By publication date

Exploited and new serious CVEs: July 2024

186 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2024-4007Proof of concept	Hard coded default credential contained in install packageabb · aspect-ent-12 firmware · CWE-1392 Pre-auth Hard-coded credentials	High8.7	—	1.5%	Jul 1, 2024
21Monitor	CVE-2024-6050Proof of concept	Reflected XSS in SOWA OPACsokrates · sowa opac · CWE-79 Pre-auth XSS	Medium5.3	—	0.7%	Jul 1, 2024
99Now	CVE-2024-36401Weaponized	Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoservergeoserver · geoserver · CWE-95 pre-auth RCE	Critical9.8	KEV	99.8%	Jul 1, 2024
31Monitor	CVE-2024-36420Proof of concept	GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-fileflowiseai · flowise · CWE-74 Pre-auth	High7.5	—	1.7%	Jul 1, 2024
57Plan	CVE-2024-20399Weaponized	Cisco NX-OS Software CLI Command Injection Vulnerabilitycisco · nx-os · CWE-78 RCE Local privilege escalation Command injection	Medium6.7	KEV	4.3%	Jul 1, 2024
62This week	CVE-2024-6387Proof of concept	Openssh: regresshion - race condition in ssh allows rce/dossonicwall · sma 6200 firmware · CWE-364 pre-auth RCE Race condition	High8.1	—	99.5%	Jul 1, 2024
40Plan	CVE-2024-36985Weaponized	Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprisesplunk · splunk · CWE-687 RCE	High8.8	—	6.4%	Jul 1, 2024
34Monitor	CVE-2024-36991Proof of concept	Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windowssplunk · splunk · CWE-35 Pre-auth Path traversal	High7.5	—	13.0%	Jul 1, 2024
51Plan	CVE-2024-38472Proof of concept	Apache HTTP Server on WIndows UNC SSRFapache · http server · CWE-918 Pre-auth SSRF	High7.5	—	69.4%	Jul 1, 2024
40Plan	CVE-2024-38473Proof of concept	Apache HTTP Server proxy encoding problemapache · http server · CWE-116 Auth bypass	High8.1	—	25.8%	Jul 1, 2024
40Plan	CVE-2024-38474No exploit	Apache HTTP Server weakness with encoded question marks in backreferencesapache · http server · CWE-116 Pre-auth	Critical9.8	—	2.4%	Jul 1, 2024
96Now	CVE-2024-38475Weaponized	Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.apache · http server · CWE-116 Pre-auth	Critical9.1	KEV	99.9%	Jul 1, 2024
51Plan	CVE-2024-38476Proof of concept	Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirectapache · http server · CWE-829 Pre-auth SSRF	Critical9.8	—	41.6%	Jul 1, 2024
41Plan	CVE-2024-39573No exploit	Apache HTTP Server: mod_rewrite proxy handler substitutionapache · http server · CWE-20 Pre-auth SSRF	High7.5	—	37.1%	Jul 1, 2024
40Plan	CVE-2024-28200Proof of concept	N-central Authentication Bypassn-able · n-central · CWE-288 Pre-auth Auth bypass	Critical9.8	—	1.9%	Jul 1, 2024
45Plan	CVE-2024-38366Proof of concept	CoacoaPods trunk RCE in email verification system rfc-822cocoapods · trunk.cocoapods.org · CWE-74 pre-auth RCE	Critical10.0	—	17.7%	Jul 1, 2024
41Plan	CVE-2024-38367No exploit	CoacoaPods trunk sessions verification step could be manipulated for owner session hijackingcocoapods · trunk.cocoapods.org · CWE-488 Pre-auth	Critical9.6	—	11.1%	Jul 1, 2024
41Plan	CVE-2024-38368No exploit	Trunk's 'Claim your pod' could be used to obtain un-used podscocoapods · trunk.cocoapods.org · CWE-668 Pre-auth	Critical9.3	—	14.8%	Jul 1, 2024
39Monitor	CVE-2024-37762Proof of concept	MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.machform · machform · CWE-434 RCE File upload	Critical9.9	—	1.4%	Jul 1, 2024
21Monitor	CVE-2024-37763Proof of concept	MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can viemachform · machform · CWE-79 Pre-auth XSS	Medium5.4	—	0.6%	Jul 1, 2024
21Monitor	CVE-2024-37764Proof of concept	MachForm up to version 19 is affected by an authenticated stored cross-site scripting.machform · machform · CWE-79 XSS	Medium5.4	—	0.5%	Jul 1, 2024
35Monitor	CVE-2024-37765Proof of concept	Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.machform · machform · CWE-89 SQL injection	High8.8	—	0.8%	Jul 1, 2024
45Plan	CVE-2024-39309Proof of concept	ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerabilityparse-community · parse-server · CWE-89 Pre-auth Auth bypass SQL injection	Critical9.8	—	20.1%	Jul 1, 2024
