Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: April 2024

218 records · 10 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2023-51572
    51Plan

    Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 38%

    voltronicpower · viewpowerApr 1, 2024

  • CVE-2023-51573
    53Plan

    Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability

    CriticalCVSS 9.8No exploitEPSS 45%

    voltronicpower · viewpowerApr 1, 2024

  • CVE-2024-0637
    57Plan

    Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 72%

    centreon · centreon webApr 1, 2024

  • CVE-2024-23115
    48Plan

    Centreon updateGroups SQL Injection Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 67%

    centreon · centreon webApr 1, 2024

  • CVE-2024-23116
    44Plan

    Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 53%

    centreon · centreon webApr 1, 2024

  • CVE-2024-23117
    44Plan

    Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 53%

    centreon · centreon webApr 1, 2024

  • CVE-2024-23118
    44Plan

    Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 53%

    centreon · centreon webApr 1, 2024

  • CVE-2024-29276
    49Plan

    An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDes

    CriticalCVSS 9.8No exploitEPSS 32%

    Apr 2, 2024

  • CVE-2024-2389
    67This week

    Flowmon Unauthenticated Command Injection Vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 93%

    progress · flowmonApr 2, 2024

  • CVE-2024-30350
    13Monitor

    Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability

    LowCVSS 3.3Proof of conceptEPSS 0%

    foxit · pdf editorApr 2, 2024

  • CVE-2024-24724
    47Plan

    Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    gibbonedu · gibbonApr 2, 2024

  • CVE-2024-2879
    36Monitor

    The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to

    HighCVSS 7.5Proof of conceptEPSS 18%

    kreaturamedia · layersliderApr 3, 2024

  • CVE-2024-30998
    39Monitor

    SQL Injection vulnerability in PHPGurukul Men Salon Management System v.2.0, allows remote attackers to execute arbitrary code and obtain se

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    phpgurukul · men salon management systemApr 3, 2024

  • CVE-2024-28515
    39Monitor

    Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of cs

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Apr 3, 2024

  • CVE-2024-28589
    26Monitor

    An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbi

    MediumCVSS 6.7Proof of conceptEPSS 0%

    Apr 3, 2024

  • CVE-2024-25096
    39Monitor

    WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    canto · cantoApr 3, 2024

  • CVE-2024-30568
    53Plan

    Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    netgear · r6850 firmwareApr 3, 2024

  • CVE-2024-30569
    31Monitor

    An information leak in currentsetting.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentica

    HighCVSS 7.5Proof of conceptEPSS 1%

    netgear · r6850 firmwareApr 3, 2024

  • CVE-2024-30570
    21Monitor

    An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication

    MediumCVSS 5.3Proof of conceptEPSS 1%

    netgear · r6850 firmwareApr 3, 2024

  • CVE-2024-30571
    34Monitor

    An information leak in the BRS_top.html component of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any au

    HighCVSS 7.5No exploitEPSS 13%

    netgear · r6850 firmwareApr 3, 2024

  • CVE-2024-27674
    31Monitor

    Macro Expert through 4.9.4 allows BUILTIN\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\GrassSoft\Macro Expert" folder and thus an un

    HighCVSS 7.8Proof of conceptEPSS 0%

    macro-expert · macro expertApr 3, 2024

  • CVE-2024-2653
    57Plan

    amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag

    HighCVSS 8.2No exploitEPSS 83%

    amphp · amphp/http-clientApr 3, 2024

  • CVE-2024-2758
    47Plan

    Tempesta FW rate limits are not enabled by default.

    MediumCVSS 6.3No exploitEPSS 72%

    tempesta · tempesta fwApr 3, 2024

  • CVE-2024-3272
    98Now

    D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    dlink · dns-320l firmwareApr 3, 2024

  • CVE-2024-3273
    99Now

    D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    dlink · dns-320l firmwareApr 3, 2024

  • CVE-2024-3274
    31Monitor

    D-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosure

    MediumCVSS 5.3Proof of conceptEPSS 33%

    d-link · dns-320lApr 3, 2024

  • CVE-2024-29375
    39Monitor

    CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to t

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Apr 4, 2024

  • CVE-2024-25503
    18Monitor

    Cross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sens

    MediumCVSS 4.7Proof of conceptEPSS 0%

    Apr 4, 2024

  • CVE-2023-36643
    21Monitor

    Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all orders from the online shop via oordershow compon

