Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2024

162 records · 13 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2024-7354
    24Monitor

    Ninja Forms 3.8.6-3.8.10 - Reflected XSS

    MediumCVSS 6.1Proof of conceptEPSS 0%

    ninjaforms · ninja formsSep 2, 2024

  • CVE-2024-42471
    31Monitor

    Arbitrary File Write via artifact extraction in actions/artifact

    HighCVSS 7.5Proof of conceptEPSS 3%

    github · actions\/artifactSep 2, 2024

  • CVE-2024-44947
    22Monitor

    fuse: Initialize beyond-EOF page contents before setting uptodate

    MediumCVSS 5.5Proof of conceptEPSS 0%

    linux · linux kernelSep 2, 2024

  • CVE-2024-45388
    47Plan

    Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)

    HighCVSS 7.5Proof of conceptEPSS 55%

    hoverfly · hoverflySep 2, 2024

  • CVE-2024-45622
    50Plan

    ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    Sep 2, 2024

  • CVE-2024-7261
    42Plan

    The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4

    CriticalCVSS 9.8No exploitEPSS 11%

    zyxel · nwa110ax firmwareSep 2, 2024

  • CVE-2024-6473
    33Monitor

    DLL Hijacking in Yandex Browser

    HighCVSS 8.4Proof of conceptEPSS 0%

    yandex · yandex browserSep 3, 2024

  • CVE-2024-6232
    31Monitor

    Regular-expression DoS when parsing TarFile headers

    HighCVSS 7.5Proof of conceptEPSS 2%

    python · pythonSep 3, 2024

  • CVE-2024-8381
    40Plan

    A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environmen

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    mozilla · firefoxSep 3, 2024

  • CVE-2024-34463
    20Monitor

    BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets.

    MediumCVSS 5.1Proof of conceptEPSS 0%

    Sep 3, 2024

  • CVE-2024-6119
    50Plan

    Possible denial of service in X.509 name checks

    HighCVSS 7.5No exploitEPSS 66%

    openssl · opensslSep 3, 2024

  • CVE-2024-6926
    40Plan

    Viral Signup <= 2.1 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    wow-company · viral signupSep 4, 2024

  • CVE-2024-7786
    22Monitor

    Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak

    MediumCVSS 5.3Proof of conceptEPSS 1%

    automattic · sensei lmsSep 4, 2024

  • CVE-2024-45195
    90Now

    Apache OFBiz: Confused controller-view authorization logic (forced browsing)

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    apache · ofbizSep 4, 2024

  • CVE-2024-45507
    67This week

    Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

    CriticalCVSS 9.8Proof of conceptEPSS 93%

    apache · ofbizSep 4, 2024

  • CVE-2024-8289
    39Monitor

    MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.0 - Missing Authorization to Limited Vendor Privilege Escalation/Account Takeove

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    multivendorx · multivendorxSep 4, 2024

  • CVE-2024-44400
    43Plan

    A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical.

    CriticalCVSS 9.8No exploitEPSS 14%

    dlink · di-8400 firmwareSep 4, 2024

  • CVE-2024-20439
    98Now

    A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by us

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    cisco · smart license utilitySep 4, 2024

  • CVE-2024-20440
    46Plan

    A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.

