By publication date

Exploited and new serious CVEs: May 2024

266 records · 13 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 3

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2024-4442Proof of concept	Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletionsalonbookingsystem · salon booking system · CWE-22 pre-auth RCE Path traversal	Critical9.1	—	1.2%	May 21, 2024
17Monitor	CVE-2024-4875Proof of concept	HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Updatehasthemes · ht mega · CWE-862 Broken access control (IDOR)	Medium4.3	—	0.7%	May 21, 2024
47Plan	CVE-2023-52755No exploit	ksmbd: fix slab out of bounds write in smb_inherit_dacl()linux · linux kernel · CWE-787 Pre-auth Memory safety	Critical9.8	—	28.1%	May 21, 2024
46Plan	CVE-2024-27130Proof of concept	A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.qnap · qts · CWE-120 Memory safety	High8.8	—	37.5%	May 21, 2024
25Monitor	CVE-2024-36039Proof of concept	PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.CWE-89 SQL injection	Medium6.3	—	0.6%	May 21, 2024
29Monitor	CVE-2024-22274Proof of concept	The vCenter Server contains an authenticated remote code execution vulnerability.vmware · cloud foundation · CWE-94 RCE	High7.2	—	2.5%	May 21, 2024
19Monitor	CVE-2024-22275Proof of concept	The vCenter Server contains a partial file read vulnerability.vmware · cloud foundation · CWE-200 Info leak	Medium4.9	—	0.9%	May 21, 2024
36Monitor	CVE-2024-31989Proof of concept	ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cacheargoproj · argo cd · CWE-327 Weak crypto	Critical9.0	—	1.4%	May 21, 2024
61This week	CVE-2024-21683Weaponized	This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.atlassian · confluence data center · CWE-94 RCE	High8.8	—	88.2%	May 21, 2024
33Monitor	CVE-2024-4443Proof of concept	Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameterbusinessdirectoryplugin · business directory · CWE-89 Pre-auth SQL injection	High7.5	—	10.3%	May 22, 2024
22Monitor	CVE-2021-47465No exploit	KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()linux · linux kernel · CWE-674 Denial of service	Medium5.5	—	0.2%	May 22, 2024
35Monitor	CVE-2024-4157Proof of concept	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValuesfluentforms · contact form · CWE-502 Deserialization	High8.8	—	0.6%	May 22, 2024
43Plan	CVE-2024-3495Proof of concept	Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injectiontrustyplugins · country state city dropdown cf7 · CWE-89 Pre-auth SQL injection	Critical9.8	—	13.6%	May 22, 2024
27Monitor	CVE-2024-5195No exploit	Arris VAP2500 diag_s.php command injectionarris · vap2500 firmware · CWE-77 RCE Command injection	Medium5.1	—	23.5%	May 22, 2024
27Monitor	CVE-2024-5196No exploit	Arris VAP2500 tools_command.php command injectionarris · vap2500 firmware · CWE-77 RCE Command injection	Medium5.1	—	23.5%	May 22, 2024
33Monitor	CVE-2024-33222No exploit	An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execuCWE-782 RCE Local privilege escalation	High8.4	—	0.1%	May 22, 2024
24Monitor	CVE-2024-35627Proof of concept	tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.CWE-79 Pre-auth XSS	Medium6.1	—	0.9%	May 22, 2024
26Monitor	CVE-2024-22026Proof of concept	A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and executivanti · endpoint manager mobile · CWE-284 RCE Local privilege escalation Broken access control (IDOR)	Medium6.7	—	1.0%	May 22, 2024
51Plan	CVE-2024-29849Proof of concept	Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.veeam · veeam backup \& replication · CWE-287 Pre-auth Auth bypass	Critical9.8	—	38.6%	May 22, 2024
72This week	CVE-2024-4978Weaponized	Malicious Code in Justice AV Solutions (JAVS) Viewerjavs · javs viewer · CWE-506	High8.7	KEV	26.9%	May 22, 2024
33Monitor	CVE-2024-5230Proof of concept	EnvaySoft FleetCart information disclosureenvaysoft · fleetcart · CWE-200 Pre-auth Info leak	Medium6.9	—	18.7%	May 22, 2024
37Monitor	CVE-2024-4399Proof of concept	CAS <= 1.0.0 - Unauthenticated SSRFapereo · central authentication service · CWE-918 Pre-auth SSRF	Critical9.1	—	1.8%	May 23, 2024
