2024 CVEs (page 3)
Page 3 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33618 | High | 7.5 | 2026-04-15 | Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network int… |
CVE-2024-23104 | Medium | 5.4 | 2026-04-14 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiNDR 7.6.0, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions… |
CVE-2024-1490 | High | 7.2 | 2026-04-09 | An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC. If user-defin… |
CVE-2024-36058 | Critical | 9.8 | 2026-04-07 | The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the POST parameter bib_li… |
CVE-2024-36057 | Critical | 9.8 | 2026-04-07 | Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -… |
CVE-2024-14032 | High | 7.8 | 2026-04-06 | Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that allows local attackers to execute arbit… |
CVE-2024-14033 | High | 7.5 | 2026-04-02 | Hirschmann EagleSDV firmware prior to 05.4.02 contains a denial-of-service vulnerability in TLS session establishment. Attackers can crash the device during TL… |
CVE-2024-14034 | Critical | 9.8 | 2026-04-02 | Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated… |
CVE-2024-44303 | High | 7.5 | 2026-04-02 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1. A malicious application may be able to modify protected parts of the f… |
CVE-2024-44286 | High | 7.5 | 2026-04-02 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard even… |
CVE-2024-44250 | High | 8.2 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to execute arbitrary code out of… |
CVE-2024-44219 | High | 7.5 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be… |
CVE-2024-40858 | High | 7.1 | 2026-04-02 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user c… |
CVE-2024-40849 | High | 7.5 | 2026-04-02 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox. |
CVE-2024-43028 | Critical | 9.8 | 2026-04-01 | A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP… |
CVE-2024-40489 | Critical | 9.8 | 2026-04-01 | There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on c… |
CVE-2024-53828 | Medium | 5.3 | 2026-04-01 | Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may… |
CVE-2024-58342 | Medium | 6.3 | 2026-04-01 | XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately validate the redirect t… |
CVE-2024-14031 | High | 8.1 | 2026-03-31 | Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Encoder embeds a version of the Z… |
CVE-2024-14030 | High | 8.1 | 2026-03-31 | Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Z… |
CVE-2024-11604 | | 2026-03-27 | Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows… | |
CVE-2024-14028 | Medium | 6.5 | 2026-03-27 | Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects: smartLink HW-DP: through 1.31 smartLi… |
CVE-2024-58341 | High | 8.2 | 2026-03-25 | OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2024-51348 | High | 8.8 | 2026-03-25 | A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33.1.0.0818 allows unauthenticated attackers within net… |
CVE-2024-51347 | High | 7.2 | 2026-03-25 | A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. The flaw exists in the handling of the Time Zone (TZ) parameter with… |
CVE-2024-51346 | High | 7.7 | 2026-03-25 | An issue in Eufy Homebase 2 version 3.3.4.1h allows a local attacker to obtain sensitive information via the cryptographic scheme. |
CVE-2024-46879 | Medium | 5.4 | 2026-03-23 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2. This vulnerability… |
CVE-2024-46878 | Medium | 5.4 | 2026-03-23 | A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier. This vulnerability allows attack… |
CVE-2024-51226 | Medium | 6.1 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attacke… |
CVE-2024-51225 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to… |
CVE-2024-51224 | Medium | 4.8 | 2026-03-23 | Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attacke… |
CVE-2024-51223 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to e… |
CVE-2024-51222 | Medium | 4.8 | 2026-03-23 | A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to e… |
CVE-2024-13785 | Medium | 5.6 | 2026-03-21 | The The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an… |
CVE-2024-44722 | Critical | 9.8 | 2026-03-20 | SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd. |
CVE-2024-32537 | High | 7.1 | 2026-03-20 | Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.This issue affects Flash Video Player: from… |