    HighCVSS 7.5Proof of conceptEPSS 51%

    cisco · smart license utilitySep 4, 2024

  • CVE-2024-42642
    26Monitor

    Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted

    MediumCVSS 6.7Proof of conceptEPSS 0%

    crucial · mx500 firmwareSep 4, 2024

  • CVE-2024-7627
    33Monitor

    Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

    HighCVSS 8.1Proof of conceptEPSS 2%

    bitapps · file managerSep 4, 2024

  • CVE-2024-6846
    21Monitor

    SmartSearchWP <= 2.4.4 - Unauthenticated Log Purge

    MediumCVSS 5.3Proof of conceptEPSS 1%

    webdigit · chatbot with chatgptSep 5, 2024

  • CVE-2024-8465
    30Monitor

    SQL injection vulnerability in Job Portal

    HighCVSS 7.5Proof of conceptEPSS 0%

    phpgurukul · job portalSep 5, 2024

  • CVE-2024-45589
    23Monitor

    RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote at

    MediumCVSS 5.9Proof of conceptEPSS 0%

    identityautomation · rapididentitySep 5, 2024

  • CVE-2024-24759
    37Monitor

    MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

    CriticalCVSS 9.1Proof of conceptEPSS 4%

    mindsdb · mindsdbSep 5, 2024

  • CVE-2024-7591
    41Plan

    Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection

    HighCVSS 7.2Proof of conceptEPSS 43%

    kemptechnologies · loadmasterSep 5, 2024

  • CVE-2024-8517
    67This week

    SPIP Bigup Multipart File Upload OS Command Injection

    CriticalCVSS 9.8WeaponizedEPSS 94%

    spip · spipSep 6, 2024

  • CVE-2023-45038
    35Monitor

    An improper authentication vulnerability has been reported to affect Music Station.

    HighCVSS 8.8Proof of conceptEPSS 1%

    qnap · music stationSep 6, 2024

  • CVE-2024-36138
    32Monitor

    Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child

    HighCVSS 8.1No exploitEPSS 1%

    nodejs · nodeSep 7, 2024

  • CVE-2024-40711
    96Now

    A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    veeam · veeam backup \& replicationSep 7, 2024

  • CVE-2024-6924
    40Plan

    TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    themetechmount · truebookerSep 8, 2024

  • CVE-2024-6928
    40Plan

    Opti Marketing <= 2.0.9 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    opti.marketing · opti marketingSep 8, 2024

  • CVE-2024-44333
    39Monitor

    D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400

    HighCVSS 8.8No exploitEPSS 12%

    Sep 9, 2024

  • CVE-2024-44334
    45Plan

    D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400

    HighCVSS 8.8No exploitEPSS 31%

    Sep 9, 2024

  • CVE-2024-44335
    39Monitor

    D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v2

    HighCVSS 8.8No exploitEPSS 12%

    Sep 9, 2024

  • CVE-2024-44849
    53Plan

    Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    qualitor · qualitorSep 9, 2024

  • CVE-2024-44902
    40Plan

    A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    thinkphp · thinkphpSep 9, 2024

  • CVE-2024-44087
    39Monitor

    A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6.0 (All versions < V6.0 SP

    CriticalCVSS 9.2No exploitEPSS 10%

    siemens · automation license manager v5Sep 10, 2024

  • CVE-2024-37728
    31Monitor

    Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attack

    HighCVSS 7.5Proof of conceptEPSS 1%

    Sep 10, 2024

  • CVE-2024-44867
    30Monitor

    phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.

    HighCVSS 7.5Proof of conceptEPSS 1%

    phpok · phpokSep 10, 2024

  • CVE-2024-44815
    18Monitor

    Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash F

    MediumCVSS 4.6Proof of conceptEPSS 0%

    hathway · skyworth cm5100-511 firmwareSep 10, 2024

  • CVE-2024-45590
    30Monitor

    body-parser vulnerable to denial of service when url encoding is enabled

    HighCVSS 7.5Proof of conceptEPSS 0%

    openjsf · body-parserSep 10, 2024

  • CVE-2024-45591
    22Monitor

    XWiki Platform document history including authors of any page exposed to unauthorized actors

    MediumCVSS 5.3Proof of conceptEPSS 3%

    xwiki · xwikiSep 10, 2024

  • CVE-2024-38014
    63This week

    Windows Installer Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 6%

    microsoft · windows 10 1507Sep 10, 2024

  • CVE-2024-38018
    50Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 51%

    microsoft · sharepoint serverSep 10, 2024

  • CVE-2024-38217
    60This week

    Windows Mark of the Web Security Feature Bypass Vulnerability

    MediumCVSS 5.4KEVWeaponizedEPSS 10%

    microsoft · windows 10 1507Sep 10, 2024

  • CVE-2024-38226
    60This week

    Microsoft Publisher Security Feature Bypass Vulnerability

    HighCVSS 7.3KEVWeaponizedEPSS 2%

    microsoft · office 2019Sep 10, 2024

  • CVE-2024-43454
    35Monitor

    Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

    HighCVSS 7.1No exploitEPSS 21%

    microsoft · windows server 2008Sep 10, 2024

  • CVE-2024-43461
    81Now

    Windows MSHTML Platform Spoofing Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 54%