    MediumCVSS 5.3Proof of conceptEPSS 0%

    itb-pim · tradeproApr 4, 2024

  • CVE-2023-36644
    21Monitor

    Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the

    MediumCVSS 5.3Proof of conceptEPSS 0%

    itb-pim · tradeproApr 4, 2024

  • CVE-2023-36645
    39Monitor

    SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer funct

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    itb-pim · tradeproApr 4, 2024

  • CVE-2024-27919
    56Plan

    HTTP/2: memory exhaustion due to CONTINUATION frame flood

    HighCVSS 7.5No exploitEPSS 86%

    envoyproxy · envoyApr 4, 2024

  • CVE-2024-3116
    60This week

    Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4

    CriticalCVSS 9.8WeaponizedEPSS 65%

    pgadmin · pgadmin 4Apr 4, 2024

  • CVE-2024-28182
    46Plan

    Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

    MediumCVSS 5.3No exploitEPSS 84%

    nghttp2 · nghttp2Apr 4, 2024

  • CVE-2023-38709
    30Monitor

    Apache HTTP Server: HTTP response splitting

    HighCVSS 7.3Proof of conceptEPSS 3%

    apache · http serverApr 4, 2024

  • CVE-2024-27316
    57Plan

    Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

    HighCVSS 7.5Proof of conceptEPSS 91%

    apache · http serverApr 4, 2024

  • CVE-2024-30255
    56Plan

    HTTP/2: CPU exhaustion due to CONTINUATION frame flood

    HighCVSS 7.5Proof of conceptEPSS 87%

    envoyproxy · envoyApr 4, 2024

  • CVE-2023-45288
    58Plan

    HTTP/2 CONTINUATION flood in net/http

    HighCVSS 7.5Proof of conceptEPSS 91%

    go standard library · net/httpApr 4, 2024

  • CVE-2024-30270
    32Monitor

    mailcow Path Traversal and Arbitrary Code Execution Vulnerability

    MediumCVSS 6.2Proof of conceptEPSS 27%

    mailcow · mailcow\Apr 4, 2024

  • CVE-2024-21894
    45Plan

    A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated mal

    CriticalCVSS 9.8No exploitEPSS 18%

    ivanti · connect secureApr 4, 2024

  • CVE-2024-31211
    40Plan

    Remote Code Execution in `WP_HTML_Token`

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    wordpress · wordpressApr 4, 2024

  • CVE-2023-52235
    35Monitor

    SpaceX Starlink Wi-Fi router GEN 2 before 2023.53.0 and Starlink Dish before 07dd2798-ff15-4722-a9ee-de28928aed34 allow CSRF (e.g., for a re

    HighCVSS 8.8Proof of conceptEPSS 0%

    Apr 5, 2024

  • CVE-2024-22363
    30Monitor

    SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).

    HighCVSS 7.5Proof of conceptEPSS 0%

    Apr 5, 2024

  • CVE-2024-29863
    31Monitor

    A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may

    HighCVSS 7.8Proof of conceptEPSS 0%

    Apr 5, 2024

  • CVE-2024-3217
    36Monitor

    WP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL Injection

    HighCVSS 8.8Proof of conceptEPSS 1%

    wpdirectorykit · wp directory kitApr 5, 2024

  • CVE-2023-49965
    27Monitor

    SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.

    MediumCVSS 6.8Proof of conceptEPSS 0%

    Apr 5, 2024

  • CVE-2024-31218
    39Monitor

    Missing Authentication for Critical Function in Webhood backend

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    webhood-io · webhoodApr 5, 2024

  • CVE-2024-3346
    40Plan

    Byzoro Smart S80 webmailattach.php os command injection

    MediumCVSS 6.3No exploitEPSS 49%

    byzoro · smart s80Apr 5, 2024

  • CVE-2024-31848
    41Plan

    A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, whic

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    cdata · api serverApr 5, 2024

  • CVE-2024-31849
    41Plan

    A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which c

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    cdata · connectApr 5, 2024

  • CVE-2024-31850
    35Monitor

    A path traversal vulnerability exists in the Java version of CData Arc < 23.4.8839 when running using the embedded Jetty server, which could

    HighCVSS 8.6Proof of conceptEPSS 3%

    cdata · arcApr 5, 2024

  • CVE-2024-31851
    35Monitor

    A path traversal vulnerability exists in the Java version of CData Sync < 23.4.8843 when running using the embedded Jetty server, which coul

    HighCVSS 8.6Proof of conceptEPSS 2%

    cdata · syncApr 5, 2024

  • CVE-2024-29745
    52Plan

    there is a possible Information Disclosure due to uninitialized data.

