Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2024

237 records · 17 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 3

  • CVE-2024-9106
    40Plan

    Wechat Social login <= 1.3.0 - Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    xunhuweb · wechat social login 微信qq钉钉登录插件Oct 1, 2024

  • CVE-2024-9224
    26Monitor

    Hello World <= 2.1.1 - Authenticated (Subscriber+) Arbitrary File Read

    MediumCVSS 6.5Proof of conceptEPSS 1%

    kau-boys · hello worldOct 1, 2024

  • CVE-2024-41276
    39Monitor

    A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Oct 1, 2024

  • CVE-2024-44610
    22Monitor

    PCAN-Ethernet Gateway FD before 1.3.0 and PCAN-Ethernet Gateway before 2.11.0 are vulnerable to Command injection via shell metacharacters i

    MediumCVSS 5.6Proof of conceptEPSS 0%

    Oct 1, 2024

  • CVE-2024-31835
    19Monitor

    Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload

    MediumCVSS 4.8Proof of conceptEPSS 1%

    flatpress · flatpressOct 1, 2024

  • CVE-2024-47525
    30Monitor

    Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php

    MediumCVSS 5.4No exploitEPSS 29%

    librenms · librenmsOct 1, 2024

  • CVE-2024-7855
    40Plan

    WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8No exploitEPSS 17%

    thimpress · wp hotel bookingOct 2, 2024

  • CVE-2024-44193
    31Monitor

    A logic issue was addressed with improved restrictions.

    HighCVSS 7.8Proof of conceptEPSS 0%

    apple · itunesOct 2, 2024

  • CVE-2024-33209
    21Monitor

    FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 5.4Proof of conceptEPSS 0%

    flatpress · flatpressOct 2, 2024

  • CVE-2024-33210
    21Monitor

    A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    flatpress · flatpressOct 2, 2024

  • CVE-2024-41290
    32Monitor

    FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

    HighCVSS 8.1Proof of conceptEPSS 0%

    flatpress · flatpressOct 2, 2024

  • CVE-2024-46626
    35Monitor

    OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.

    HighCVSS 8.8Proof of conceptEPSS 0%

    os4ed · opensisOct 2, 2024

  • CVE-2024-24116
    48Plan

    An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    ruijie · rg-nbs2009g-p firmwareOct 2, 2024

  • CVE-2024-9441
    55Plan

    Linear eMerge e3-Series Forgot Password Command Injection

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    linear · emerge e3-seriesOct 2, 2024

  • CVE-2024-45519
    99Now

    The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    synacor · zimbra collaboration suiteOct 2, 2024

  • CVE-2024-41163
    46Plan

    A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0.

    HighCVSS 7.5No exploitEPSS 52%

    veertu · anka build cloudOct 3, 2024

  • CVE-2024-45870
    26Monitor

    Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    bandisoft · bandiviewOct 3, 2024

  • CVE-2024-46658
    39Monitor

    Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.

    HighCVSS 8.0Proof of conceptEPSS 24%

    Oct 3, 2024

  • CVE-2024-47855
    26Monitor

    util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.

    MediumCVSS 5.3No exploitEPSS 17%

    Oct 4, 2024

  • CVE-2024-9513
    26Monitor

    Netadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposure

    MediumCVSS 6.3Proof of conceptEPSS 1%

    netadmin · netadmin iamOct 4, 2024

  • CVE-2024-43686
    25Monitor

    Reflected XSS in TimeProvider 4100 chart component

    MediumCVSS 5.4No exploitEPSS 12%

    microchip · timeprovider 4100 firmwareOct 4, 2024

  • CVE-2024-43687
    30Monitor

    XSS vulnerability in bannerconfig endpoint in TimeProvider 4100

    HighCVSS 7.7Proof of conceptEPSS 0%

    microchip · timeprovider 4100 firmwareOct 4, 2024

  • CVE-2024-7801
    25Monitor

    SQL injection in get_chart_data in TimeProvider 4100

    MediumCVSS 6.3Proof of conceptEPSS 0%

    microchip · timeprovider 4100 firmwareOct 4, 2024

  • CVE-2024-9054
    39Monitor

    Remote code Execution inTimeProvider® 4100

    HighCVSS 8.5Proof of conceptEPSS 15%

    microchip · timeprovider 4100 firmwareOct 4, 2024

  • CVE-2024-47841
    37Monitor

    Path traversal when loading stylesheets

    MediumCVSS 6.9No exploitEPSS 34%

    wikimedia · wikimedia-extensions-cssOct 4, 2024

  • CVE-2024-8743
    27Monitor

    Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload

    MediumCVSS 6.8Proof of conceptEPSS 0%

    bitpressadmin · file managerOct 5, 2024

  • CVE-2024-9161
    27Monitor

    Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete

    MediumCVSS 6.5Proof of conceptEPSS 2%

    rankmath · seoOct 5, 2024

  • CVE-2024-47374
    24Monitor

    WordPress LiteSpeed Cache plugin <= 6.5.0.2 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 1%

