CVE-2024-53187.md): io\_uring: check for overflows in io\_pin\_pages (CVSS 5.5, Linux)
- [CVE-2024-53186](https://cve.now/CVE-2024-53186.md): ksmbd: fix use-after-free in SMB request handling (CVSS 9.8, Linux)
- [CVE-2024-53185](https://cve.now/CVE-2024-53185.md): smb: client: fix NULL ptr deref in crypto\_aead\_setkey() (CVSS 7.5, Linux)
- [CVE-2024-53184](https://cve.now/CVE-2024-53184.md): um: ubd: Do not use drvdata in release (no CVSS, Linux)
- [CVE-2024-53183](https://cve.now/CVE-2024-53183.md): um: net: Do not use drvdata in release (no CVSS, Linux)
- [CVE-2024-53182](https://cve.now/CVE-2024-53182.md): Revert "block, bfq: merge bfq\_release\_process\_ref() into bfq\_put\_cooperator()" (CVSS 7.8, Linux)
- [CVE-2024-53181](https://cve.now/CVE-2024-53181.md): um: vector: Do not use drvdata in release (no CVSS, Linux)
- [CVE-2024-53180](https://cve.now/CVE-2024-53180.md): ALSA: pcm: Add sanity NULL check for the default mmap fault handler (CVSS 5.5, Linux)
- [CVE-2024-53179](https://cve.now/CVE-2024-53179.md): smb: client: fix use-after-free of signing key (CVSS 9.8, Linux)
- [CVE-2024-53178](https://cve.now/CVE-2024-53178.md): smb: Don't leak cfid when reconnect races with open\_cached\_dir (CVSS 7.5, Linux)
- [CVE-2024-53177](https://cve.now/CVE-2024-53177.md): smb: prevent use-after-free due to open\_cached\_dir error paths (CVSS 9.8, Linux)
- [CVE-2024-53176](https://cve.now/CVE-2024-53176.md): smb: During unmount, ensure all cached dir instances drop their dentry (CVSS 9.8, Linux)
- [CVE-2024-53175](https://cve.now/CVE-2024-53175.md): ipc: fix memleak if msg\_init\_ns failed in create\_ipc\_ns (CVSS 5.5, Linux)
- [CVE-2024-53174](https://cve.now/CVE-2024-53174.md): SUNRPC: make sure cache entry active before cache\_show (CVSS 7.8, Linux)
- [CVE-2024-53173](https://cve.now/CVE-2024-53173.md): NFSv4.0: Fix a use-after-free problem in the asynchronous open() (CVSS 7.8, Linux)
- [CVE-2024-53172](https://cve.now/CVE-2024-53172.md): ubi: fastmap: Fix duplicate slab cache names while attaching (no CVSS, Linux)
- [CVE-2024-53171](https://cve.now/CVE-2024-53171.md): ubifs: authentication: Fix use-after-free in ubifs\_tnc\_end\_commit (CVSS 7.8, Linux)
- [CVE-2024-53170](https://cve.now/CVE-2024-53170.md): block: fix uaf for flush rq while iterating tags (CVSS 7.8, Linux)
- [CVE-2024-53169](https://cve.now/CVE-2024-53169.md): nvme-fabrics: fix kernel crash while shutting down controller (CVSS 9.8, Linux)
- [CVE-2024-53168](https://cve.now/CVE-2024-53168.md): sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (CVSS 7.8, Linux)
- [CVE-2024-53167](https://cve.now/CVE-2024-53167.md): nfs/blocklayout: Don't attempt unregister for invalid block device (CVSS 7.5, Linux)
- [CVE-2024-53166](https://cve.now/CVE-2024-53166.md): block, bfq: fix bfqq uaf in bfq\_limit\_depth() (CVSS 7.8, Linux)
- [CVE-2024-53165](https://cve.now/CVE-2024-53165.md): sh: intc: Fix use-after-free bug in register\_intc\_controller() (CVSS 7.4, Linux)
- [CVE-2022-49034](https://cve.now/CVE-2022-49034.md): sh: cpuinfo: Fix a warning for CONFIG\_CPUMASK\_OFFSTACK (no CVSS, Linux)
- [CVE-2024-53164](https://cve.now/CVE-2024-53164.md): net: sched: fix ordering of qlen adjustment (CVSS 7.8, Linux)
- [CVE-2020-1819](https://cve.now/CVE-2020-1819.md): There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some (CVSS 3.7, Huawei IPS Module · Huawei NGFW Module +7)
- [CVE-2020-1818](https://cve.now/CVE-2020-1818.md): There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some (CVSS 3.7, Huawei IPS Module · Huawei NGFW Module +7)
- [CVE-2020-9253](https://cve.now/CVE-2020-9253.md): There is a stack overflow vulnerability in some Huawei smart phone. (CVSS 6.3, Huawei Lion-AL00C)