    microsoft · windows 10 1507Sep 10, 2024

  • CVE-2024-43464
    39Monitor

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 7.2No exploitEPSS 36%

    microsoft · sharepoint serverSep 10, 2024

  • CVE-2024-43491
    43Plan

    Microsoft Windows Update Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 12%

    microsoft · windows 10 1507Sep 10, 2024

  • CVE-2024-44871
    33Monitor

    An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via up

    HighCVSS 7.2Proof of conceptEPSS 16%

    mozilo · mozilocmsSep 10, 2024

  • CVE-2024-34831
    24Monitor

    cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in

    MediumCVSS 6.1Proof of conceptEPSS 0%

    gibbonedu · gibbonSep 10, 2024

  • CVE-2024-45409
    42Plan

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    onelogin · ruby-samlSep 10, 2024

  • CVE-2024-8232
    38Monitor

    iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Type

    HighCVSS 8.7Proof of conceptEPSS 13%

    ininet solutions gmbh · spidercontrol scada web serverSep 10, 2024

  • CVE-2024-8503
    63This week

    VICIdial Unauthenticated SQL Injection

    CriticalCVSS 9.8WeaponizedEPSS 79%

    vicidial · vicidialSep 10, 2024

  • CVE-2024-8504
    58Plan

    VICIdial Authenticated Remote Code Execution

    HighCVSS 8.8WeaponizedEPSS 76%

    vicidial · vicidialSep 10, 2024

  • CVE-2024-8190
    85Now

    An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated att

    HighCVSS 7.2KEVWeaponizedEPSS 88%

    ivanti · cloud services applianceSep 10, 2024

  • CVE-2024-8191
    45Plan

    SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker

    CriticalCVSS 9.8No exploitEPSS 20%

    ivanti · endpoint managerSep 10, 2024

  • CVE-2024-27115
    41Plan

    Remote Code Execution through File Upload in SOPlanning before 1.52.02

    CriticalCVSS 10.0Proof of conceptEPSS 4%

    soplanning · soplanningSep 11, 2024

  • CVE-2024-8636
    35Monitor

    Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a

    HighCVSS 8.8Proof of conceptEPSS 0%

    google · chromeSep 11, 2024

  • CVE-2024-44466
    42Plan

    COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4.

    CriticalCVSS 9.8No exploitEPSS 10%

    comfast · cf-xr11 firmwareSep 11, 2024

  • CVE-2024-44541
    40Plan

    evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    Sep 11, 2024

  • CVE-2024-29847
    55Plan

    Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenti

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-32840
    36Monitor

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p

    HighCVSS 7.2No exploitEPSS 25%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-32845
    35Monitor

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p

    HighCVSS 7.2No exploitEPSS 24%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-32848
    41Plan

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p

    HighCVSS 7.2No exploitEPSS 43%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-34779
    35Monitor

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p

    HighCVSS 7.2No exploitEPSS 24%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-34783
    41Plan

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p

    HighCVSS 7.2No exploitEPSS 43%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-34785
    36Monitor

    An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin p

    HighCVSS 7.2No exploitEPSS 25%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-37397
    50Plan

    An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allow

    HighCVSS 8.2No exploitEPSS 59%

    ivanti · endpoint managerSep 11, 2024

  • CVE-2024-8522
    60This week

    LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'

    HighCVSS 7.5WeaponizedEPSS 62%

    thimpress · learnpressSep 12, 2024

  • CVE-2024-8529
    60This week

    LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

    HighCVSS 7.5WeaponizedEPSS 12%

    thimpress · learnpressSep 12, 2024

  • CVE-2024-40457
    36Monitor

    No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file.

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    Sep 12, 2024

  • CVE-2024-45826
    38Monitor

    ThinManager® Code Execution Vulnerability

    HighCVSS 8.5No exploitEPSS 12%

    rockwellautomation · thinmanagerSep 12, 2024

  • CVE-2024-8124
    42Plan

    Inefficient Regular Expression Complexity in GitLab

    HighCVSS 7.5No exploitEPSS 40%

    gitlab · gitlabSep 12, 2024

  • CVE-2024-45383
    20Monitor

    A mishandling of IRP requests vulnerability exists in the HDAudBus_DMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.36

