2024 CVEs (page 2)
Page 2 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-27892 | Critical | 9.6 | 2026-06-04 | Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpecte… |
CVE-2024-27891 | Medium | 5.3 | 2026-06-04 | On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egress… |
CVE-2024-27890 | Critical | 9.6 | 2026-06-04 | Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpecte… |
CVE-2024-6858 | Medium | 6.5 | 2026-06-04 | In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the f… |
CVE-2024-47273 | Medium | 4.3 | 2026-06-03 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4… |
CVE-2024-47263 | Medium | 4.1 | 2026-06-03 | An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup… |
CVE-2024-14036 | High | 7.5 | 2026-06-02 | Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-adjacent attackers to trigger high CPU… |
CVE-2024-42206 | Low | 3.1 | 2026-06-02 | HCL iReflection Third party vulnerable and outdated components issue was detected in the web application |
CVE-2024-52011 | High | 8.3 | 2026-06-01 | launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the insufficient sanitization of the `file` a… |
CVE-2024-40646 | High | 8.6 | 2026-06-01 | Vertex is a management tool for PT (Private Tracker) users to manage streaming and watching videos. Versions prior to commit fbde301b97986d5913fc4bc95f5445750d… |
CVE-2024-47097 | | 2026-05-28 | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the sit… | |
CVE-2024-47096 | | 2026-05-28 | Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the sho… | |
CVE-2024-56462 | High | 7.2 | 2026-05-27 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to upload a malicious backup archive that could be restored and used to gain… |
CVE-2024-40684 | Medium | 5.9 | 2026-05-27 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3… |
CVE-2024-28765 | Medium | 5.3 | 2026-05-27 | IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information… |
CVE-2024-47272 | Low | 2.7 | 2026-05-27 | Incorrect authorization vulnerability in IO Module functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated… |
CVE-2024-47271 | Medium | 4.9 | 2026-05-27 | Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote auth… |
CVE-2024-47270 | Low | 2.7 | 2026-05-27 | Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows re… |
CVE-2024-47269 | Medium | 4.9 | 2026-05-27 | Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 al… |
CVE-2024-47268 | Medium | 4.9 | 2026-05-27 | Missing authorization vulnerability in AddOns functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated user… |
CVE-2024-47267 | Low | 2.7 | 2026-05-27 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station b… |
CVE-2024-11399 | Medium | 6.8 | 2026-05-27 | Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local us… |
CVE-2024-36343 | | 2026-05-19 | Improper input validation in the System Management Mode (SMM) communications buffer could allow a privileged attacker to perform an out of bounds read or write… | |
CVE-2024-36334 | | 2026-05-15 | Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to be run with elevat… | |
CVE-2024-36333 | High | 7.8 | 2026-05-15 | A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execut… |
CVE-2024-36323 | | 2026-05-15 | Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized access to the register… | |
CVE-2024-21950 | | 2026-05-15 | An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of established bounds potent… | |
CVE-2024-36332 | | 2026-05-15 | Improper isolation of GPU HW register space could allow a privileged attacker in malicious Guest Virtual Machine (VM) to perform unauthorized access to specifi… | |
CVE-2024-21962 | | 2026-05-15 | Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation… | |
CVE-2024-36345 | | 2026-05-15 | Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out-of-bounds read, po… | |
CVE-2024-48519 | Medium | 6.2 | 2026-05-13 | Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial of service via the… |
CVE-2024-55045 | High | 7.3 | 2026-05-13 | Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the task_mavobc_entry function at /comm/task_comm.c. |
CVE-2024-51395 | Medium | 6.2 | 2026-05-13 | Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service vi… |
CVE-2024-51394 | Medium | 5.5 | 2026-05-13 | Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service vi… |
CVE-2024-47091 | High | 7.8 | 2026-05-13 | Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a… |
CVE-2024-36315 | | 2026-05-13 | Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information… | |
CVE-2024-54017 | Medium | 5.3 | 2026-05-12 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All… |
CVE-2024-0391 | Medium | 5.3 | 2026-05-11 | The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered us… |
CVE-2024-53326 | High | 7.3 | 2026-05-08 | LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution. |
CVE-2024-51092 | Critical | 9.1 | 2026-05-08 | LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(), SettingsController… |
CVE-2024-46508 | High | 7.5 | 2026-05-08 | yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other t… |
CVE-2024-46507 | High | 7.3 | 2026-05-08 | A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute co… |
CVE-2024-45257 | High | 7.3 | 2026-05-08 | A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a craf… |
CVE-2024-33724 | Medium | 5.4 | 2026-05-08 | SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. |
CVE-2024-33722 | Medium | 6.3 | 2026-05-08 | SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. |
CVE-2024-33288 | High | 7.3 | 2026-05-08 | Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page. |
CVE-2024-30167 | Medium | 6.3 | 2026-05-08 | /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a POST request that ca… |