60This week	CVE-2024-5084Weaponized	Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionhashthemes · hash form · CWE-434 pre-auth RCE File upload	Critical9.8	—	50.9%	May 23, 2024
30Monitor	CVE-2024-5243Proof of concept	TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerabilitytp-link · omada er605 firmware · CWE-120 pre-auth RCE Memory safety	High7.5	—	0.8%	May 23, 2024
44Plan	CVE-2024-5246Proof of concept	NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerabilitynetgear · prosafe network management software 300 · CWE-1395 RCE	High8.8	—	31.3%	May 23, 2024
43Plan	CVE-2024-5247No exploit	NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerabilitynetgear · prosafe network management system · CWE-434 RCE File upload	High8.8	—	26.9%	May 23, 2024
46Plan	CVE-2024-5315Proof of concept	Multiple vulnerabilities in DOLIBARR's ERP CMSdolibarr · dolibarr erp\/crm · CWE-89 Pre-auth SQL injection	Critical9.1	—	34.5%	May 24, 2024
24Monitor	CVE-2024-4455Proof of concept	YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scriptingyithemes · yith woocommerce ajax search · CWE-79 Pre-auth XSS	Medium6.1	—	1.0%	May 24, 2024
31Monitor	CVE-2021-47553No exploit	sched/scs: Reset task stack state in bringup_cpu()linux · linux kernel · CWE-908 Memory safety	High7.8	—	0.2%	May 24, 2024
17Monitor	CVE-2023-46442Proof of concept	An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).CWE-400 Denial of service	Medium4.3	—	0.9%	May 24, 2024
26Monitor	CVE-2024-36079Proof of concept	An issue was discovered in Vaultize 21.07.27.CWE-22 Path traversal	Medium6.5	—	0.5%	May 24, 2024
21Monitor	CVE-2024-30056Proof of concept	Microsoft Edge (Chromium-based) Information Disclosure Vulnerabilitymicrosoft · edge chromium · CWE-359 Pre-auth Info leak	Medium5.4	—	1.5%	May 25, 2024
21Monitor	CVE-2024-5356Proof of concept	anji-plus AJ-Report testTransform;swagger-ui sql injectionanji-plus · aj-report · CWE-89 SQL injection	Medium5.3	—	1.0%	May 26, 2024
34Monitor	CVE-2024-35219Proof of concept	OpenAPI Generator Online - Arbitrary File Read/Deleteopenapitools · openapi-generator · CWE-22 Path traversal	High8.3	—	3.5%	May 27, 2024
34Monitor	CVE-2024-29415Proof of concept	The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, CWE-918 Pre-auth SSRF	High8.1	—	8.2%	May 27, 2024
37Monitor	CVE-2024-5410No exploit	Stored Cross-Site Scriptingoringnet · iap-420 firmware · CWE-79 Pre-auth XSS	High8.3	—	13.7%	May 28, 2024
41Plan	CVE-2024-5411No exploit	Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.Toringnet · iap-420 firmware · CWE-78 RCE Command injection	High8.7	—	23.4%	May 28, 2024
31Monitor	CVE-2024-24684Proof of concept	Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.libigl · libigl · CWE-121 Memory safety	High7.8	—	0.7%	May 28, 2024
31Monitor	CVE-2024-24685Proof of concept	Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.libigl · libigl · CWE-121 Memory safety	High7.8	—	0.5%	May 28, 2024
31Monitor	CVE-2024-24686Proof of concept	Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.libigl · libigl · CWE-121 Memory safety	High7.8	—	0.5%	May 28, 2024
40Plan	CVE-2024-35397No exploit	TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the totolink · cp900l firmware · CWE-77 pre-auth RCE Command injection	High8.8	—	15.0%	May 28, 2024
70This week	CVE-2024-5274Weaponized	Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a cragoogle · chrome · CWE-843 pre-auth RCE	Critical9.6	KEV	7.7%	May 28, 2024
28Monitor	CVE-2024-30212Proof of concept	Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE commandmicrochip · mplab® harmony 3 core module · CWE-190 Memory safety	High7.0	—	0.5%	May 28, 2024
43Plan	CVE-2024-34854No exploit	F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`f-logic · datacube3 firmware · CWE-22 Pre-auth Path traversal	Critical9.8	—	12.7%	May 28, 2024
94Now	CVE-2024-24919Weaponized	Information disclosurecheckpoint · quantum spark firmware · CWE-200 Pre-auth Info leak	High8.6	KEV	99.9%	May 28, 2024
32Monitor	CVE-2023-46694Proof of concept	Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands.CWE-434 File upload	High8.1	—	0.9%	May 28, 2024
30Monitor	CVE-2024-22641Proof of concept	TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.tcpdf project · tcpdf · CWE-434 Pre-auth File upload Denial of service	High7.5	—	1.1%	May 28, 2024