31Monitor	CVE-2024-4836Proof of concept	LFI in sites managed by Edito CMSedito · edito cms · CWE-552 Pre-auth	High7.5	—	2.6%	Jul 2, 2024
62This week	CVE-2024-36404Proof of concept	GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressionsgeotools · geotools · CWE-95 pre-auth RCE	Critical9.8	—	76.0%	Jul 2, 2024
21Monitor	CVE-2024-39143Proof of concept	A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious propertcoderberg · residencecms · CWE-79 XSS	Medium5.4	—	0.9%	Jul 2, 2024
60This week	CVE-2024-39891Weaponized	In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access totwilio · authy · CWE-203 Pre-auth	Medium5.3	KEV	1.6%	Jul 2, 2024
22Monitor	CVE-2022-25477Proof of concept	Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Readrealtek · rtsper · CWE-532 Info leak	Medium5.5	—	0.2%	Jul 2, 2024
22Monitor	CVE-2022-25479Proof of concept	Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Readrealtek · rtsper · CWE-401 Denial of service	Medium5.5	—	0.6%	Jul 2, 2024
39Monitor	CVE-2024-38537Proof of concept	Inclusion of Untrusted polyfill.io Code Vulnerability in fides.jsethyca · fides · CWE-829 Pre-auth	Critical9.8	—	1.4%	Jul 2, 2024
47Plan	CVE-2024-32937No exploit	An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1grandstream · gxp2135 firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	26.9%	Jul 3, 2024
27Monitor	CVE-2024-37726Proof of concept	Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privilegesCWE-269 Local privilege escalation	Medium6.8	—	0.8%	Jul 3, 2024
21Monitor	CVE-2024-39248Proof of concept	A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload ifikeulous · simpcms · CWE-79 RCE XSS	Medium5.4	—	0.7%	Jul 3, 2024
40Plan	CVE-2024-39844Proof of concept	In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.CWE-94 pre-auth RCE	Critical9.8	—	3.8%	Jul 3, 2024
21Monitor	CVE-2024-31223Proof of concept	Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URLethyca · fides · CWE-497 Pre-auth Info leak	Medium5.3	—	1.1%	Jul 3, 2024
40Plan	CVE-2024-29510Weaponized	Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.artifex · ghostscript · CWE-693	Medium6.3	—	27.9%	Jul 3, 2024
21Monitor	CVE-2024-39211Proof of concept	Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_emaiCWE-204 Pre-auth	Medium5.3	—	1.1%	Jul 4, 2024
33Monitor	CVE-2024-39929Proof of concept	Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blockingexim · exim · CWE-116 Pre-auth	Medium5.4	—	41.4%	Jul 4, 2024
41Plan	CVE-2024-39930Proof of concept	The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.gogs · gogs · CWE-88 RCE	Critical9.9	—	7.7%	Jul 4, 2024
55Plan	CVE-2024-39931No exploit	Gogs through 0.13.0 allows deletion of internal files.gogs · gogs · CWE-552	Critical9.9	—	52.6%	Jul 4, 2024
44Plan	CVE-2024-39932No exploit	Gogs through 0.13.0 allows argument injection during the previewing of changes.gogs · gogs · CWE-94 RCE	Critical9.9	—	17.3%	Jul 4, 2024
47Plan	CVE-2024-39943Proof of concept	rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if rejetto · http file server · CWE-78 RCE Command injection	High8.8	—	39.4%	Jul 4, 2024
42Plan	CVE-2024-6209Proof of concept	unauthorized file accessabb · aspect-ent-12 firmware · CWE-552 Pre-auth	Critical9.4	—	17.1%	Jul 5, 2024
43Plan	CVE-2024-6298Proof of concept	remote code executionabb · aspect-ent-12 firmware · CWE-1287 pre-auth RCE	Critical9.4	—	19.0%	Jul 5, 2024
38Monitor	CVE-2024-23997Proof of concept	Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.lukasbach · yana · CWE-79 Pre-auth XSS	Critical9.6	—	0.6%	Jul 5, 2024
38Monitor	CVE-2024-23998Proof of concept	goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.goanother · another redis desktop manager · CWE-79 Pre-auth XSS	Critical9.6	—	0.7%	Jul 5, 2024
30Monitor	CVE-2024-39210Proof of concept	Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php.mayurik · best house rental management system · CWE-200 Pre-auth Info leak	High7.5	—	0.8%	Jul 5, 2024
36Monitor	CVE-2024-34361Proof of concept	Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)pi-hole · pi-hole · CWE-918 RCE SSRF	High8.8	—	2.8%	Jul 5, 2024
30Monitor	CVE-2024-39689Proof of concept	Certifi removes GLOBALTRUST root certificatecertifi · certifi · CWE-345 Pre-auth	High7.5	—	1.0%	Jul 5, 2024