- [CVE-2020-9236](https://cve.now/CVE-2020-9236.md): There is an improper interface design vulnerability in Huawei product. (CVSS 8.8, Huawei FusionCompute)
- [CVE-2020-9222](https://cve.now/CVE-2020-9222.md): There is a privilege escalation vulnerability in Huawei FusionCompute product. (CVSS 7.0, Huawei FusionCompute)
- [CVE-2020-9211](https://cve.now/CVE-2020-9211.md): There is an out-of-bound read and write vulnerability in Huawei smartphone. (CVSS 6.4, HUAWEI Mate)
- [CVE-2020-9210](https://cve.now/CVE-2020-9210.md): There is an insufficient integrity vulnerability in Huawei products. (CVSS 6.8, Huawei Myna)
- [CVE-2024-3393](https://cve.now/CVE-2024-3393.md): PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet (CVSS 8.7, KEV, Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS)
- [CVE-2020-9089](https://cve.now/CVE-2020-9089.md): There is an information vulnerability in Huawei smartphones. (CVSS 3.3, HUAWEI P30 Pro)
- [CVE-2020-9086](https://cve.now/CVE-2020-9086.md): There is a buffer error vulnerability in some Huawei product. (CVSS 4.3, HUAWEI 4G Router B612)
- [CVE-2020-9085](https://cve.now/CVE-2020-9085.md): There is a NULL pointer dereference vulnerability in some Huawei products. (CVSS 5.3, HUAWEI 4G Router B612)
- [CVE-2020-9082](https://cve.now/CVE-2020-9082.md): There is an information disclosure vulnerability in several smartphones. (CVSS 3.5, HUAWEI Mate)
- [CVE-2020-9081](https://cve.now/CVE-2020-9081.md): There is an improper authorization vulnerability in some Huawei smartphones. (CVSS 3.5, HUAWEI Mate · HUAWEI P30 +4)
- [CVE-2020-9080](https://cve.now/CVE-2020-9080.md): There is an improper privilege management vulnerability in Huawei smart phone product. (CVSS 7.8, HUAWEI Mate 20 Pro · HUAWEI nova)
- [CVE-2024-12983](https://cve.now/CVE-2024-12983.md): code-projects Hospital Management System Edit Doctor Details Page manage-doctors.php cross site scripting (CVSS 5.1, code-projects Hospital Management System)
- [CVE-2024-12982](https://cve.now/CVE-2024-12982.md): PHPGurukul Blood Bank & Donor Management System update-contactinfo.php cross site scripting (CVSS 5.1, PHPGurukul Blood Bank & Donor Management System)
- [CVE-2024-11921](https://cve.now/CVE-2024-11921.md): Give \< 3.19.0 - Reflected XSS (CVSS 4.8, GiveWP)
- [CVE-2024-11842](https://cve.now/CVE-2024-11842.md): DN Shipping by Weight for WooCommerce \< 1.2 - Settings Update via CSRF (CVSS 4.3, DN Shipping by Weight for WooCommerce)
- [CVE-2024-11645](https://cve.now/CVE-2024-11645.md): Float Block \<= 1.7 - Admin+ Stored XSS via Widget (CVSS 4.8, float block)
- [CVE-2024-11644](https://cve.now/CVE-2024-11644.md): WP-SVG \<= 0.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.9, WP-SVG)
- [CVE-2024-11605](https://cve.now/CVE-2024-11605.md): WP Publications \<= 1.2 - Admin+ Stored XSS (CVSS 4.8, wp-publications)
- [CVE-2024-12981](https://cve.now/CVE-2024-12981.md): CodeAstro Car Rental System bookingconfirm.php sql injection (CVSS 5.3, CodeAstro Car Rental System)
- [CVE-2024-12980](https://cve.now/CVE-2024-12980.md): code-projects Job Recruitment \_all\_edits.php fln\_update cross site scripting (CVSS 6.9, code-projects Job Recruitment)
- [CVE-2024-12979](https://cve.now/CVE-2024-12979.md): code-projects Job Recruitment \_all\_edits.php cn\_update cross site scripting (CVSS 6.9, code-projects Job Recruitment)
- [CVE-2024-12978](https://cve.now/CVE-2024-12978.md): code-projects Job Recruitment \_all\_edits.php add\_req sql injection (CVSS 6.9, code-projects Job Recruitment)