    litespeedtech · litespeed cacheOct 5, 2024

  • CVE-2024-38399
    31Monitor

    Use After Free in Graphics

    HighCVSS 7.8Proof of conceptEPSS 0%

    qualcomm · wsa8835 firmwareOct 7, 2024

  • CVE-2024-43047
    61This week

    Use After Free in DSP Service

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    qualcomm · fastconnect 6700 firmwareOct 7, 2024

  • CVE-2024-46278
    34Monitor

    Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.

    HighCVSS 8.4Proof of conceptEPSS 2%

    sismics · teedyOct 7, 2024

  • CVE-2024-9570
    35Monitor

    D-Link DIR-619L B1 formEasySetTimezone buffer overflow

    HighCVSS 8.7Proof of conceptEPSS 2%

    dlink · dir-619l firmwareOct 7, 2024

  • CVE-2024-42831
    24Monitor

    A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary Java

    MediumCVSS 6.1Proof of conceptEPSS 0%

    Oct 7, 2024

  • CVE-2024-31449
    36Monitor

    Lua library commands may lead to stack overflow and RCE in Redis

    HighCVSS 8.8Proof of conceptEPSS 4%

    redis · redisOct 7, 2024

  • CVE-2024-45293
    31Monitor

    XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader

    HighCVSS 7.5Proof of conceptEPSS 2%

    phpoffice · phpspreadsheetOct 7, 2024

  • CVE-2024-43362
    33Monitor

    Stored Cross-site Scripting (XSS) when creating external links in Cacti

    MediumCVSS 5.4No exploitEPSS 38%

    cacti · cactiOct 7, 2024

  • CVE-2024-43363
    39Monitor

    Remote code execution via Log Poisoning in Cacti

    HighCVSS 7.2Proof of conceptEPSS 35%

    cacti · cactiOct 7, 2024

  • CVE-2024-43364
    43Plan

    Stored Cross-site Scripting (XSS) when creating external links in Cacti

    HighCVSS 8.2No exploitEPSS 37%

    cacti · cactiOct 7, 2024

  • CVE-2024-43365
    40Plan

    Stored Cross-site Scripting (XSS) when creating external links in Cacti

    HighCVSS 8.2No exploitEPSS 25%

    cacti · cactiOct 7, 2024

  • CVE-2024-21532
    29Monitor

    All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the b

    HighCVSS 7.3Proof of conceptEPSS 1%

    Oct 8, 2024

  • CVE-2024-21533
    26Monitor

    All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Oct 8, 2024

  • CVE-2024-8911
    40Plan

    LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    latepoint · latepointOct 8, 2024

  • CVE-2024-8943
    40Plan

    LatePoint <= 5.0.12 - Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    latepoint · latepointOct 8, 2024

  • CVE-2024-45230
    38Monitor

    An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.

    HighCVSS 7.5No exploitEPSS 25%

    djangoproject · djangoOct 8, 2024

  • CVE-2024-47949
    37Monitor

    In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location

    HighCVSS 7.5No exploitEPSS 23%

    jetbrains · teamcityOct 8, 2024

  • CVE-2024-44349
    41Plan

    A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    Oct 8, 2024

  • CVE-2024-47008
    44Plan

    Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.

    HighCVSS 7.5No exploitEPSS 47%

    ivanti · avalancheOct 8, 2024

  • CVE-2024-47010
    50Plan

    Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication.

    CriticalCVSS 9.8No exploitEPSS 37%

    ivanti · avalancheOct 8, 2024

  • CVE-2024-47011
    47Plan

    Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information

    HighCVSS 7.5No exploitEPSS 56%

    ivanti · avalancheOct 8, 2024

  • CVE-2024-9380
    76This week

    An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker wit

    HighCVSS 7.2KEVWeaponizedEPSS 59%

    ivanti · endpoint manager cloud services applianceOct 8, 2024

  • CVE-2024-9381
    33Monitor

    Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions.