18Monitor	CVE-2024-35511Proof of concept	phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php.phpgurukul · men salon management system · CWE-89 SQL injection	Medium4.7	—	0.3%	May 28, 2024
98Now	CVE-2024-4358Weaponized	Registration Authentication Bypass Vulnerabilitytelerik · report server 2024 · CWE-290 Pre-auth Auth bypass	Critical9.8	KEV	97.4%	May 29, 2024
33Monitor	CVE-2024-35333Proof of concept	A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3.CWE-121 RCE Memory safety	High8.4	—	0.3%	May 29, 2024
34Monitor	CVE-2024-36114Proof of concept	Decompressors can crash the JVM and leak memory content in Aircompressorairlift · aircompressor · CWE-125 Pre-auth Memory safety	High8.6	—	0.5%	May 29, 2024
35Monitor	CVE-2024-5326Proof of concept	Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Updatewpxpo · post grid gutenberg blocks for news, magazines, blog websites – postx · CWE-862 Broken access control (IDOR)	High8.8	—	1.4%	May 30, 2024
31Monitor	CVE-2024-36886Proof of concept	tipc: fix UAF in error pathlinux · linux kernel · CWE-416 Memory safety	High7.8	—	1.3%	May 30, 2024
37Monitor	CVE-2024-3300Proof of concept	Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024dassault systèmes · delmia apriso · CWE-502 pre-auth RCE Deserialization	Critical9.0	—	2.8%	May 30, 2024
21Monitor	CVE-2024-35468Proof of concept	A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitraryoretnom23 · human resource management system · CWE-89 RCE SQL injection	Medium5.4	—	0.3%	May 30, 2024
39Monitor	CVE-2024-35469Proof of concept	A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQLoretnom23 · human resource management system · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	0.6%	May 30, 2024
62This week	CVE-2024-37032Weaponized	Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandlesollama · ollama · CWE-22 Path traversal	High8.8	—	89.6%	May 31, 2024
99Now	CVE-2024-23692Weaponized	Rejetto HTTP File Server 2.3m Unauthenticated RCErejetto · http file server · CWE-1336 pre-auth RCE SSTI	Critical9.8	KEV	99.4%	May 31, 2024
37Monitor	CVE-2024-5565No exploit	Prompt Injection in "ask" API with visualization leads to RCECWE-94 pre-auth RCE	High8.1	—	15.1%	May 31, 2024
54Plan	CVE-2024-29822No exploit	An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samivanti · endpoint manager · CWE-89 pre-auth RCE SQL injection	High8.8	—	64.3%	May 31, 2024
65This week	CVE-2024-29823No exploit	An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samivanti · endpoint manager · CWE-89 pre-auth RCE SQL injection	High8.8	—	99.8%	May 31, 2024
95Now	CVE-2024-29824Weaponized	An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samivanti · endpoint manager · CWE-89 pre-auth RCE SQL injection	High8.8	KEV	99.9%	May 31, 2024
65This week	CVE-2024-29825No exploit	An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samivanti · endpoint manager · CWE-89 pre-auth RCE SQL injection	High8.8	—	99.8%	May 31, 2024
65This week	CVE-2024-29826No exploit	An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samivanti · endpoint manager · CWE-89 pre-auth RCE SQL injection	High8.8	—	99.8%	May 31, 2024
57Plan	CVE-2024-29827No exploit	An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samivanti · endpoint manager · CWE-89 pre-auth RCE SQL injection	High8.8	—	71.6%	May 31, 2024
47Plan	CVE-2024-29848No exploit	An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execivanti · avalanche · CWE-434 RCE File upload	High7.2	—	64.4%	May 31, 2024

CVE-2024-4442
36Monitor
Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletion
CriticalCVSS 9.1Proof of conceptEPSS 1%
- pre-auth RCE
- Path traversal
salonbookingsystem · salon booking systemMay 21, 2024
CVE-2024-4875
17Monitor
HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update
MediumCVSS 4.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
hasthemes · ht megaMay 21, 2024
CVE-2023-52755
47Plan
ksmbd: fix slab out of bounds write in smb_inherit_dacl()
CriticalCVSS 9.8No exploitEPSS 28%
- Pre-auth
- Memory safety
linux · linux kernelMay 21, 2024
CVE-2024-27130
46Plan
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions.