CVE-2024-31119 | Medium | 5.9 | 2026-03-20 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Vasilis Triantafyllou Special Box for Content allows DOM-… |
CVE-2024-42210 | High | 7.6 | 2026-03-19 | A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-… |
CVE-2024-14026 | High | 7.8 | 2026-03-11 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also g… |
CVE-2024-14025 | Medium | 6.7 | 2026-03-11 | An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator accou… |
CVE-2024-14024 | Medium | 6.7 | 2026-03-11 | An improper certificate validation vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an a… |
CVE-2024-14027 | Medium | 5.5 | 2026-03-09 | In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexatt… |
CVE-2024-35644 | Medium | 5.9 | 2026-03-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pascal Birchler Preferred Languages allows DOM-Bas… |
CVE-2024-43035 | Medium | 5.8 | 2026-03-05 | Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in ser… |
CVE-2024-57854 | Critical | 9.1 | 2026-03-05 | Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt… |
CVE-2024-55027 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db. |
CVE-2024-55026 | Critical | 9.8 | 2026-03-03 | An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supp… |
CVE-2024-55025 | Medium | 6.5 | 2026-03-03 | Incorrect access control in the VNC component of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to access the HMI system. |
CVE-2024-55024 | Critical | 9.8 | 2026-03-03 | An authentication bypass vulnerability in the authorization mechanism of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to per… |
CVE-2024-55023 | Medium | 5.3 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded encryption key which could allow attackers to access sensitive informat… |
CVE-2024-55022 | High | 8.8 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter. |
CVE-2024-55021 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain a hardcoded password in the FTP protocol. |
CVE-2024-55020 | Critical | 9.8 | 2026-03-03 | A command injection vulnerability in the DHCP activation feature of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows attackers to execute a… |
CVE-2024-55019 | High | 7.5 | 2026-03-03 | Incorrect access control in the component download_wb.cgi of Weintek cMT-3072XH2 easyweb Web Version v2.1.53, OS v20231011 allows unauthenticated attack to dow… |
CVE-2024-43766 | Medium | 6.5 | 2026-03-02 | In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. This could lead to remote (proximal/adjac… |
CVE-2024-31328 | High | 8.8 | 2026-03-02 | In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from the background on the paired companion… |
CVE-2024-50337 | Medium | 5.3 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which resu… |
CVE-2024-47886 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within ver… |
CVE-2024-10938 | Medium | 6.5 | 2026-02-27 | The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scr… |
CVE-2024-48928 | High | 7.5 | 2026-02-24 | Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set… |
CVE-2024-56373 | High | 8.4 | 2026-02-24 | DAG Author (who already has quite a lot of permissions) could manipulate database of Airflow 2 in the way to execute arbitrary code in the web-server context… |
CVE-2024-1524 | High | 7.7 | 2026-02-24 | When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's informat… |
CVE-2024-58041 | Critical | 9.1 | 2026-02-24 | Smolder versions through 1.51 for Perl uses insecure rand() function for cryptographic functions. Smolder 1.51 and earlier for Perl uses the rand() function a… |
CVE-2024-56208 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in desertthemes NewsMash newsmash allows Stored XSS.This iss… |
CVE-2024-54222 | Medium | 4.3 | 2026-02-20 | Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-52387 | Medium | 5.9 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons al… |
CVE-2024-51915 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache al… |
CVE-2024-50555 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stor… |
CVE-2024-50452 | Medium | 6.5 | 2026-02-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor a… |
CVE-2024-43228 | Medium | 5.3 | 2026-02-20 | Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3. |
CVE-2024-34438 | Medium | 5.3 | 2026-02-20 | Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19. |