24Monitor	CVE-2024-6095Proof of concept	SSRF and Partial LFI in /models/apply Endpoint in mudler/localaimudler · localai · CWE-918 Pre-auth SSRF	Medium5.8	—	2.6%	Jul 6, 2024
30Monitor	CVE-2024-3651Proof of concept	Denial of Service via Quadratic Complexity in kjd/idnakjd · internationalized domain names in applications · CWE-1333 Pre-auth Denial of service	High7.5	—	1.3%	Jul 7, 2024
28Monitor	CVE-2024-37389No exploit	Apache NiFi: Improper Neutralization of Input in Parameter Context Descriptionapache · nifi · CWE-79 XSS	Medium5.4	—	24.0%	Jul 8, 2024
44Plan	CVE-2024-1305No exploit	tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can useopenvpn · tap-windows6 · CWE-190 pre-auth RCE Memory safety	Critical9.8	—	15.3%	Jul 8, 2024
36Monitor	CVE-2024-6409No exploit	Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9red hat · red hat enterprise linux 9 · CWE-364 pre-auth RCE Race condition	High7.0	—	27.9%	Jul 8, 2024
40Plan	CVE-2024-5488Proof of concept	SEOPress < 7.9 - Unauthenticated Object Injectionseopress · seopress · CWE-502 Pre-auth Deserialization	Critical9.8	—	3.7%	Jul 9, 2024
30Monitor	CVE-2024-5633Proof of concept	Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the salongse technology · lbh30fe200w · CWE-912	High7.5	—	0.6%	Jul 9, 2024
40Plan	CVE-2024-3596Proof of concept	RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.freeradius · freeradius · CWE-354 Pre-auth	Critical9.0	—	14.8%	Jul 9, 2024
35Monitor	CVE-2024-30081No exploit	Windows NTLM Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-200 Info leak	High7.1	—	23.8%	Jul 9, 2024
44Plan	CVE-2024-38023No exploit	Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 RCE Deserialization	High7.2	—	52.9%	Jul 9, 2024
42Plan	CVE-2024-38024No exploit	Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 RCE Deserialization	High7.2	—	45.2%	Jul 9, 2024
41Plan	CVE-2024-38030No exploit	Windows Themes Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-200 Pre-auth Info leak	Medium6.5	—	51.0%	Jul 9, 2024
23Monitor	CVE-2024-38041Proof of concept	Windows Kernel Information Disclosure Vulnerabilitymicrosoft · windows 10 1607 · CWE-200 Info leak	Medium5.5	—	2.1%	Jul 9, 2024
34Monitor	CVE-2024-38054No exploit	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 Local privilege escalation Memory safety	High7.8	—	10.4%	Jul 9, 2024
40Plan	CVE-2024-38060No exploit	Windows Imaging Component Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507 · CWE-122 RCE Memory safety	High8.8	—	15.9%	Jul 9, 2024
41Plan	CVE-2024-38071No exploit	Windows Remote Desktop Licensing Service Denial of Service Vulnerabilitymicrosoft · windows server 2008 · CWE-126 Pre-auth Denial of service	High7.5	—	35.8%	Jul 9, 2024
64This week	CVE-2024-38077Proof of concept	Windows Remote Desktop Licensing Service Remote Code Execution Vulnerabilitymicrosoft · windows server 2008 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	84.2%	Jul 9, 2024
63This week	CVE-2024-38080Weaponized	Windows Hyper-V Elevation of Privilege Vulnerabilitymicrosoft · windows 11 21h2 · CWE-190 Local privilege escalation Memory safety	High7.8	KEV	7.1%	Jul 9, 2024
73This week	CVE-2024-38094Weaponized	Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 RCE Deserialization	High7.2	KEV	50.8%	Jul 9, 2024
85Now	CVE-2024-38112Weaponized	Windows MSHTML Platform Spoofing Vulnerabilitymicrosoft · windows 10 1507 · CWE-451 Pre-auth	High7.5	KEV	84.2%	Jul 9, 2024
39Monitor	CVE-2023-48194Proof of concept	Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \x0.tenda · ac8 firmware · CWE-787 Pre-auth Memory safety	Critical9.8	—	0.6%	Jul 9, 2024
31Monitor	CVE-2024-31317Proof of concept	In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to ugoogle · android · CWE-502 Deserialization Local privilege escalation	High7.8	—	0.7%	Jul 9, 2024
31Monitor	CVE-2024-31320Proof of concept	In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation dgoogle · android · CWE-269 Local privilege escalation	High7.8	—	0.2%	Jul 9, 2024
21Monitor	CVE-2024-39031Proof of concept	In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar.silverpeas · silverpeas · CWE-79 XSS	Medium5.4	—	0.7%	Jul 9, 2024
