Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: May 2024

264 records · 13 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

  • CVE-2023-43040
    40Plan

    IBM Spectrum Fusion HCI improper access control

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    ibm · storage fusion hciMay 14, 2024

  • CVE-2023-46870
    29Monitor

    extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1

    HighCVSS 7.3Proof of conceptEPSS 0%

    May 14, 2024

  • CVE-2023-52654
    18Monitor

    io_uring/af_unix: disable sending io_uring over sockets

    MediumCVSS 4.7Proof of conceptEPSS 0%

    linux · linux kernelMay 14, 2024

  • CVE-2024-0087
    41Plan

    NVIDIA Triton Inference Server for Linux contains a vulnerability where a user can set the logging location to an arbitrary file.

    HighCVSS 8.8No exploitEPSS 19%

    nvidia · triton inference serverMay 14, 2024

  • CVE-2024-0088
    38Monitor

    NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an improper memory access is

    HighCVSS 8.1No exploitEPSS 18%

    nvidia · triton inference serverMay 14, 2024

  • CVE-2024-22774
    31Monitor

    An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.ex

    HighCVSS 7.8Proof of conceptEPSS 0%

    May 14, 2024

  • CVE-2024-25641
    54Plan

    Cacti RCE vulnerability when importing packages

    HighCVSS 7.2WeaponizedEPSS 86%

    cacti · cactiMay 14, 2024

  • CVE-2024-27398
    31Monitor

    Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelMay 14, 2024

  • CVE-2024-27460
    27Monitor

    A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below.

    MediumCVSS 6.7Proof of conceptEPSS 1%

    hp · poly plantronics hubMay 14, 2024

  • CVE-2024-27804
    22Monitor

    The issue was addressed with improved memory handling.

    MediumCVSS 5.5Proof of conceptEPSS 1%

    apple · ipadosMay 14, 2024

  • CVE-2024-27821
    18Monitor

    A path handling issue was addressed with improved validation.

    MediumCVSS 4.7Proof of conceptEPSS 0%

    apple · ipadosMay 14, 2024

  • CVE-2024-27822
    40Plan

    A logic issue was addressed with improved restrictions.

    HighCVSS 7.8WeaponizedEPSS 1%

    apple · macosMay 14, 2024

  • CVE-2024-28075
    55Plan

    SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution

    HighCVSS 8.0No exploitEPSS 78%

    solarwinds · access rights managerMay 14, 2024

  • CVE-2024-29895
    70This week

    Cacti command injection in cmd_realtime.php

    CriticalCVSS 10.0Proof of conceptEPSS 98%

    cacti · cactiMay 14, 2024

  • CVE-2024-2257
    36Monitor

    Password Policy Bypass Vulnerability in Digisol Router

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    digisol · digisol router dg-gr1321May 14, 2024

  • CVE-2024-2454
    36Monitor

    Allocation of Resources Without Limits or Throttling in GitLab

    MediumCVSS 6.5No exploitEPSS 33%

    gitlab · gitlabMay 14, 2024

  • CVE-2024-2651
    36Monitor

    Inefficient Regular Expression Complexity in GitLab

    MediumCVSS 6.5No exploitEPSS 33%

    gitlab · gitlabMay 14, 2024

  • CVE-2024-31444
    25Monitor

    Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database

    MediumCVSS 5.4No exploitEPSS 14%

    cacti · cactiMay 14, 2024

  • CVE-2024-31445
    43Plan

    SQL Injection vulnerability in automation_get_new_graphs_sql

    HighCVSS 8.8No exploitEPSS 26%

    cacti · cactiMay 14, 2024

  • CVE-2024-31458
    36Monitor

    Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database

    HighCVSS 8.0No exploitEPSS 12%

    cacti · cactiMay 14, 2024

  • CVE-2024-31771
    31Monitor

    Insecure Permission vulnerability in TotalAV v.6.0.740 allows a local attacker to escalate privileges via a crafted file

    HighCVSS 7.8Proof of conceptEPSS 0%

    totalav · totalavMay 14, 2024

  • CVE-2024-32700
    41Plan

    WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 2%

    kognetiks · kognetiks chatbot for wordpressMay 14, 2024

  • CVE-2024-32735
    41Plan

    CyberPower PowerPanel Enterprise Missing Authentication

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    cyberpower · powerpanelMay 14, 2024

