2024 CVEs (page 4)
Page 4 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-5986 | Critical | 9.1 | 2026-02-02 | A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `… |
CVE-2024-5386 | High | 8.8 | 2026-02-02 | In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this v… |
CVE-2024-4147 | Medium | 6.5 | 2026-02-02 | In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete prompts created in other organizations t… |
CVE-2024-2356 | Critical | 9.6 | 2026-02-02 | A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `nam… |
CVE-2024-54263 | High | 7.5 | 2026-02-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Loc… |
CVE-2024-9432 | | 2026-01-30 | Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data. The vulnerability could read Vertica… | |
CVE-2024-4027 | High | 7.5 | 2026-01-30 | A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends… |
CVE-2024-11976 | High | 7.3 | 2026-01-23 | The The BuddyPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 14.3.3. This is due to the softwar… |
CVE-2024-54556 | Low | 2.4 | 2026-01-16 | This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from… |
CVE-2024-44238 | High | 7.8 | 2026-01-16 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An app may be able to corrupt coproce… |
CVE-2024-44210 | Low | 3.3 | 2026-01-16 | This issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia 15.1. An app may be able to access user-sensitive data. |
CVE-2024-48077 | High | 7.5 | 2026-01-15 | NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate… |
CVE-2024-54855 | Medium | 6.4 | 2026-01-13 | fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-m… |
CVE-2024-58340 | High | 7.5 | 2026-01-12 | LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/… |
CVE-2024-58339 | High | 7.5 | 2026-01-12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEn… |
CVE-2024-14021 | High | 7.8 | 2026-01-12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_… |
CVE-2024-14020 | Medium | 5.0 | 2026-01-07 | A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js o… |
CVE-2024-31088 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSen… |
CVE-2024-30547 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shazdeh Header Image Slider header-image-slider al… |
CVE-2024-53735 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in corourke iPhone Webclip Manager iphone-webclip-manager al… |
CVE-2024-30516 | High | 7.5 | 2026-01-05 | Improper Validation of Specified Quantity in Input vulnerability in SaasProject Booking Package allows Accessing Functionality Not Properly Constrained by ACLs… |
CVE-2024-30461 | High | 7.1 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tumult Inc Tumult Hype Animations allows DOM-Based… |
CVE-2024-23511 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builde… |
CVE-2024-55374 | Medium | 5.3 | 2026-01-02 | REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts. |
CVE-2024-58338 | Critical | 10.0 | 2025-12-30 | Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute comm… |
CVE-2024-58337 | Medium | 4.3 | 2025-12-30 | Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configu… |
CVE-2024-58336 | Medium | 5.3 | 2025-12-30 | Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endp… |
CVE-2024-58315 | High | 7.8 | 2025-12-30 | Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated syst… |
CVE-2024-27480 | Critical | 9.8 | 2025-12-29 | givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. |
CVE-2024-25183 | High | 7.5 | 2025-12-29 | givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. |
CVE-2024-25182 | Critical | 9.8 | 2025-12-29 | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. |
CVE-2024-30855 | High | 8.8 | 2025-12-29 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php. |
CVE-2024-25181 | Critical | 9.1 | 2025-12-29 | A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vuln… |
CVE-2024-44065 | Critical | 9.8 | 2025-12-26 | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter. |
CVE-2024-42718 | Medium | 6.5 | 2025-12-26 | A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit-file' parameter. |
CVE-2024-29720 | Medium | 5.5 | 2025-12-26 | An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component of the Sciter vide… |
CVE-2024-40317 | Medium | 6.1 | 2025-12-24 | A reflected cross-site scripting (XSS) vulnerability in MyNET up to v26.08 allows attackers to execute arbitrary code in the context of a user's browser via in… |
CVE-2024-39037 | Medium | 6.5 | 2025-12-24 | MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter. |
CVE-2024-35322 | Medium | 6.1 | 2025-12-24 | MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. |
CVE-2024-58335 | Medium | 5.0 | 2025-12-24 | OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because the disallow-doctype-decl feature is not enabled in visualization/VisualizerImp… |
CVE-2024-57521 | Critical | 10.0 | 2025-12-23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java. |
CVE-2024-9684 | High | 7.5 | 2025-12-23 | FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences. |
CVE-2024-24844 | High | 7.5 | 2025-12-23 | Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2024-27708 | Critical | 9.6 | 2025-12-22 | Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src pa… |
CVE-2024-25812 | Medium | 6.1 | 2025-12-22 | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the src parameter. |
CVE-2024-35321 | Medium | 4.3 | 2025-12-22 | MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter. |
CVE-2024-25814 | Medium | 6.1 | 2025-12-22 | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter. |
CVE-2024-49587 | Critical | 9.1 | 2025-12-19 | Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users that did not have any permission to hit gl… |