31Monitor	CVE-2024-39069Proof of concept	An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack.CWE-491 RCE	High7.8	—	0.5%	Jul 9, 2024
39Monitor	CVE-2024-39614Proof of concept	An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.djangoproject · django · CWE-130 Pre-auth Denial of service	High7.5	—	28.6%	Jul 10, 2024
38Monitor	CVE-2024-3799No exploit	Shell command injection in Phonieboxphoniebox · phoniebox · CWE-78 pre-auth RCE Command injection	High8.7	—	14.5%	Jul 10, 2024
35Monitor	CVE-2024-40332No exploit	idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecordidccms · idccms · CWE-352 Pre-auth CSRF	High8.8	—	0.2%	Jul 10, 2024
97Now	CVE-2024-4879Weaponized	Jelly Template Injection Vulnerability in ServiceNow UI Macrosservicenow · servicenow · CWE-1287 Pre-auth SSTI	Critical9.3	KEV	99.9%	Jul 10, 2024
37Monitor	CVE-2024-5178No exploit	Incomplete Input Validation in SecurelyAccess APIservicenow · now platform · CWE-184	Medium6.9	—	33.5%	Jul 10, 2024
96Now	CVE-2024-5217Weaponized	Incomplete Input Validation in GlideExpression Scriptservicenow · servicenow · CWE-184 Pre-auth	Critical9.2	KEV	99.6%	Jul 10, 2024
36Monitor	CVE-2024-37770Proof of concept	14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function.b1ackc4t · 14finger · CWE-94 pre-auth RCE	Critical9.1	—	1.5%	Jul 10, 2024
41Plan	CVE-2024-6646Proof of concept	Netgear WN604 Web Interface downloadFile.php information disclosurenetgear · wn604 · CWE-200 Pre-auth Info leak	Medium6.9	—	45.6%	Jul 10, 2024
17Monitor	CVE-2024-37147Proof of concept	GLPI allows Authenticated File Upload to Restricted Ticketsglpi-project · glpi · CWE-284 Broken access control (IDOR)	Medium4.3	—	0.6%	Jul 10, 2024
95Now	CVE-2024-5910Weaponized	Expedition: Missing Authentication Leads to Admin Account Takeoverpaloaltonetworks · expedition · CWE-306 Pre-auth Auth bypass	Critical9.3	KEV	91.6%	Jul 10, 2024
43Plan	CVE-2024-6235Proof of concept	Sensitive information disclosurecitrix · netscaler console · CWE-287 Pre-auth Auth bypass	Critical9.4	—	21.1%	Jul 10, 2024
38Monitor	CVE-2024-37148No exploit	GLPI allows account takeover via SQL Injection in AJAX scriptsglpi-project · glpi · CWE-89 SQL injection	High8.1	—	20.2%	Jul 10, 2024
41Plan	CVE-2024-37149No exploit	GLPI allows remote code execution through the plugin loaderglpi-project · glpi · CWE-73 RCE Path traversal	High8.8	—	21.0%	Jul 10, 2024
21Monitor	CVE-2024-38353Proof of concept	CodiMD - Missing Image Access Controls and Unauthorized Image Accesshackmd · codimd · CWE-338 Pre-auth Auth bypass Weak crypto	Medium5.3	—	1.1%	Jul 10, 2024
39Monitor	CVE-2024-6036No exploit	Denial of Service in gaizhenbiao/chuanhuchatgptgaizhenbiao · chuanhuchatgpt · CWE-400 Pre-auth Denial of service	Critical9.1	—	10.8%	Jul 10, 2024
39Monitor	CVE-2024-6037No exploit	Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgptgaizhenbiao · chuanhuchatgpt · CWE-770 Pre-auth Denial of service	Critical9.1	—	10.6%	Jul 10, 2024
40Plan	CVE-2024-6624Proof of concept	JSON API User <= 3.9.3 - Unauthenticated Privilege Escalationparorrey · json api user · CWE-269 Pre-auth	Critical9.8	—	2.8%	Jul 11, 2024
25Monitor	CVE-2024-6485Proof of concept	XSS in Bootstrap button componentbootstrap · bootstrap · CWE-79 Pre-auth XSS	Medium6.4	—	0.4%	Jul 11, 2024
55Plan	CVE-2024-6396Proof of concept	Arbitrary File Overwrite and Data Exfiltration in aimhubio/aimaimstack · aim · CWE-29 pre-auth RCE	Critical9.8	—	53.1%	Jul 11, 2024
21Monitor	CVE-2024-6555Proof of concept	WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosuretimersys · wp popups – wordpress popup builder · CWE-200 Pre-auth Info leak	Medium5.3	—	0.9%	Jul 12, 2024
31Monitor	CVE-2024-39903Proof of concept	Local File Inclusion in Solarawidgetti · solara · CWE-22 Pre-auth Path traversal	High7.5	—	2.8%	Jul 12, 2024
46Plan	CVE-2024-39914Proof of concept	FOG has a command injection in /fog/management/export.php?filename=fogproject · fogproject · CWE-77 pre-auth RCE Command injection	Critical9.8	—	23.2%	Jul 12, 2024