HighCVSS 8.8Proof of conceptEPSS 37%
- Memory safety
qnap · qtsMay 21, 2024
CVE-2024-36039
25Monitor
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
MediumCVSS 6.3Proof of conceptEPSS 0%
- SQL injection
May 21, 2024
CVE-2024-22274
29Monitor
The vCenter Server contains an authenticated remote code execution vulnerability.
HighCVSS 7.2Proof of conceptEPSS 2%
- RCE
vmware · cloud foundationMay 21, 2024
CVE-2024-22275
19Monitor
The vCenter Server contains a partial file read vulnerability.
MediumCVSS 4.9Proof of conceptEPSS 0%
- Info leak
vmware · cloud foundationMay 21, 2024
CVE-2024-31989
36Monitor
ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
CriticalCVSS 9.0Proof of conceptEPSS 1%
- Weak crypto
argoproj · argo cdMay 21, 2024
CVE-2024-21683
61This week
This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.
HighCVSS 8.8WeaponizedEPSS 88%
- RCE
atlassian · confluence data centerMay 21, 2024
CVE-2024-4443
33Monitor
Business Directory Plugin – Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter
HighCVSS 7.5Proof of conceptEPSS 10%
- Pre-auth
- SQL injection
businessdirectoryplugin · business directoryMay 22, 2024
CVE-2021-47465
22Monitor
KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
MediumCVSS 5.5No exploitEPSS 0%
- Denial of service
linux · linux kernelMay 22, 2024
CVE-2024-4157
35Monitor
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues
HighCVSS 8.8Proof of conceptEPSS 0%
- Deserialization
fluentforms · contact formMay 22, 2024
CVE-2024-3495
43Plan
Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection
CriticalCVSS 9.8Proof of conceptEPSS 13%
- Pre-auth
- SQL injection
trustyplugins · country state city dropdown cf7May 22, 2024
CVE-2024-5195
27Monitor
Arris VAP2500 diag_s.php command injection
MediumCVSS 5.1No exploitEPSS 23%
- RCE
- Command injection
arris · vap2500 firmwareMay 22, 2024
CVE-2024-5196
27Monitor
Arris VAP2500 tools_command.php command injection
MediumCVSS 5.1No exploitEPSS 23%
- RCE
- Command injection
arris · vap2500 firmwareMay 22, 2024
CVE-2024-33222
33Monitor
An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execu
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Local privilege escalation
May 22, 2024
CVE-2024-35627
24Monitor
tileserver-gl up to v4.4.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /data/v3/?key.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
May 22, 2024
CVE-2024-22026
26Monitor
A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execut
MediumCVSS 6.7Proof of conceptEPSS 1%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
ivanti · endpoint manager mobileMay 22, 2024
CVE-2024-29849
51Plan
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
CriticalCVSS 9.8Proof of conceptEPSS 38%
- Pre-auth
- Auth bypass
veeam · veeam backup \& replicationMay 22, 2024
CVE-2024-4978
72This week
Malicious Code in Justice AV Solutions (JAVS) Viewer
HighCVSS 8.7KEVWeaponizedEPSS 26%
javs · javs viewerMay 22, 2024
CVE-2024-5230
33Monitor
EnvaySoft FleetCart information disclosure
MediumCVSS 6.9Proof of conceptEPSS 18%
- Pre-auth
- Info leak
envaysoft · fleetcartMay 22, 2024
CVE-2024-4399
37Monitor
CAS <= 1.0.0 - Unauthenticated SSRF
CriticalCVSS 9.1Proof of conceptEPSS 1%
- Pre-auth
- SSRF
apereo · central authentication serviceMay 23, 2024
CVE-2024-5084
60This week
Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
CriticalCVSS 9.8WeaponizedEPSS 50%
- pre-auth RCE
- File upload
hashthemes · hash formMay 23, 2024
CVE-2024-5243
30Monitor
TP-Link Omada ER605 Buffer Overflow Remote Code Execution Vulnerability
HighCVSS 7.5Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
