Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2024

238 records · 17 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

  • CVE-2012-10018
    33Monitor

    Mapplic Lite and Mapplic <= (Various Versions) - Server Side Request Forgery to Cross-Site Scirpting

    HighCVSS 8.3Proof of conceptEPSS 1%

    mapplic · mapplicOct 16, 2024

  • CVE-2016-15041
    24Monitor

    MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance Plugin <= 3.1.2 - Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 1%

    mainwp · mainwp dashboardOct 16, 2024

  • CVE-2017-20192
    24Monitor

    Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 1%

    strategy11 · formidable form builderOct 16, 2024

  • CVE-2019-25213
    31Monitor

    Advanced Access Manager <= 5.9.8.1 - Unauthenticated Arbitrary File Read

    HighCVSS 7.5Proof of conceptEPSS 2%

    vasyltech · advanced access managerOct 16, 2024

  • CVE-2020-36836
    32Monitor

    WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion

    HighCVSS 8.0Proof of conceptEPSS 1%

    wpfastestcache · wp fastest cacheOct 16, 2024

  • CVE-2021-4448
    39Monitor

    Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    kaswara project · kaswaraOct 16, 2024

  • CVE-2021-4449
    41Plan

    ZoomSounds <= 5.96 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    digitalzoomstudio · zoomsoundsOct 16, 2024

  • CVE-2022-4971
    29Monitor

    Sassy Social Share <= 3.3.3 - Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 17%

    heateor · sassy social shareOct 16, 2024

  • CVE-2016-15042
    41Plan

    Frontend File Manager < 4.0 & N-Media Post Front-end Form < 1.1 & - Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    najeebmedia · frontend file managerOct 16, 2024

  • CVE-2017-20194
    21Monitor

    Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 1%

    strategy11 · formidable form builderOct 16, 2024

  • CVE-2020-36842
    35Monitor

    Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8Proof of conceptEPSS 1%

    wpvivid · migration\, backup\, stagingOct 16, 2024

  • CVE-2023-22649
    40Plan

    Rancher 'Audit Log' leaks sensitive information

    HighCVSS 8.4WeaponizedEPSS 2%

    suse · rancherOct 16, 2024

  • CVE-2024-45216
    67This week

    Apache Solr: Authentication bypass possible using a fake URL Path ending

    CriticalCVSS 9.8Proof of conceptEPSS 92%

    apache · solrOct 16, 2024

  • CVE-2024-9061
    55Plan

    WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    themehunk · wp popup builderOct 16, 2024

  • CVE-2024-45844
    37Monitor

    BIG-IP monitors vulnerability

    HighCVSS 8.6No exploitEPSS 10%

    f5 · big-ip access policy managerOct 16, 2024

  • CVE-2024-38814
    40Plan

    An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware.

    HighCVSS 8.8No exploitEPSS 15%

    vmware · vmware hcxOct 16, 2024

  • CVE-2024-44762
    22Monitor

    A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.

    MediumCVSS 5.3Proof of conceptEPSS 2%

    webmin · userminOct 16, 2024

  • CVE-2024-6333
    28Monitor

    Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products

    HighCVSS 7.2Proof of conceptEPSS 1%

    xerox · altalink® b8045 / b8055 / b8065 / b8075 / b8090 | c8030 / c8035 / c8045 / c8055 / c807Oct 17, 2024

  • CVE-2024-48634
    37Monitor

    D-Link DIR_882_FW130B06 and DIR_878 DIR_878_FW130B08 were discovered to contain a command injection vulnerability via the key parameter in t

    HighCVSS 8.0No exploitEPSS 17%

    dlink · dir-882 firmwareOct 17, 2024

  • CVE-2023-39593
    22Monitor

    Insecure permissions in the sys_exec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated pr

    MediumCVSS 5.6Proof of conceptEPSS 0%

    mariadb · mariadbOct 17, 2024

  • CVE-2024-27766
    22Monitor

    An issue in MariaDB v.11.1 allows a remote attacker to execute arbitrary code via the lib_mysqludf_sys.so function.

    MediumCVSS 5.7Proof of conceptEPSS 1%

    mariadb · mariadbOct 17, 2024

  • CVE-2024-33453
    32Monitor

    Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.