40Plan	CVE-2024-40110Proof of concept	Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimagnikhil-bhalerao · poultry farm management system · CWE-77 pre-auth RCE Command injection	Critical9.8	—	1.9%	Jul 12, 2024
23Monitor	CVE-2024-3753Proof of concept	Hostel < 1.1.5.3 - Reflected XSSkibokolabs · hostel · CWE-79 XSS	Medium5.9	—	0.8%	Jul 13, 2024
35Monitor	CVE-2024-21513Proof of concept	Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving valulangchain · langchain-experimental · CWE-94 RCE	High8.5	—	1.8%	Jul 15, 2024
24Monitor	CVE-2024-6289Proof of concept	WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosurewpserveur · wps hide login · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.9%	Jul 15, 2024

CVE-2024-4007
34Monitor
Hard coded default credential contained in install package
HighCVSS 8.7Proof of conceptEPSS 1%
- Pre-auth
- Hard-coded credentials
abb · aspect-ent-12 firmwareJul 1, 2024
CVE-2024-6050
21Monitor
Reflected XSS in SOWA OPAC
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
sokrates · sowa opacJul 1, 2024
CVE-2024-36401
99Now
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- pre-auth RCE
geoserver · geoserverJul 1, 2024
CVE-2024-36420
31Monitor
GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
flowiseai · flowiseJul 1, 2024
CVE-2024-20399
57Plan
Cisco NX-OS Software CLI Command Injection Vulnerability
MediumCVSS 6.7KEVWeaponizedEPSS 4%
- RCE
- Local privilege escalation
- Command injection
cisco · nx-osJul 1, 2024
CVE-2024-6387
62This week
Openssh: regresshion - race condition in ssh allows rce/dos
HighCVSS 8.1Proof of conceptEPSS 99%
- pre-auth RCE
- Race condition
sonicwall · sma 6200 firmwareJul 1, 2024
CVE-2024-36985
40Plan
Remote Code Execution (RCE) through an external lookup due to “copybuckets.py“ script in the “splunk_archiver“ application in Splunk Enterprise
HighCVSS 8.8WeaponizedEPSS 6%
- RCE
splunk · splunkJul 1, 2024
CVE-2024-36991
34Monitor
Path Traversal on the “/modules/messaging/“ endpoint in Splunk Enterprise on Windows
HighCVSS 7.5Proof of conceptEPSS 13%
- Pre-auth
- Path traversal
splunk · splunkJul 1, 2024
CVE-2024-38472
51Plan
Apache HTTP Server on WIndows UNC SSRF
HighCVSS 7.5Proof of conceptEPSS 69%
- Pre-auth
- SSRF
apache · http serverJul 1, 2024
CVE-2024-38473
40Plan
Apache HTTP Server proxy encoding problem
HighCVSS 8.1Proof of conceptEPSS 25%
- Auth bypass
apache · http serverJul 1, 2024
CVE-2024-38474
40Plan
Apache HTTP Server weakness with encoded question marks in backreferences
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
apache · http serverJul 1, 2024
CVE-2024-38475
96Now
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
CriticalCVSS 9.1KEVWeaponizedEPSS 99%
- Pre-auth
apache · http serverJul 1, 2024
CVE-2024-38476
51Plan
Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
CriticalCVSS 9.8Proof of conceptEPSS 41%
- Pre-auth
- SSRF
apache · http serverJul 1, 2024
CVE-2024-39573
41Plan
Apache HTTP Server: mod_rewrite proxy handler substitution
HighCVSS 7.5No exploitEPSS 37%
- Pre-auth
- SSRF
apache · http serverJul 1, 2024
CVE-2024-28200
40Plan
N-central Authentication Bypass
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
n-able · n-centralJul 1, 2024
CVE-2024-38366
45Plan
CoacoaPods trunk RCE in email verification system rfc-822
CriticalCVSS 10.0Proof of conceptEPSS 17%
- pre-auth RCE
cocoapods · trunk.cocoapods.orgJul 1, 2024
CVE-2024-38367
41Plan
CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking
CriticalCVSS 9.6No exploitEPSS 11%
- Pre-auth
cocoapods · trunk.cocoapods.orgJul 1, 2024
CVE-2024-38368
41Plan
Trunk's 'Claim your pod' could be used to obtain un-used pods
CriticalCVSS 9.3No exploitEPSS 14%
- Pre-auth
cocoapods · trunk.cocoapods.orgJul 1, 2024
CVE-2024-37762
39Monitor
MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.
CriticalCVSS 9.9Proof of conceptEPSS 1%
- RCE
- File upload
machform · machformJul 1, 2024
CVE-2024-37763
21Monitor
MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can vie
MediumCVSS 5.4Proof of conceptEPSS 0%
- Pre-auth
- XSS
machform · machformJul 1, 2024
CVE-2024-37764
21Monitor
MachForm up to version 19 is affected by an authenticated stored cross-site scripting.