    HighCVSS 7.2No exploitEPSS 15%

    ivanti · endpoint manager cloud services applianceOct 8, 2024

  • CVE-2024-38124
    36Monitor

    Windows Netlogon Elevation of Privilege Vulnerability

    CriticalCVSS 9.0Proof of conceptEPSS 1%

    microsoft · windows server 2008Oct 8, 2024

  • CVE-2024-43468
    93Now

    Microsoft Configuration Manager Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 81%

    microsoft · configuration manager 2403Oct 8, 2024

  • CVE-2024-43532
    39Monitor

    Remote Registry Service Elevation of Privilege Vulnerability

    HighCVSS 8.8No exploitEPSS 11%

    microsoft · windows 10 1507Oct 8, 2024

  • CVE-2024-43535
    28Monitor

    Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 0%

    microsoft · windows 10 1507Oct 8, 2024

  • CVE-2024-43572
    81Now

    Microsoft Management Console Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 66%

    microsoft · windows 10 1507Oct 8, 2024

  • CVE-2024-43573
    76This week

    Windows MSHTML Platform Spoofing Vulnerability

    HighCVSS 8.1KEVWeaponizedEPSS 46%

    microsoft · windows 10 1507Oct 8, 2024

  • CVE-2024-43583
    31Monitor

    Winlogon Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows 10 1507Oct 8, 2024

  • CVE-2024-43612
    18Monitor

    Power BI Report Server Spoofing Vulnerability

    MediumCVSS 4.7No exploitEPSS 0%

    microsoft · power bi report serverOct 8, 2024

  • CVE-2024-47773
    32Monitor

    Anonymous cache poisoning via XHR requests in Discourse

    HighCVSS 8.2Proof of conceptEPSS 1%

    discourse · discourseOct 8, 2024

  • CVE-2024-47823
    30Monitor

    Livewire Remote Code Execution (RCE) on File Uploads

    HighCVSS 7.7Proof of conceptEPSS 0%

    laravel · livewireOct 8, 2024

  • CVE-2024-9379
    71This week

    SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to ru

    HighCVSS 7.2KEVWeaponizedEPSS 43%

    ivanti · endpoint manager cloud services applianceOct 8, 2024

  • CVE-2024-9680
    76This week

    An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines.

    CriticalCVSS 9.8KEVWeaponizedEPSS 23%

    mozilla · firefoxOct 9, 2024

  • CVE-2024-7293
    35Monitor

    Password policy for new users is not strong enough

    HighCVSS 8.8No exploitEPSS 0%

    progress · telerik reportingOct 9, 2024

  • CVE-2024-9463
    99Now

    Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

    CriticalCVSS 9.9KEVWeaponizedEPSS 98%

    paloaltonetworks · expeditionOct 9, 2024

  • CVE-2024-9464
    62This week

    Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure

    CriticalCVSS 9.3Proof of conceptEPSS 82%

    paloaltonetworks · expeditionOct 9, 2024

  • CVE-2024-9465
    96Now

    Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

    CriticalCVSS 9.2KEVWeaponizedEPSS 99%

    paloaltonetworks · expeditionOct 9, 2024

  • CVE-2024-9466
    36Monitor

    Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure

    HighCVSS 8.2Proof of conceptEPSS 13%

    paloaltonetworks · expeditionOct 9, 2024

  • CVE-2024-3656
    33Monitor

    Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

    HighCVSS 8.1Proof of conceptEPSS 2%

    red hat · red hat build of keycloakOct 9, 2024

  • CVE-2024-9796
    40Plan

    WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    internet-formation · wp-advanced-searchOct 10, 2024

  • CVE-2023-25581
    37Monitor

    Deserialization of untrusted data in InternalAttributeHandler in pac4j

    CriticalCVSS 9.2Proof of conceptEPSS 1%

    pac4j · pac4jOct 10, 2024

  • CVE-2024-9793
    28Monitor

    Tenda AC1206 ate ate_ifconfig_set command injection

    MediumCVSS 5.3No exploitEPSS 23%

    tenda · ac1206 firmwareOct 10, 2024

  • CVE-2024-47167
    27Monitor

    SSRF in the path parameter of /queue/join in Gradio

    MediumCVSS 6.9Proof of conceptEPSS 0%

    gradio project · gradioOct 10, 2024

  • CVE-2024-9487
    46Plan

    An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed

    CriticalCVSS 9.5Proof of conceptEPSS 25%

    github · enterprise serverOct 10, 2024

  • CVE-2024-9822
    39Monitor

    Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    pedalo · pedalo connectorOct 10, 2024