  • CVE-2024-32736
    32Monitor

    CyberPower PowerPanel Enterprise SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 5%

    cyberpower · powerpanelMay 14, 2024

  • CVE-2024-32737
    32Monitor

    CyberPower PowerPanel Enterprise SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 5%

    cyberpower · powerpanelMay 14, 2024

  • CVE-2024-32738
    31Monitor

    CyberPower PowerPanel Enterprise SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 4%

    cyberpower · powerpanelMay 14, 2024

  • CVE-2024-32739
    32Monitor

    CyberPower PowerPanel Enterprise SQL Injection

    HighCVSS 7.5Proof of conceptEPSS 5%

    cyberpower · powerpanelMay 14, 2024

  • CVE-2024-32964
    52Plan

    lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

    CriticalCVSS 9.0Proof of conceptEPSS 52%

    lobehub · lobe chatMay 14, 2024

  • CVE-2024-34070
    38Monitor

    Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise

    CriticalCVSS 9.6Proof of conceptEPSS 0%

    froxlor · froxlorMay 14, 2024

  • CVE-2024-34218
    20Monitor

    TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost functio

    LowCVSS 3.8No exploitEPSS 17%

    totolink · cp450 firmwareMay 14, 2024

  • CVE-2024-34219
    40Plan

    TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log

    HighCVSS 8.6No exploitEPSS 20%

    totolink · cp450 firmwareMay 14, 2024

  • CVE-2024-34220
    30Monitor

    Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the 'leave' parameter.

    HighCVSS 7.5Proof of conceptEPSS 0%

    oretnom23 · human resource management systemMay 14, 2024

  • CVE-2024-34221
    35Monitor

    Sourcecodester Human Resource Management System 1.0 is vulnerable to Insecure Permissions resulting in privilege escalation.

    HighCVSS 8.8Proof of conceptEPSS 0%

    oretnom23 · human resource management systemMay 14, 2024

  • CVE-2024-34222
    23Monitor

    Sourcecodester Human Resource Management System 1.0 is vulnerable to SQL Injection via the searccountry parameter.

    MediumCVSS 5.9Proof of conceptEPSS 0%

    oretnom23 · human resource management systemMay 14, 2024

  • CVE-2024-34223
    17Monitor

    Insecure permission vulnerability in /hrm/leaverequest.php in SourceCodester Human Resource Management System 1.0 allow attackers to approve

    MediumCVSS 4.3Proof of conceptEPSS 0%

    oretnom23 · human resource management systemMay 14, 2024

  • CVE-2024-34224
    29Monitor

    Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 all

    HighCVSS 7.3Proof of conceptEPSS 0%

    oretnom23 · computer laboratory management systemMay 14, 2024

  • CVE-2024-34225
    24Monitor

    Cross Site Scripting vulnerability in php-lms/admin/?page=system_info in Computer Laboratory Management System using PHP and MySQL 1.0 allow

    MediumCVSS 6.1Proof of conceptEPSS 0%

    oretnom23 · computer laboratory management systemMay 14, 2024

  • CVE-2024-34226
    37Monitor

    SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to

    CriticalCVSS 9.4Proof of conceptEPSS 0%

    oretnom23 · visitor management systemMay 14, 2024

  • CVE-2024-34310
    35Monitor

    Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter.

    HighCVSS 8.8Proof of conceptEPSS 0%

    May 14, 2024

  • CVE-2024-34351
    32Monitor

    Next.js Server-Side Request Forgery in Server Actions

    HighCVSS 7.5Proof of conceptEPSS 5%

    vercel · next.jsMay 14, 2024

  • CVE-2024-34359
    46Plan

    llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata

    CriticalCVSS 9.6No exploitEPSS 26%

    abetlen · llama-cpp-pythonMay 14, 2024

  • CVE-2024-35205
    31Monitor

    The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them t

    HighCVSS 7.8Proof of conceptEPSS 0%

    May 14, 2024

  • CVE-2024-3806
    40Plan

    Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    p-themes · portoMay 14, 2024

  • CVE-2024-4041
    24Monitor

    Yoast SEO <= 22.5 - Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 0%

    yoast · yoast seo – advanced seo with real-time guidance and built-in aiMay 14, 2024

  • CVE-2024-4044
    35Monitor

    Deserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudio

    HighCVSS 7.8No exploitEPSS 14%

    ni · flexloggerMay 14, 2024

  • CVE-2024-4068
    30Monitor

    Memory Exhaustion in braces

    HighCVSS 7.5No exploitEPSS 1%

    jonschlinkert · bracesMay 14, 2024

  • CVE-2024-4231
    27Monitor

    Incorrect Access Control Vulnerability in Digisol Router

    MediumCVSS 6.8Proof of conceptEPSS 0%

    digisol · digisol router dg-gr1321May 14, 2024

  • CVE-2024-4232
    21Monitor

    Password Storage in Plaintext Vulnerability in Digisol Router

    MediumCVSS 5.4Proof of conceptEPSS 0%

    digisol · digisol router dg-gr1321May 14, 2024

  • CVE-2024-4434
    50Plan

    LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    thimpress · learnpressMay 14, 2024