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
machform · machformJul 1, 2024
CVE-2024-37765
35Monitor
Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
HighCVSS 8.8Proof of conceptEPSS 0%
- SQL injection
machform · machformJul 1, 2024
CVE-2024-39309
45Plan
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 20%
- Pre-auth
- Auth bypass
- SQL injection
parse-community · parse-serverJul 1, 2024
CVE-2024-4836
31Monitor
LFI in sites managed by Edito CMS
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
edito · edito cmsJul 2, 2024
CVE-2024-36404
62This week
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
CriticalCVSS 9.8Proof of conceptEPSS 76%
- pre-auth RCE
geotools · geotoolsJul 2, 2024
CVE-2024-39143
21Monitor
A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious propert
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
coderberg · residencecmsJul 2, 2024
CVE-2024-39891
60This week
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to
MediumCVSS 5.3KEVWeaponizedEPSS 1%
- Pre-auth
twilio · authyJul 2, 2024
CVE-2022-25477
22Monitor
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read
MediumCVSS 5.5Proof of conceptEPSS 0%
- Info leak
realtek · rtsperJul 2, 2024
CVE-2022-25479
22Monitor
Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Read
MediumCVSS 5.5Proof of conceptEPSS 0%
- Denial of service
realtek · rtsperJul 2, 2024
CVE-2024-38537
39Monitor
Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
ethyca · fidesJul 2, 2024
CVE-2024-32937
47Plan
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1
CriticalCVSS 9.8No exploitEPSS 26%
- pre-auth RCE
- Command injection
grandstream · gxp2135 firmwareJul 3, 2024
CVE-2024-37726
27Monitor
Insecure Permissions vulnerability in Micro-Star International Co., Ltd MSI Center v.2.0.36.0 allows a local attacker to escalate privileges
MediumCVSS 6.8Proof of conceptEPSS 0%
- Local privilege escalation
Jul 3, 2024
CVE-2024-39248
21Monitor
A cross-site scripting (XSS) vulnerability in SimpCMS v0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload i
MediumCVSS 5.4Proof of conceptEPSS 0%
- RCE
- XSS
fikeulous · simpcmsJul 3, 2024
CVE-2024-39844
40Plan
In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.
CriticalCVSS 9.8Proof of conceptEPSS 3%
- pre-auth RCE
Jul 3, 2024
CVE-2024-31223
21Monitor
Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
- Info leak
ethyca · fidesJul 3, 2024
CVE-2024-29510
40Plan
Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.
MediumCVSS 6.3WeaponizedEPSS 27%
artifex · ghostscriptJul 3, 2024
CVE-2024-39211
21Monitor
Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_emai
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
Jul 4, 2024
CVE-2024-39929
33Monitor
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking
MediumCVSS 5.4Proof of conceptEPSS 41%
- Pre-auth
exim · eximJul 4, 2024
CVE-2024-39930
41Plan
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.
CriticalCVSS 9.9Proof of conceptEPSS 7%
- RCE
gogs · gogsJul 4, 2024
CVE-2024-39931
55Plan
Gogs through 0.13.0 allows deletion of internal files.
CriticalCVSS 9.9No exploitEPSS 52%
gogs · gogsJul 4, 2024
CVE-2024-39932
44Plan
Gogs through 0.13.0 allows argument injection during the previewing of changes.
CriticalCVSS 9.9No exploitEPSS 17%
- RCE
gogs · gogsJul 4, 2024
CVE-2024-39943
47Plan
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if
HighCVSS 8.8Proof of conceptEPSS 39%
- RCE
- Command injection
rejetto · http file serverJul 4, 2024
CVE-2024-6209
42Plan
unauthorized file access
CriticalCVSS 9.4Proof of conceptEPSS 17%
- Pre-auth
abb · aspect-ent-12 firmwareJul 5, 2024
CVE-2024-6298
43Plan
remote code execution
CriticalCVSS 9.4Proof of conceptEPSS 19%
- pre-auth RCE
abb · aspect-ent-12 firmwareJul 5, 2024
CVE-2024-23997
38Monitor
Lukas Bach yana =<1.0.16 is vulnerable to Cross Site Scripting (XSS) via src/electron-main.ts.
CriticalCVSS 9.6Proof of conceptEPSS 0%
- Pre-auth
- XSS
lukasbach · yanaJul 5, 2024
CVE-2024-23998
38Monitor
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.vue.