    MediumCVSS 5.5KEVWeaponizedEPSS 0%

    google · androidApr 5, 2024

  • CVE-2024-29748
    61This week

    there is a possible way to bypass due to a logic error in the code.

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    google · androidApr 5, 2024

  • CVE-2024-3378
    31Monitor

    iboss Secure Web Gateway Login Portal login cross site scripting

    MediumCVSS 6.1Proof of conceptEPSS 22%

    iboss · secure web gatewayApr 6, 2024

  • CVE-2024-3156
    39Monitor

    Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds m

    HighCVSS 8.8No exploitEPSS 12%

    google · chromeApr 6, 2024

  • CVE-2024-0406
    31Monitor

    Mholt/archiver: path traversal vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    mholt · archiverApr 6, 2024

  • CVE-2024-27620
    31Monitor

    An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API.

    HighCVSS 7.5Proof of conceptEPSS 2%

    Apr 6, 2024

  • CVE-2024-28741
    60This week

    Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php co

    HighCVSS 8.8WeaponizedEPSS 78%

    Apr 6, 2024

  • CVE-2024-26574
    31Monitor

    Insecure Permissions vulnerability in Wondershare Filmora v.13.0.51 allows a local attacker to execute arbitrary code via a crafted script t

    HighCVSS 7.8Proof of conceptEPSS 0%

    wondershare · filmoraApr 8, 2024

  • CVE-2024-31817
    47Plan

    In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStat

    HighCVSS 7.5No exploitEPSS 55%

    totolink · ex200 firmwareApr 8, 2024

  • CVE-2024-30269
    26Monitor

    DataEase has database configuration information exposure vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 15%

    dataease · dataeaseApr 8, 2024

  • CVE-2024-2511
    39Monitor

    Unbounded memory growth with session handling in TLSv1.3

    MediumCVSS 5.9No exploitEPSS 52%

    openssl · opensslApr 8, 2024

  • CVE-2023-7164
    31Monitor

    BackWPup < 4.0.4 - Unauthenticated Backup Download

    HighCVSS 7.5Proof of conceptEPSS 2%

    inpsyde · backwpupApr 8, 2024

  • CVE-2024-27630
    30Monitor

    Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input

    HighCVSS 7.5Proof of conceptEPSS 0%

    gnu · savaneApr 8, 2024

  • CVE-2024-27631
    24Monitor

    Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/userg

    MediumCVSS 6.0Proof of conceptEPSS 0%

    gnu · savaneApr 8, 2024

  • CVE-2024-27632
    35Monitor

    An issue in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via the form_id in the form_header() function.

    HighCVSS 8.8Proof of conceptEPSS 1%

    gnu · savaneApr 8, 2024

  • CVE-2024-27983
    58Plan

    An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 f

    HighCVSS 8.2Proof of conceptEPSS 87%

    nodejs · nodeApr 8, 2024

  • CVE-2023-6319
    30Monitor

    Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service

    HighCVSS 7.2Proof of conceptEPSS 6%

    lg · webosApr 9, 2024

  • CVE-2023-49074
    34Monitor

    A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.

    HighCVSS 7.5No exploitEPSS 13%

    tp-link · eap225 firmwareApr 9, 2024

  • CVE-2024-21409
    30Monitor

    .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability

    HighCVSS 7.3Proof of conceptEPSS 2%

    microsoft · .net frameworkApr 9, 2024

  • CVE-2024-26158
    35Monitor

    Microsoft Install Service Elevation of Privilege Vulnerability

    HighCVSS 7.8No exploitEPSS 12%

    microsoft · windows 10 1507Apr 9, 2024

  • CVE-2024-26209
    26Monitor

    Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability

    MediumCVSS 5.5No exploitEPSS 14%

    microsoft · windows 10 1507Apr 9, 2024

  • CVE-2024-26212
    49Plan

    DHCP Server Service Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 62%

    microsoft · windows server 2008Apr 9, 2024

  • CVE-2024-26218
    35Monitor

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 12%

    microsoft · windows 10 1809Apr 9, 2024

  • CVE-2024-26229
    34Monitor

    Windows CSC Service Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 9%

    microsoft · windows 10 1507Apr 9, 2024

  • CVE-2024-26230
    38Monitor

    Windows Telephony Server Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 24%

    microsoft · windows 10 1507Apr 9, 2024

  • CVE-2024-26256
    57Plan

    Libarchive Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 87%

    libarchive · libarchiveApr 9, 2024

  • CVE-2024-29050
    31Monitor

    Windows Cryptographic Services Remote Code Execution Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows 10 1507Apr 9, 2024