    MediumCVSS 5.0Proof of conceptEPSS 1%

    microsoft · high definition audio bus driverSep 12, 2024

  • CVE-2024-6678
    36Monitor

    Authentication Bypass by Spoofing in GitLab

    HighCVSS 8.8Proof of conceptEPSS 1%

    gitlab · gitlabSep 12, 2024

  • CVE-2024-45607
    25Monitor

    whatsapp-api-js fails to validate message's signature

    MediumCVSS 5.3No exploitEPSS 14%

    secreto31126 · whatsapp-api-jsSep 12, 2024

  • CVE-2024-38816
    34Monitor

    CVE-2024-38816: Path traversal vulnerability in functional web frameworks

    HighCVSS 7.5Proof of conceptEPSS 14%

    spring · springSep 13, 2024

  • CVE-2024-41874
    48Plan

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    CriticalCVSS 9.8No exploitEPSS 30%

    adobe · coldfusionSep 13, 2024

  • CVE-2024-46048
    42Plan

    Tenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function i

    CriticalCVSS 9.8No exploitEPSS 10%

    tenda · fh451 firmwareSep 13, 2024

  • CVE-2024-6587
    41Plan

    SSRF in berriai/litellm

    HighCVSS 7.5Proof of conceptEPSS 35%

    litellm · litellmSep 13, 2024

  • CVE-2024-39924
    39Monitor

    An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.

    HighCVSS 8.8No exploitEPSS 13%

    dani-garcia · vaultwardenSep 13, 2024

  • CVE-2024-8669
    33Monitor

    Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection

    HighCVSS 7.2No exploitEPSS 16%

    softaculous · backuplySep 14, 2024

  • CVE-2024-46938
    44Plan

    An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release thro

    HighCVSS 7.5Proof of conceptEPSS 46%

    sitecore · experience commerceSep 15, 2024

  • CVE-2024-46451
    39Monitor

    TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    totolink · t8 firmwareSep 16, 2024

  • CVE-2024-44623
    39Monitor

    An issue in TuomoKu SPx-GC v.1.3.0 and before allows a remote attacker to execute arbitrary code via the child_process.js function.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    spx · spx graphics controllerSep 16, 2024

  • CVE-2024-8752
    41Plan

    WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 11%

    smart-hmi · webiqSep 16, 2024

  • CVE-2024-27876
    22Monitor

    A race condition was addressed with improved locking.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apple · ipadosSep 16, 2024

  • CVE-2024-40842
    22Monitor

    An issue was addressed with improved validation of environment variables.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apple · macosSep 16, 2024

  • CVE-2024-44133
    24Monitor

    This issue was addressed by removing the vulnerable code.

    MediumCVSS 5.5Proof of conceptEPSS 7%

    apple · macosSep 16, 2024

  • CVE-2024-38812
    85Now

    Heap-overflow vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 54%

    vmware · cloud foundationSep 17, 2024

  • CVE-2024-38813
    74This week

    Privilege escalation vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 17%

    vmware · cloud foundationSep 17, 2024

  • CVE-2024-8945
    26Monitor

    CodeCanyon RISE Ultimate Project Manager save sql injection

    MediumCVSS 5.3Proof of conceptEPSS 15%

    fairsketch · rise ultimate project managerSep 17, 2024

  • CVE-2024-45798
    39Monitor

    Multiple Poisoned Pipeline Execution (PPE) vulnerabilities

    CriticalCVSS 9.9Proof of conceptEPSS 0%

    espressif · arduino-esp32Sep 17, 2024

  • CVE-2024-8949
    21Monitor

    SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management

    MediumCVSS 5.3Proof of conceptEPSS 0%

    oretnom23 · online eyewear shopSep 17, 2024

  • CVE-2024-8956
    84Now

    PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication

    CriticalCVSS 9.1KEVWeaponizedEPSS 58%

    ptzoptics · pt30x-sdi firmwareSep 17, 2024

  • CVE-2024-8957
    82Now

    PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration

    HighCVSS 7.2KEVWeaponizedEPSS 79%

    ptzoptics · pt30x-sdi firmwareSep 17, 2024

  • CVE-2024-46982
    48Plan

    Cache Poisoning in next.js

    HighCVSS 7.5Proof of conceptEPSS 59%

    vercel · next.jsSep 17, 2024