  • CVE-2024-21534
    42Plan

    All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    Oct 11, 2024

  • CVE-2024-7514
    26Monitor

    WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal

    MediumCVSS 6.5Proof of conceptEPSS 1%

    webtoffee · comments import & exportOct 11, 2024

  • CVE-2024-9234
    42Plan

    GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    ataurr · gutenkit – page builder blocks, patterns, and templates for gutenberg block editorOct 11, 2024

  • CVE-2024-9707
    42Plan

    Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    themehunk · hunk companionOct 11, 2024

  • CVE-2024-47875
    24Monitor

    DOMPurify nesting-based mXSS

    MediumCVSS 6.1Proof of conceptEPSS 1%

    cure53 · dompurifyOct 11, 2024

  • CVE-2024-42640
    51Plan

    angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php.

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    Oct 11, 2024

  • CVE-2024-48827
    36Monitor

    An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password fun

    HighCVSS 8.8Proof of conceptEPSS 2%

    sbond · watcharrOct 11, 2024

  • CVE-2024-46532
    39Monitor

    SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Oct 11, 2024

  • CVE-2024-35517
    33Monitor

    Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter.

    HighCVSS 7.2No exploitEPSS 15%

    netgear · xr1000 firmwareOct 11, 2024

  • CVE-2024-9821
    35Monitor

    Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass

    HighCVSS 8.8Proof of conceptEPSS 1%

    guruteam · bot for telegram on woocommerceOct 11, 2024

  • CVE-2024-9047
    67This week

    WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php

    CriticalCVSS 9.8Proof of conceptEPSS 93%

    iptanus · wordpress file uploadOct 12, 2024

  • CVE-2024-9756
    17Monitor

    Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload

    MediumCVSS 4.3Proof of conceptEPSS 0%

    directsoftware · order attachments for woocommerceOct 12, 2024

  • CVE-2024-9916
    49Plan

    HuangDou UTCMS cli.php os command injection

    MediumCVSS 6.9Proof of conceptEPSS 73%

    usualtool · usualtoolcmsOct 13, 2024

  • CVE-2024-48120
    21Monitor

    X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    x2engine · x2crmOct 14, 2024

  • CVE-2024-48259
    29Monitor

    Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.

    HighCVSS 7.3Proof of conceptEPSS 0%

    magicbug · cloudlogOct 14, 2024

  • CVE-2023-50780
    40Plan

    Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans

    HighCVSS 8.8Proof of conceptEPSS 17%

    apache · artemisOct 14, 2024

  • CVE-2024-41997
    26Monitor

    An issue was discovered in version of Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02).

    MediumCVSS 6.6Proof of conceptEPSS 1%

    Oct 14, 2024

  • CVE-2024-45741
    25Monitor

    Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise

    MediumCVSS 5.4No exploitEPSS 14%

    splunk · splunkOct 14, 2024

  • CVE-2024-46528
    17Monitor

    An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x

    MediumCVSS 4.3Proof of conceptEPSS 1%

    Oct 14, 2024

  • CVE-2024-9977
    27Monitor

    MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection

    MediumCVSS 5.1No exploitEPSS 22%

    mitrastar · gpt-2541gnacOct 15, 2024

  • CVE-2024-48914
    54Plan

    Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy

    CriticalCVSS 9.1Proof of conceptEPSS 60%

    vendure-ecommerce · vendureOct 15, 2024

  • CVE-2024-9506
    14Monitor

    Regular Expression Denial of Service (ReDoS)

    LowCVSS 3.7Proof of conceptEPSS 0%

    vue · vueOct 15, 2024

  • CVE-2024-35584
    37Monitor

    SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis

    HighCVSS 8.8Proof of conceptEPSS 5%

    os4ed · opensisOct 15, 2024

  • CVE-2024-21262
    26Monitor

    Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).

    MediumCVSS 6.5Proof of conceptEPSS 0%

    oracle · mysql connector\/odbcOct 15, 2024

  • CVE-2024-44337
    20Monitor

    The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML.

    MediumCVSS 5.1Proof of conceptEPSS 0%

    Oct 15, 2024