  • CVE-2024-29988
    79This week

    SmartScreen Prompt Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 45%

    microsoft · windows 10 1809Apr 9, 2024

  • CVE-2024-29990
    41Plan

    Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability

    CriticalCVSS 9.0No exploitEPSS 18%

    microsoft · azure kubernetes service confidential containersApr 9, 2024

  • CVE-2024-24576
    46Plan

    Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows

    CriticalCVSS 10.0Proof of conceptEPSS 20%

    fedoraproject · fedoraApr 9, 2024

  • CVE-2024-0588
    17Monitor

    Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery

    MediumCVSS 4.3Proof of conceptEPSS 0%

    strangerstudios · paid memberships proApr 9, 2024

  • CVE-2024-1813
    39Monitor

    Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    presstigers · simple job boardApr 9, 2024

  • CVE-2024-2340
    29Monitor

    Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing

    MediumCVSS 5.3Proof of conceptEPSS 27%

    theme-fusion · avadaApr 9, 2024

  • CVE-2024-3097
    32Monitor

    WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 38%

    imagely · nextgen galleryApr 9, 2024

  • CVE-2024-3136
    41Plan

    MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    stylemixthemes · masterstudy lmsApr 9, 2024

  • CVE-2024-27665
    21Monitor

    Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting (XSS) via file upload feature in Syllabus module.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Apr 9, 2024

  • CVE-2024-31309
    58Plan

    Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack

    HighCVSS 7.5No exploitEPSS 94%

    apache · traffic serverApr 10, 2024

  • CVE-2024-24809
    50Plan

    Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type

    HighCVSS 8.5WeaponizedEPSS 54%

    traccar · traccarApr 10, 2024

  • CVE-2024-27474
    35Monitor

    Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF).

    HighCVSS 8.8Proof of conceptEPSS 0%

    leantime · leantimeApr 10, 2024

  • CVE-2024-29296
    21Monitor

    A user enumeration vulnerability was found in Portainer CE 2.19.4.

    MediumCVSS 5.3Proof of conceptEPSS 1%

    portainer · portainerApr 10, 2024

  • CVE-2024-1520
    53Plan

    OS Command Injection in parisneo/lollms-webui

    CriticalCVSS 9.8No exploitEPSS 48%

    lollms · lollms web uiApr 10, 2024

  • CVE-2024-1600
    47Plan

    Local File Inclusion in parisneo/lollms-webui

    CriticalCVSS 9.3No exploitEPSS 32%

    lollms · lollms web uiApr 10, 2024

  • CVE-2024-1728
    56Plan

    Local File Inclusion in gradio-app/gradio

    HighCVSS 7.5Proof of conceptEPSS 85%

    gradio project · gradioApr 10, 2024

  • CVE-2024-3385
    30Monitor

    PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled

    HighCVSS 7.5No exploitEPSS 0%

    paloaltonetworks · pan-osApr 10, 2024

  • CVE-2024-3568
    39Monitor

    Arbitrary Code Execution via Deserialization in huggingface/transformers

    CriticalCVSS 9.6Proof of conceptEPSS 2%

    huggingface · transformersApr 10, 2024

  • CVE-2024-31214
    60This week

    Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution

    CriticalCVSS 9.6WeaponizedEPSS 17%

    traccar · traccarApr 10, 2024

  • CVE-2024-29269
    37Monitor

    An issue discovered in Telesquare TLR-2005Ksh 1.0.0 and 1.1.4 allows attackers to run arbitrary system commands via the Cmd parameter.

    HighCVSS 8.8Proof of conceptEPSS 6%

    telesquare · tlr-2005ksh firmwareApr 10, 2024

  • CVE-2024-31465
    58Plan

    XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet

    HighCVSS 8.8No exploitEPSS 75%

    xwiki · xwikiApr 10, 2024