CVE-2024-58323 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows mali… |
CVE-2024-58322 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configuration. This could lead… |
CVE-2024-58321 | Medium | 5.4 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule configuration. Attackers… |
CVE-2024-58320 | Medium | 5.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentic… |
CVE-2024-58319 | Medium | 6.1 | 2025-12-18 | A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration d… |
CVE-2024-58318 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor component for page and f… |
CVE-2024-58317 | Medium | 5.3 | 2025-12-18 | A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.conf… |
CVE-2024-46062 | High | 7.8 | 2025-12-17 | Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During instal… |
CVE-2024-46060 | High | 7.8 | 2025-12-17 | Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory. During install… |
CVE-2024-29371 | High | 7.5 | 2025-12-17 | In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally… |
CVE-2024-29370 | Medium | 5.3 | 2025-12-17 | In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON W… |
CVE-2024-44599 | High | 8.3 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Directory Traversal. |
CVE-2024-44598 | High | 8.8 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. |
CVE-2024-58316 | High | 7.5 | 2025-12-12 | Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL thro… |
CVE-2024-58314 | High | 8.8 | 2025-12-12 | Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attacke… |
CVE-2024-58311 | Critical | 9.8 | 2025-12-12 | Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier… |
CVE-2024-58305 | High | 8.8 | 2025-12-12 | WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript through the module installation endpoint. At… |
CVE-2024-58299 | Critical | 9.8 | 2025-12-12 | PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a… |
CVE-2024-14010 | Critical | 9.8 | 2025-12-12 | Typora 1.7.4 contains a command injection vulnerability in the PDF export preferences that allows attackers to execute arbitrary system commands. Attackers can… |
CVE-2024-58313 | High | 7.2 | 2025-12-11 | xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrar… |
CVE-2024-58312 | High | 7.5 | 2025-12-11 | xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters. A… |
CVE-2024-58310 | | 2025-12-11 | APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating UR… | |
CVE-2024-58309 | Critical | 9.8 | 2025-12-11 | xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL c… |
CVE-2024-58308 | Critical | 9.8 | 2025-12-11 | Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attac… |
CVE-2024-58307 | High | 8.8 | 2025-12-11 | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database… |
CVE-2024-58306 | | 2025-12-11 | minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests. Attackers can… | |
CVE-2024-58304 | Medium | 6.1 | 2025-12-11 | SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to… |
CVE-2024-58303 | | 2025-12-11 | FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates. A… | |
CVE-2024-58302 | | 2025-12-11 | FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates. Atta… | |
CVE-2024-58301 | | 2025-12-11 | Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parame… | |
CVE-2024-58300 | | 2025-12-11 | Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated cre… | |
CVE-2024-58298 | | 2025-12-11 | Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP fil… | |
CVE-2024-58297 | Medium | 5.4 | 2025-12-11 | PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts. Att… |
CVE-2024-58296 | | 2025-12-11 | CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts… | |
CVE-2024-58295 | | 2025-12-11 | ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme ins… | |
CVE-2024-58294 | High | 8.8 | 2025-12-11 | FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbi… |
CVE-2024-58293 | | 2025-12-11 | Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple fo… | |
CVE-2024-58292 | | 2025-12-11 | XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templ… | |
CVE-2024-58291 | | 2025-12-11 | Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in forum information fi… | |
CVE-2024-58290 | | 2025-12-11 | Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through… | |
CVE-2024-58289 | Medium | 5.4 | 2025-12-11 | Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts into user profile fields… |
CVE-2024-58288 | | 2025-12-11 | Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit t… | |
CVE-2024-58287 | High | 8.8 | 2025-12-11 | reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute… |
CVE-2024-58286 | | 2025-12-11 | dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. A… | |
CVE-2024-42197 | Medium | 5.5 | 2025-12-11 | HCL Workload Scheduler stores user credentials in plain text which can be read by a local user. |
CVE-2024-8273 | High | 8.8 | 2025-12-11 | Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1. |
CVE-2024-40593 | Medium | 6.0 | 2025-12-11 | A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAn… |
CVE-2024-58285 | Medium | 5.4 | 2025-12-10 | Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into post titles. Attackers can cr… |
CVE-2024-58284 | High | 7.2 | 2025-12-10 | PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inject malicious PHP code through the meta… |
CVE-2024-58283 | High | 8.8 | 2025-12-10 | WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the Elfinder fi… |
CVE-2024-58282 | High | 7.2 | 2025-12-10 | Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media uploa… |
CVE-2024-58281 | High | 8.8 | 2025-12-10 | Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functio… |