CriticalCVSS 9.6Proof of conceptEPSS 0%
- Pre-auth
- XSS
goanother · another redis desktop managerJul 5, 2024
CVE-2024-39210
30Monitor
Best House Rental Management System v1.0 was discovered to contain an arbitrary file read vulnerability via the Page parameter at index.php.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Info leak
mayurik · best house rental management systemJul 5, 2024
CVE-2024-34361
36Monitor
Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
HighCVSS 8.8Proof of conceptEPSS 2%
- RCE
- SSRF
pi-hole · pi-holeJul 5, 2024
CVE-2024-39689
30Monitor
Certifi removes GLOBALTRUST root certificate
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
certifi · certifiJul 5, 2024
CVE-2024-6095
24Monitor
SSRF and Partial LFI in /models/apply Endpoint in mudler/localai
MediumCVSS 5.8Proof of conceptEPSS 2%
- Pre-auth
- SSRF
mudler · localaiJul 6, 2024
CVE-2024-3651
30Monitor
Denial of Service via Quadratic Complexity in kjd/idna
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Denial of service
kjd · internationalized domain names in applicationsJul 7, 2024
CVE-2024-37389
28Monitor
Apache NiFi: Improper Neutralization of Input in Parameter Context Description
MediumCVSS 5.4No exploitEPSS 24%
- XSS
apache · nifiJul 8, 2024
CVE-2024-1305
44Plan
tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use
CriticalCVSS 9.8No exploitEPSS 15%
- pre-auth RCE
- Memory safety
openvpn · tap-windows6Jul 8, 2024
CVE-2024-6409
36Monitor
Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9
HighCVSS 7.0No exploitEPSS 27%
- pre-auth RCE
- Race condition
red hat · red hat enterprise linux 9Jul 8, 2024
CVE-2024-5488
40Plan
SEOPress < 7.9 - Unauthenticated Object Injection
CriticalCVSS 9.8Proof of conceptEPSS 3%
- Pre-auth
- Deserialization
seopress · seopressJul 9, 2024
CVE-2024-5633
30Monitor
Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the sa
HighCVSS 7.5Proof of conceptEPSS 0%
longse technology · lbh30fe200wJul 9, 2024
CVE-2024-3596
40Plan
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
CriticalCVSS 9.0Proof of conceptEPSS 14%
- Pre-auth
freeradius · freeradiusJul 9, 2024
CVE-2024-30081
35Monitor
Windows NTLM Spoofing Vulnerability
HighCVSS 7.1No exploitEPSS 23%
- Info leak
microsoft · windows 10 1507Jul 9, 2024
CVE-2024-38023
44Plan
Microsoft SharePoint Server Remote Code Execution Vulnerability
HighCVSS 7.2No exploitEPSS 52%
- RCE
- Deserialization
microsoft · sharepoint serverJul 9, 2024
CVE-2024-38024
42Plan
Microsoft SharePoint Server Remote Code Execution Vulnerability
HighCVSS 7.2No exploitEPSS 45%
- RCE
- Deserialization
microsoft · sharepoint serverJul 9, 2024
CVE-2024-38030
41Plan
Windows Themes Spoofing Vulnerability
MediumCVSS 6.5No exploitEPSS 51%
- Pre-auth
- Info leak
microsoft · windows 10 1507Jul 9, 2024
CVE-2024-38041
23Monitor
Windows Kernel Information Disclosure Vulnerability
MediumCVSS 5.5Proof of conceptEPSS 2%
- Info leak
microsoft · windows 10 1607Jul 9, 2024
CVE-2024-38054
34Monitor
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 10%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1507Jul 9, 2024
CVE-2024-38060
40Plan
Windows Imaging Component Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 15%
- RCE
- Memory safety
microsoft · windows 10 1507Jul 9, 2024
CVE-2024-38071
41Plan
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
HighCVSS 7.5No exploitEPSS 35%
- Pre-auth
- Denial of service
microsoft · windows server 2008Jul 9, 2024
CVE-2024-38077
64This week
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 84%
- pre-auth RCE
- Memory safety
microsoft · windows server 2008Jul 9, 2024
CVE-2024-38080
63This week
Windows Hyper-V Elevation of Privilege Vulnerability
HighCVSS 7.8KEVWeaponizedEPSS 7%
- Local privilege escalation
- Memory safety
microsoft · windows 11 21h2Jul 9, 2024
CVE-2024-38094
73This week
Microsoft SharePoint Remote Code Execution Vulnerability
HighCVSS 7.2KEVWeaponizedEPSS 50%
- RCE
- Deserialization
microsoft · sharepoint serverJul 9, 2024
CVE-2024-38112
85Now
Windows MSHTML Platform Spoofing Vulnerability
HighCVSS 7.5KEVWeaponizedEPSS 84%
- Pre-auth
microsoft · windows 10 1507Jul 9, 2024
CVE-2023-48194
39Monitor
Vulnerability in Tenda AC8v4 .V16.03.34.09 due to sscanf and the last digit of s8 being overwritten with \x0.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
tenda · ac8 firmwareJul 9, 2024
CVE-2024-31317
31Monitor
In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to u
HighCVSS 7.8Proof of conceptEPSS 0%
- Deserialization
- Local privilege escalation
google · androidJul 9, 2024
CVE-2024-31320
31Monitor
In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association without any confirmation d
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
google · androidJul 9, 2024
CVE-2024-39031
21Monitor
In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar.
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
silverpeas · silverpeasJul 9, 2024
CVE-2024-39069
31Monitor
An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack.
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
Jul 9, 2024
CVE-2024-39614
39Monitor
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.