  • CVE-2024-4671
    71This week

    Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to pot

    CriticalCVSS 9.6KEVWeaponizedEPSS 8%

    google · chromeMay 14, 2024

  • CVE-2024-4701
    46Plan

    Path Traversal vulnerability via File Uploads in Genie

    CriticalCVSS 9.9Proof of conceptEPSS 24%

    netflix · genieMay 14, 2024

  • CVE-2024-0762
    31Monitor

    Potential buffer overflow when handling UEFI variables

    HighCVSS 7.8Proof of conceptEPSS 0%

    intel · celeron 3865uMay 14, 2024

  • CVE-2024-34716
    41Plan

    PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

    MediumCVSS 6.1Proof of conceptEPSS 56%

    prestashop · prestashopMay 14, 2024

  • CVE-2024-4761
    68This week

    Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a

    HighCVSS 8.8KEVWeaponizedEPSS 11%

    google · chromeMay 14, 2024

  • CVE-2023-24203
    21Monitor

    Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary

    MediumCVSS 5.4Proof of conceptEPSS 0%

    oretnom23 · simple customer relationship management systemMay 14, 2024

  • CVE-2024-30038
    40Plan

    Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8WeaponizedEPSS 2%

    microsoft · windows 10 1507May 14, 2024

  • CVE-2024-30040
    66This week

    Windows MSHTML Platform Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 3%

    microsoft · windows 10 1507May 14, 2024

  • CVE-2024-30043
    47Plan

    Microsoft SharePoint Server Information Disclosure Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 56%

    microsoft · sharepoint serverMay 14, 2024

  • CVE-2024-30044
    52Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 80%

    microsoft · sharepoint serverMay 14, 2024

  • CVE-2024-30050
    24Monitor

    Windows Mark of the Web Security Feature Bypass Vulnerability

    MediumCVSS 5.4No exploitEPSS 11%

    microsoft · windows 10 1507May 14, 2024

  • CVE-2024-30051
    63This week

    Windows DWM Core Library Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 5%

    microsoft · windows 10 1507May 14, 2024

  • CVE-2024-4367
    56Plan

    A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.

    HighCVSS 8.8Proof of conceptEPSS 70%

    mozilla · firefoxMay 14, 2024

  • CVE-2024-32002
    45Plan

    Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

    CriticalCVSS 9.0Proof of conceptEPSS 29%

    git · gitMay 14, 2024

  • CVE-2024-32004
    31Monitor

    Git vulnerable to Remote Code Execution while cloning special-crafted local repositories