- [CVE-2024-9774](https://cve.now/CVE-2024-9774.md): Python-sql: python-sql unary operators does not escape non-expression (CVSS 6.5, python-sql)
- [CVE-2024-12977](https://cve.now/CVE-2024-12977.md): PHPGurukul Complaint Management System state.php sql injection (CVSS 5.3, PHPGurukul Complaint Management System)
- [CVE-2024-12976](https://cve.now/CVE-2024-12976.md): CodeZips Hospital Management System staff.php sql injection (CVSS 6.9, CodeZips Hospital Management System)
- [CVE-2024-39025](https://cve.now/CVE-2024-39025.md): Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data. (CVSS 7.5, letta)
- [CVE-2024-50713](https://cve.now/CVE-2024-50713.md): SmartAgent v1.1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/interface.php. (CVSS 9.8)
- [CVE-2024-50714](https://cve.now/CVE-2024-50714.md): A Server-Side Request Forgery (SSRF) in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via a cr (CVSS 7.5)
- [CVE-2024-50715](https://cve.now/CVE-2024-50715.md): An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command injection through a vuln (CVSS 7.5)
- [CVE-2024-50716](https://cve.now/CVE-2024-50716.md): SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the id parameter in the /sendPushM (CVSS 9.8)
- [CVE-2024-50717](https://cve.now/CVE-2024-50717.md): SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the client parameter in the /recup (CVSS 9.8)
- [CVE-2024-50944](https://cve.now/CVE-2024-50944.md): Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality (CVSS 9.8)
- [CVE-2024-50945](https://cve.now/CVE-2024-50945.md): An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submi (CVSS 7.5)
- [CVE-2024-53476](https://cve.now/CVE-2024-53476.md): A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory rest (CVSS 5.9)
- [CVE-2024-54450](https://cve.now/CVE-2024-54450.md): An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. (CVSS 9.4)
- [CVE-2024-54451](https://cve.now/CVE-2024-54451.md): A cross-site scripting (XSS) vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0.38, 7.10.x through 7 (CVSS 4.8)
- [CVE-2024-54452](https://cve.now/CVE-2024-54452.md): An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35 and 7.10.x through 7.10.0.18. (CVSS 4.9)
- [CVE-2024-54453](https://cve.now/CVE-2024-54453.md): An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. (CVSS 7.5)
- [CVE-2024-54454](https://cve.now/CVE-2024-54454.md): An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15. (CVSS 5.3)
- [CVE-2024-54774](https://cve.now/CVE-2024-54774.md): Dcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create. (CVSS 4.8, dcat/laravel-admin)
- [CVE-2024-54775](https://cve.now/CVE-2024-54775.md): Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting (XSS) vulnerability via /admin/auth/menu and /admin/auth/extensions. (CVSS 4.8, dcat/laravel-admin)
- [CVE-2024-56519](https://cve.now/CVE-2024-56519.md): An issue was discovered in TCPDF before 6.8.0. (CVSS 7.5, tecnick tcpdf · tecnickcom/tcpdf)
- [CVE-2024-56520](https://cve.now/CVE-2024-56520.md): An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. (CVSS 7.3, tecnick tcpdf · tecnickcom/tc-lib-pdf-font)
- [CVE-2024-56521](https://cve.now/CVE-2024-56521.md): An issue was discovered in TCPDF before 6.8.0. (CVSS 9.8, tecnick tcpdf · tecnickcom/tcpdf)
- [CVE-2024-56522](https://cve.now/CVE-2024-56522.md): An issue was discovered in TCPDF before 6.8.0. (CVSS 7.5, tecnick tcpdf · tecnickcom/tcpdf)
- [CVE-2024-56527](https://cve.now/CVE-2024-56527.md): An issue was discovered in TCPDF before 6.8.0. (CVSS 7.5, tecnick tcpdf · tecnickcom/tcpdf)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-12-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.