CVE-2024-43178 | Medium | 5.9 | 2026-02-17 | IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2024-55270 | High | 8.8 | 2026-02-17 | phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. |
CVE-2024-55271 | Low | 3.5 | 2026-02-17 | A Cross-Site Request Forgery (CSRF) vulnerability has been identified in phpgurukul Gym Management System 1.0. This issue is present in the profile update func… |
CVE-2024-31118 | Medium | 6.5 | 2026-02-17 | Missing Authorization vulnerability in Smartypants SP Project & Document Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-21961 | | 2026-02-13 | Improper restriction of operations within the bounds of a memory buffer in PCIe® Link could allow an attacker with access to a guest virtual machine to potenti… | |
CVE-2024-36319 | | 2026-02-12 | Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causing the VCN FW to per… | |
CVE-2024-50619 | High | 8.8 | 2026-02-11 | Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access levels. A low-privi… |
CVE-2024-50617 | High | 7.5 | 2026-02-11 | Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authen… |
CVE-2024-50620 | High | 8.8 | 2026-02-11 | Unrestricted Upload of File with Dangerous Type vulnerabilities exist in the rich text editor and document manage components in CIPPlanner CIPAce before 9.17… |
CVE-2024-50618 | Medium | 4.3 | 2026-02-11 | A Use of Single-factor Authentication vulnerability in the Authentication component of CIPPlanner CIPAce before 9.17 allows attackers to bypass a protection me… |
CVE-2024-26480 | High | 7.5 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the admin parameter. |
CVE-2024-26479 | Medium | 5.3 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the Command execution function. |
CVE-2024-26478 | Medium | 5.3 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the /api/users endpoint. |
CVE-2024-26477 | High | 7.5 | 2026-02-11 | An issue in Statping-ng v.0.91.0 allows an attacker to obtain sensitive information via a crafted request to the api parameter of the oauth, amazon_sns, export… |
CVE-2024-36324 | High | 8.8 | 2026-02-11 | Improper input validation in AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to arbitrary code execution. |
CVE-2024-36320 | | 2026-02-11 | Integer Overflow within atihdwt6.sys can allow a local attacker to cause out of bound read/write potentially leading to loss of confidentiality, integrity and… | |
CVE-2024-36316 | Medium | 5.5 | 2026-02-11 | The integer overflow vulnerability within AMD Graphics driver could allow an attacker to bypass size checks potentially resulting in a denial of service |
CVE-2024-56808 | High | 7.8 | 2026-02-11 | A command injection vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access who have also gained a user acc… |
CVE-2024-56807 | Medium | 5.5 | 2026-02-11 | An out-of-bounds read vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access, they can then exploit the vu… |
CVE-2024-36355 | | 2026-02-10 | Improper input validation in the SMM handler could allow an attacker with Ring0 access to write to SMRAM and modify execution flow for S3 (sleep) wake up, pote… | |
CVE-2024-36311 | | 2026-02-10 | A Time-of-check time-of-use (TOCTOU) race condition in the SMM communications buffer could allow a privileged attacker to bypass input validation and perform a… | |
CVE-2024-36310 | | 2026-02-10 | Improper input validation in the SMM communications buffer could allow a privileged attacker to perform an out of bounds read or write to SMRAM potentially res… | |
CVE-2024-21953 | | 2026-02-10 | Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity. | |
CVE-2024-54192 | Medium | 5.5 | 2026-02-10 | An issue inTcpreplay v4.5.1 allows a local attacker to cause a denial of service via a crafted file to the tcpedit_dlt_getplugin function at src/tcpedit/plugin… |
CVE-2024-52334 | Medium | 5.3 | 2026-02-10 | A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly. This c… |
CVE-2024-51451 | Medium | 6.5 | 2026-02-04 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attack… |
CVE-2024-43181 | Medium | 6.3 | 2026-02-04 | IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. |
CVE-2024-40685 | Medium | 4.3 | 2026-02-04 | IBM Operations Analytics – Log Analysis versions 1.3.5.0 through 1.3.8.3 and IBM SmartCloud Analytics – Log Analysis are vulnerable to a cross-site request for… |
CVE-2024-39724 | Medium | 5.3 | 2026-02-04 | IBM Db2 Big SQL on Cloud Pak for Data versions 7.6 (on CP4D 4.8), 7.7 (on CP4D 5.0), and 7.8 (on CP4D 5.1) do not properly limit the allocation of system resou… |