CVE-2024-27686 | High | 7.5 | 2026-05-08 | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted packet data to the… |
CVE-2024-43384 | High | 8.0 | 2026-05-07 | A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. |
CVE-2024-30151 | High | 8.3 | 2026-05-06 | HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users t… |
CVE-2024-52911 | High | 7.5 | 2026-05-05 | Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14. |
CVE-2024-13362 | Medium | 6.1 | 2026-05-01 | Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient inp… |
CVE-2024-13971 | High | 7.5 | 2026-04-30 | Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read acc… |
CVE-2024-39847 | High | 7.5 | 2026-04-30 | Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server. This allows them to obtain read access to… |
CVE-2024-54013 | High | 8.8 | 2026-04-28 | Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain condi… |
CVE-2024-54012 | Medium | 5.3 | 2026-04-28 | Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted reques… |
CVE-2024-54011 | Medium | 6.5 | 2026-04-28 | Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data supplied in certain requests, causing a se… |
CVE-2024-46636 | Critical | 9.4 | 2026-04-27 | NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter |
CVE-2024-58344 | Medium | 6.4 | 2026-04-22 | Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code throug… |
CVE-2024-7083 | Low | 3.5 | 2026-04-20 | The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2024-58343 | Medium | 4.3 | 2026-04-16 | Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id. |
CVE-2024-8010 | Low | 3.5 | 2026-04-16 | The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payloa… |
CVE-2024-4867 | Medium | 5.4 | 2026-04-16 | The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency… |
CVE-2024-10242 | Medium | 6.1 | 2026-04-16 | The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malic… |
CVE-2024-2374 | High | 7.5 | 2026-04-16 | The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This o… |
CVE-2024-53412 | High | 8.4 | 2026-04-15 | Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code exec… |
CVE-2024-33618 | High | 7.5 | 2026-04-15 | Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network int… |
CVE-2024-23104 | Medium | 5.4 | 2026-04-14 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions… |
CVE-2024-1490 | High | 7.2 | 2026-04-09 | An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defin… |
CVE-2024-36058 | Critical | 9.8 | 2026-04-07 | The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the POST parameter bib_li… |
CVE-2024-36057 | Critical | 9.8 | 2026-04-07 | Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -… |
CVE-2024-14032 | High | 7.8 | 2026-04-06 | Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbit… |
CVE-2024-14033 | High | 7.5 | 2026-04-02 | Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TL… |
CVE-2024-14034 | Critical | 9.8 | 2026-04-02 | Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated… |
CVE-2024-44303 | High | 7.5 | 2026-04-02 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be able to modify protected parts of the f… |
CVE-2024-44286 | High | 7.5 | 2026-04-02 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard even… |
CVE-2024-44250 | High | 8.2 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbitrary code out of… |
CVE-2024-44219 | High | 7.5 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be… |
CVE-2024-40858 | High | 7.1 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user c… |
CVE-2024-40849 | High | 7.5 | 2026-04-02 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox. |
CVE-2024-43028 | Critical | 9.8 | 2026-04-01 | A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP… |
CVE-2024-40489 | Critical | 9.8 | 2026-04-01 | There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on c… |
CVE-2024-53828 | Medium | 5.3 | 2026-04-01 | Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may… |
CVE-2024-58342 | Medium | 6.3 | 2026-04-01 | XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect t… |
CVE-2024-14031 | High | 8.1 | 2026-03-31 | Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds a version of the Z… |
CVE-2024-14030 | High | 8.1 | 2026-03-31 | Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Z… |
CVE-2024-11604 | | 2026-03-27 | Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows… | |
CVE-2024-14028 | Medium | 6.5 | 2026-03-27 | Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects: smartLink HW-DP: through 1.31 smartLi… |
CVE-2024-58341 | High | 8.2 | 2026-03-25 | OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2024-51348 | High | 8.8 | 2026-03-25 | A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33.1.0.0818 allows unauthenticated attackers within net… |
CVE-2024-51347 | High | 7.2 | 2026-03-25 | A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. The flaw exists in the handling of the Time Zone (TZ) parameter with… |
CVE-2024-51346 | High | 7.7 | 2026-03-25 | An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme. |
CVE-2024-46879 | Medium | 5.4 | 2026-03-23 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2. This vulnerability… |
CVE-2024-46878 | Medium | 5.4 | 2026-03-23 | A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. This vulnerability allows attack… |
CVE-2024-51226 | Medium | 6.1 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attacke… |
CVE-2024-51225 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to… |
CVE-2024-51224 | Medium | 4.8 | 2026-03-23 | Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attacke… |
CVE-2024-51223 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to e… |
CVE-2024-51222 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to e… |
CVE-2024-13785 | Medium | 5.6 | 2026-03-21 | The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an… |