tp-link · omada er605 firmwareMay 23, 2024
CVE-2024-5246
44Plan
NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability
HighCVSS 8.8Proof of conceptEPSS 31%
- RCE
netgear · prosafe network management software 300May 23, 2024
CVE-2024-5247
43Plan
NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 26%
- RCE
- File upload
netgear · prosafe network management systemMay 23, 2024
CVE-2024-5315
46Plan
Multiple vulnerabilities in DOLIBARR's ERP CMS
CriticalCVSS 9.1Proof of conceptEPSS 34%
- Pre-auth
- SQL injection
dolibarr · dolibarr erp\/crmMay 24, 2024
CVE-2024-4455
24Monitor
YITH WooCommerce Ajax Search <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
yithemes · yith woocommerce ajax searchMay 24, 2024
CVE-2021-47553
31Monitor
sched/scs: Reset task stack state in bringup_cpu()
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linux kernelMay 24, 2024
CVE-2023-46442
17Monitor
An infinite loop in the retrieveActiveBody function of Soot before v4.4.1 under Java 8 allows attackers to cause a Denial of Service (DoS).
MediumCVSS 4.3Proof of conceptEPSS 0%
- Denial of service
May 24, 2024
CVE-2024-36079
26Monitor
An issue was discovered in Vaultize 21.07.27.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Path traversal
May 24, 2024
CVE-2024-30056
21Monitor
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
MediumCVSS 5.4Proof of conceptEPSS 1%
- Pre-auth
- Info leak
microsoft · edge chromiumMay 25, 2024
CVE-2024-5356
21Monitor
anji-plus AJ-Report testTransform;swagger-ui sql injection
MediumCVSS 5.3Proof of conceptEPSS 1%
- SQL injection
anji-plus · aj-reportMay 26, 2024
CVE-2024-35219
34Monitor
OpenAPI Generator Online - Arbitrary File Read/Delete
HighCVSS 8.3Proof of conceptEPSS 3%
- Path traversal
openapitools · openapi-generatorMay 27, 2024
CVE-2024-29415
34Monitor
The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01,
HighCVSS 8.1Proof of conceptEPSS 8%
- Pre-auth
- SSRF
May 27, 2024
CVE-2024-5410
37Monitor
Stored Cross-Site Scripting
HighCVSS 8.3No exploitEPSS 13%
- Pre-auth
- XSS
oringnet · iap-420 firmwareMay 28, 2024
CVE-2024-5411
41Plan
Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.T
HighCVSS 8.7No exploitEPSS 23%
- RCE
- Command injection
oringnet · iap-420 firmwareMay 28, 2024
CVE-2024-24684
31Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
libigl · libiglMay 28, 2024
CVE-2024-24685
31Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
libigl · libiglMay 28, 2024
CVE-2024-24686
31Monitor
Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0.
HighCVSS 7.8Proof of conceptEPSS 0%
- Memory safety
libigl · libiglMay 28, 2024
CVE-2024-35397
40Plan
TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the
HighCVSS 8.8No exploitEPSS 15%
- pre-auth RCE
- Command injection
totolink · cp900l firmwareMay 28, 2024
CVE-2024-5274
70This week
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra
CriticalCVSS 9.6KEVWeaponizedEPSS 7%
- pre-auth RCE
google · chromeMay 28, 2024
CVE-2024-30212
28Monitor
Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
HighCVSS 7.0Proof of conceptEPSS 0%
- Memory safety
microchip · mplab® harmony 3 core moduleMay 28, 2024
CVE-2024-34854
43Plan
F-logic DataCube3 v1.0 is vulnerable to File Upload via `/admin/transceiver_schedule.php.`
CriticalCVSS 9.8No exploitEPSS 12%
- Pre-auth
- Path traversal
f-logic · datacube3 firmwareMay 28, 2024
CVE-2024-24919
94Now
Information disclosure
HighCVSS 8.6KEVWeaponizedEPSS 99%
- Pre-auth
- Info leak
checkpoint · quantum spark firmwareMay 28, 2024
CVE-2023-46694
32Monitor
Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote commands.