    HighCVSS 7.8Proof of conceptEPSS 1%

    git-scm · gitMay 14, 2024

  • CVE-2024-3822
    19Monitor

    Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS

    MediumCVSS 4.8Proof of conceptEPSS 0%

    mranderson · base64 encoder\/decoderMay 15, 2024

  • CVE-2024-4947
    73This week

    Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf

    CriticalCVSS 9.6KEVWeaponizedEPSS 15%

    google · chromeMay 15, 2024

  • CVE-2024-3435
    33Monitor

    Path Traversal in parisneo/lollms-webui

    HighCVSS 8.4Proof of conceptEPSS 0%

    lollms · lollms web uiMay 16, 2024

  • CVE-2024-3848
    43Plan

    Path Traversal Bypass in mlflow/mlflow

    HighCVSS 7.5Proof of conceptEPSS 43%

    lfprojects · mlflowMay 16, 2024

  • CVE-2024-4322
    39Monitor

    Path Traversal in parisneo/lollms-webui

    HighCVSS 7.5Proof of conceptEPSS 30%

    lollms · lollms web uiMay 16, 2024

  • CVE-2024-4391
    21Monitor

    Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widge

    MediumCVSS 5.4No exploitEPSS 0%

    leevio · happy addons for elementorMay 16, 2024

  • CVE-2024-4351
    35Monitor

    Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation

    HighCVSS 8.8Proof of conceptEPSS 1%

    themeum · tutor lmsMay 16, 2024

  • CVE-2024-4999
    41Plan

    Ligowave Unity/Pro/Mimo/APC Arbitrary Command Injection

    CriticalCVSS 9.4No exploitEPSS 12%

    ligowave · unityMay 16, 2024

  • CVE-2024-31142
    35Monitor

    x86: Incorrect logic for BTC/SRSO mitigations

    HighCVSS 7.5No exploitEPSS 17%

    xen · xenMay 16, 2024

  • CVE-2024-34582
    24Monitor

    Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    May 16, 2024

  • CVE-2024-34958
    26Monitor

    idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/banner_deal.php?mudi=add

    MediumCVSS 6.5Proof of conceptEPSS 0%

    idccms · idccmsMay 16, 2024

  • CVE-2024-35176
    22Monitor

    REXML contains a denial of service vulnerability

    MediumCVSS 5.3Proof of conceptEPSS 2%

    ruby-lang · rexmlMay 16, 2024

  • CVE-2024-3640
    28Monitor

    Rockwell Automation FactoryTalk® Remote Access™ has Unquoted Executables

    HighCVSS 7.0Proof of conceptEPSS 0%

    rockwell automation · factorytalk® remote access™May 16, 2024

  • CVE-2024-4956
    36Monitor

    Nexus Repository 3 - Path Traversal

    HighCVSS 7.5Proof of conceptEPSS 19%

    sonatype · nexus repositoryMay 16, 2024

  • CVE-2024-22476
    51Plan

    Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially

    CriticalCVSS 10.0Proof of conceptEPSS 35%

    May 16, 2024

  • CVE-2024-3231
    24Monitor

    Popup4Phone <= 1.3.2 - Unauthenticated Stored XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    ivanweb · popup4phoneMay 17, 2024

  • CVE-2023-37999
    40Plan

    WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    hasthemes · ht megaMay 17, 2024

  • CVE-2023-41954
    34Monitor

    WordPress ProfilePress plugin <= 4.13.1 - Unauthenticated Limited Privilege Escalation vulnerability

    HighCVSS 8.6Proof of conceptEPSS 1%

    properfraction · profilepressMay 17, 2024

  • CVE-2024-31351
    39Monitor

    WordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    copymatic · copymaticMay 17, 2024

  • CVE-2023-46197
    26Monitor

    WordPress Popup by Supsystic plugin <= 1.10.19 - Unauthenticated Subscriber Email Addresses Disclosure

    MediumCVSS 6.5Proof of conceptEPSS 1%

    supsystic · popupMay 17, 2024

  • CVE-2024-22145
    35Monitor

    WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    instawp · instawp connectMay 17, 2024

  • CVE-2024-24882
    40Plan

    WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    themegrill · masteriyoMay 17, 2024

  • CVE-2024-27954
    59Plan

    WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 72%

    wp automatic · automaticMay 17, 2024

  • CVE-2024-32507
    35Monitor

    WordPress Login with phone number plugin <= 1.7.16 - Privilege Escalation vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    hamid alinia · login with phone numberMay 17, 2024

  • CVE-2024-33644
    39Monitor

    WordPress Customify Site Library plugin <= 0.0.9 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    wpcustomify · customify site libraryMay 17, 2024

  • CVE-2024-34370
    28Monitor

    WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability

    HighCVSS 7.2Proof of conceptEPSS 1%

    wpfactory · ean for woocommerceMay 17, 2024

  • CVE-2024-22120
    58Plan

    Time Based SQL Injection in Zabbix Server Audit Log

    HighCVSS 8.8Proof of conceptEPSS 76%

    zabbix · zabbixMay 17, 2024

  • CVE-2024-32830
    30Monitor

    WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability

    HighCVSS 7.5Proof of conceptEPSS 0%

    themekraft · buddyformsMay 17, 2024

  • CVE-2024-34982
    40Plan

    An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code v

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    lylme · lylme spageMay 17, 2024

  • CVE-2024-31974
    25Monitor

    The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute

    MediumCVSS 6.3Proof of conceptEPSS 0%

    May 17, 2024

  • CVE-2024-34241
    19Monitor

    A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admi

    MediumCVSS 4.8Proof of conceptEPSS 0%

    rocketsoft · rocket lmsMay 17, 2024

  • CVE-2024-2771
    40Plan

    Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    fluentforms · contact formMay 18, 2024

  • CVE-2024-2782
    30Monitor

    Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation

    HighCVSS 7.5Proof of conceptEPSS 1%

    fluentforms · contact formMay 18, 2024

  • CVE-2024-4323
    47Plan

    Fluent Bit Memory Corruption Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 27%

    treasuredata · fluent bitMay 20, 2024

  • CVE-2024-33901
    26Monitor

    Issue in KeePassXC 2.7.7 allows an attacker (who has the privileges of the victim) to recover some passwords stored in the .kdbx database vi

    MediumCVSS 6.5Proof of conceptEPSS 0%

    keepassxc · keepassxcMay 20, 2024

  • CVE-2024-4875
    17Monitor

    HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update

    MediumCVSS 4.3Proof of conceptEPSS 0%

    hasthemes · ht megaMay 21, 2024