HighCVSS 7.5Proof of conceptEPSS 28%
- Pre-auth
- Denial of service
djangoproject · djangoJul 10, 2024
CVE-2024-3799
38Monitor
Shell command injection in Phoniebox
HighCVSS 8.7No exploitEPSS 14%
- pre-auth RCE
- Command injection
phoniebox · phonieboxJul 10, 2024
CVE-2024-40332
35Monitor
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
idccms · idccmsJul 10, 2024
CVE-2024-4879
97Now
Jelly Template Injection Vulnerability in ServiceNow UI Macros
CriticalCVSS 9.3KEVWeaponizedEPSS 99%
- Pre-auth
- SSTI
servicenow · servicenowJul 10, 2024
CVE-2024-5178
37Monitor
Incomplete Input Validation in SecurelyAccess API
MediumCVSS 6.9No exploitEPSS 33%
servicenow · now platformJul 10, 2024
CVE-2024-5217
96Now
Incomplete Input Validation in GlideExpression Script
CriticalCVSS 9.2KEVWeaponizedEPSS 99%
- Pre-auth
servicenow · servicenowJul 10, 2024
CVE-2024-37770
36Monitor
14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function.
CriticalCVSS 9.1Proof of conceptEPSS 1%
- pre-auth RCE
b1ackc4t · 14fingerJul 10, 2024
CVE-2024-6646
41Plan
Netgear WN604 Web Interface downloadFile.php information disclosure
MediumCVSS 6.9Proof of conceptEPSS 45%
- Pre-auth
- Info leak
netgear · wn604Jul 10, 2024
CVE-2024-37147
17Monitor
GLPI allows Authenticated File Upload to Restricted Tickets
MediumCVSS 4.3Proof of conceptEPSS 0%
- Broken access control (IDOR)
glpi-project · glpiJul 10, 2024
CVE-2024-5910
95Now
Expedition: Missing Authentication Leads to Admin Account Takeover
CriticalCVSS 9.3KEVWeaponizedEPSS 91%
- Pre-auth
- Auth bypass
paloaltonetworks · expeditionJul 10, 2024
CVE-2024-6235
43Plan
Sensitive information disclosure
CriticalCVSS 9.4Proof of conceptEPSS 21%
- Pre-auth
- Auth bypass
citrix · netscaler consoleJul 10, 2024
CVE-2024-37148
38Monitor
GLPI allows account takeover via SQL Injection in AJAX scripts
HighCVSS 8.1No exploitEPSS 20%
- SQL injection
glpi-project · glpiJul 10, 2024
CVE-2024-37149
41Plan
GLPI allows remote code execution through the plugin loader
HighCVSS 8.8No exploitEPSS 21%
- RCE
- Path traversal
glpi-project · glpiJul 10, 2024
CVE-2024-38353
21Monitor
CodiMD - Missing Image Access Controls and Unauthorized Image Access
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
- Weak crypto
hackmd · codimdJul 10, 2024
CVE-2024-6036
39Monitor
Denial of Service in gaizhenbiao/chuanhuchatgpt
CriticalCVSS 9.1No exploitEPSS 10%
- Pre-auth
- Denial of service
gaizhenbiao · chuanhuchatgptJul 10, 2024
CVE-2024-6037
39Monitor
Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt
CriticalCVSS 9.1No exploitEPSS 10%
- Pre-auth
- Denial of service
gaizhenbiao · chuanhuchatgptJul 10, 2024
CVE-2024-6624
40Plan
JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
parorrey · json api userJul 11, 2024
CVE-2024-6485
25Monitor
XSS in Bootstrap button component
MediumCVSS 6.4Proof of conceptEPSS 0%
- Pre-auth
- XSS
bootstrap · bootstrapJul 11, 2024
CVE-2024-6396
55Plan
Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
CriticalCVSS 9.8Proof of conceptEPSS 53%
- pre-auth RCE
aimstack · aimJul 11, 2024
CVE-2024-6555
21Monitor
WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Info leak
timersys · wp popups – wordpress popup builderJul 12, 2024
CVE-2024-39903
31Monitor
Local File Inclusion in Solara
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
widgetti · solaraJul 12, 2024
CVE-2024-39914
46Plan
FOG has a command injection in /fog/management/export.php?filename=
CriticalCVSS 9.8Proof of conceptEPSS 23%
- pre-auth RCE
- Command injection
fogproject · fogprojectJul 12, 2024
CVE-2024-40110
40Plan
Sourcecodester Poultry Farm Management System v1.0 contains an Unauthenticated Remote Code Execution (RCE) vulnerability via the productimag
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
nikhil-bhalerao · poultry farm management systemJul 12, 2024
CVE-2024-3753
23Monitor
Hostel < 1.1.5.3 - Reflected XSS
MediumCVSS 5.9Proof of conceptEPSS 0%
- XSS
kibokolabs · hostelJul 13, 2024
CVE-2024-21513
35Monitor
Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving valu
HighCVSS 8.5Proof of conceptEPSS 1%
- RCE
langchain · langchain-experimentalJul 15, 2024
CVE-2024-6289
24Monitor
WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
wpserveur · wps hide loginJul 15, 2024