HighCVSS 8.1Proof of conceptEPSS 0%
- File upload
May 28, 2024
CVE-2024-22641
30Monitor
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- File upload
- Denial of service
tcpdf project · tcpdfMay 28, 2024
CVE-2024-35511
18Monitor
phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/index.php.
MediumCVSS 4.7Proof of conceptEPSS 0%
- SQL injection
phpgurukul · men salon management systemMay 28, 2024
CVE-2024-4358
98Now
Registration Authentication Bypass Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 97%
- Pre-auth
- Auth bypass
telerik · report server 2024May 29, 2024
CVE-2024-35333
33Monitor
A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3.
HighCVSS 8.4Proof of conceptEPSS 0%
- RCE
- Memory safety
May 29, 2024
CVE-2024-36114
34Monitor
Decompressors can crash the JVM and leak memory content in Aircompressor
HighCVSS 8.6Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
airlift · aircompressorMay 29, 2024
CVE-2024-5326
35Monitor
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update
HighCVSS 8.8Proof of conceptEPSS 1%
- Broken access control (IDOR)
wpxpo · post grid gutenberg blocks for news, magazines, blog websites – postxMay 30, 2024
CVE-2024-36886
31Monitor
tipc: fix UAF in error path
HighCVSS 7.8Proof of conceptEPSS 1%
- Memory safety
linux · linux kernelMay 30, 2024
CVE-2024-3300
37Monitor
Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024
CriticalCVSS 9.0Proof of conceptEPSS 2%
- pre-auth RCE
- Deserialization
dassault systèmes · delmia aprisoMay 30, 2024
CVE-2024-35468
21Monitor
A SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- SQL injection
oretnom23 · human resource management systemMay 30, 2024
CVE-2024-35469
39Monitor
A SQL injection vulnerability in /hrm/user/ in SourceCodester Human Resource Management System 1.0 allows attackers to execute arbitrary SQL
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- SQL injection
oretnom23 · human resource management systemMay 30, 2024
CVE-2024-37032
62This week
Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles
HighCVSS 8.8WeaponizedEPSS 89%
- Path traversal
ollama · ollamaMay 31, 2024
CVE-2024-23692
99Now
Rejetto HTTP File Server 2.3m Unauthenticated RCE
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- SSTI
rejetto · http file serverMay 31, 2024
CVE-2024-5565
37Monitor
Prompt Injection in "ask" API with visualization leads to RCE
HighCVSS 8.1No exploitEPSS 15%
- pre-auth RCE
May 31, 2024
CVE-2024-29822
54Plan
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam
HighCVSS 8.8No exploitEPSS 64%
- pre-auth RCE
- SQL injection
ivanti · endpoint managerMay 31, 2024
CVE-2024-29823
65This week
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam
HighCVSS 8.8No exploitEPSS 99%
- pre-auth RCE
- SQL injection
ivanti · endpoint managerMay 31, 2024
CVE-2024-29824
95Now
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam
HighCVSS 8.8KEVWeaponizedEPSS 99%
- pre-auth RCE
- SQL injection
ivanti · endpoint managerMay 31, 2024
CVE-2024-29825
65This week
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam
HighCVSS 8.8No exploitEPSS 99%
- pre-auth RCE
- SQL injection
ivanti · endpoint managerMay 31, 2024
CVE-2024-29826
65This week
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam
HighCVSS 8.8No exploitEPSS 99%
- pre-auth RCE
- SQL injection
ivanti · endpoint managerMay 31, 2024
CVE-2024-29827
57Plan
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam
HighCVSS 8.8No exploitEPSS 71%
- pre-auth RCE
- SQL injection
ivanti · endpoint managerMay 31, 2024
CVE-2024-29848
47Plan
An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to exec
HighCVSS 7.2No exploitEPSS 64%
- RCE
- File upload
ivanti · avalancheMay 31, 2024