    HighCVSS 8.1Proof of conceptEPSS 0%

    espressif · esp-idfOct 17, 2024

  • CVE-2024-9264
    66This week

    Grafana SQL Expressions allow for remote code execution

    CriticalCVSS 9.4WeaponizedEPSS 97%

    grafana · grafanaOct 18, 2024

  • CVE-2024-38820
    21Monitor

    CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

    MediumCVSS 5.3Proof of conceptEPSS 0%

    vmware · spring frameworkOct 18, 2024

  • CVE-2024-9537
    68This week

    ScienceLogic SL1 unspecified vulnerability

    CriticalCVSS 9.3KEVWeaponizedEPSS 3%

    sciencelogic · sl1Oct 18, 2024

  • CVE-2024-9593
    37Monitor

    Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution

    HighCVSS 8.3Proof of conceptEPSS 12%

    wpplugin · time clockOct 18, 2024

  • CVE-2024-37404
    56Plan

    Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1

    HighCVSS 8.8WeaponizedEPSS 70%

    ivanti · connect secureOct 18, 2024

  • CVE-2024-10140
    21Monitor

    code-projects Pharmacy Management System manage_supplier.php sql injection

    MediumCVSS 5.3Proof of conceptEPSS 1%

    code-projects · pharmacy management systemOct 19, 2024

  • CVE-2024-10193
    25Monitor

    WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping_ddns command injection

    MediumCVSS 5.1No exploitEPSS 15%

    wavlink · wn530h4 firmwareOct 20, 2024

  • CVE-2024-49328
    39Monitor

    WordPress WP REST API FNS Plugin plugin <= 1.0.0 - Account Takeover vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    vivektamrakar · wp rest api fnsOct 20, 2024

  • CVE-2024-49607
    39Monitor

    WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    redwanhilali · wp dropbox dropinsOct 20, 2024

  • CVE-2024-44000
    64This week

    WordPress LiteSpeed Cache plugin < 6.5.0.1 - Unauthenticated Account Takeover via Cookie Leak vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 82%

    litespeedtech · litespeed cacheOct 20, 2024

  • CVE-2024-8625
    29Monitor

    TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injection

    HighCVSS 7.2Proof of conceptEPSS 2%

    total-soft · ts pollOct 21, 2024

  • CVE-2024-45309
    60This week

    OneDev vulnerable to arbitrary file reading for unauthenticated user

    HighCVSS 8.7WeaponizedEPSS 24%

    onedev project · onedevOct 21, 2024

  • CVE-2024-49368
    43Plan

    Unchecked logrotate settings lead to arbitrary command execution

    HighCVSS 8.9Proof of conceptEPSS 27%

    nginxui · nginx uiOct 21, 2024

  • CVE-2024-49882
    31Monitor

    ext4: fix double brelse() the buffer of the extents path

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelOct 21, 2024

  • CVE-2024-35286
    59Plan

    A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection

    CriticalCVSS 9.8Proof of conceptEPSS 65%

    mitel · micollabOct 21, 2024

  • CVE-2024-35315
    22Monitor

    A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.2

    MediumCVSS 5.6Proof of conceptEPSS 0%

    mitel · micollabOct 21, 2024

  • CVE-2024-41713
    95Now

    A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenti

    CriticalCVSS 9.1KEVWeaponizedEPSS 97%

    mitel · micollabOct 21, 2024

  • CVE-2024-8852
    21Monitor

    All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

    MediumCVSS 5.3Proof of conceptEPSS 1%

    servmask · all-in-one wp migrationOct 22, 2024

  • CVE-2022-23861
    21Monitor

    Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    ysoft · safeqOct 22, 2024

  • CVE-2022-23862
    31Monitor

    A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53.

    HighCVSS 7.8Proof of conceptEPSS 0%

    ysoft · safeqOct 22, 2024

  • CVE-2024-48605
    31Monitor

    An issue in Helakuru Desktop Application v1.1 allows a local attacker to execute arbitrary code via the lack of proper validation of the wow

    HighCVSS 7.8Proof of conceptEPSS 0%

    helakuru · helakuruOct 22, 2024

  • CVE-2024-45518
    41Plan

    An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before P

    HighCVSS 8.8No exploitEPSS 20%

    zimbra · collaborationOct 22, 2024

  • CVE-2024-46538
    43Plan

    A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload

    MediumCVSS 4.8Proof of conceptEPSS 80%

    netgate · pfsenseOct 22, 2024

  • CVE-2024-44812
    39Monitor

    SQL Injection vulnerability in Online Complaint Site v.1.0 allows a remote attacker to escalate privileges via the username and password par

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    janobe · online complaint siteOct 22, 2024

  • CVE-2024-46483
    39Monitor

    Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap ov

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Oct 22, 2024

  • CVE-2024-48415
    20Monitor

    itsourcecode Loan Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload to the lastname, firstname, middl

    MediumCVSS 5.0Proof of conceptEPSS 0%

    razormist · loan management systemOct 22, 2024

  • CVE-2024-48644
    21Monitor

    Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote

    MediumCVSS 5.3Proof of conceptEPSS 0%

    Oct 22, 2024

  • CVE-2024-48652
    19Monitor

    Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field

    MediumCVSS 4.8Proof of conceptEPSS 1%

    tuzitio · camaleon cmsOct 22, 2024

  • CVE-2024-50050
    25Monitor

    Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, poten

    MediumCVSS 6.3Proof of conceptEPSS 0%

    meta platforms, inc · llama stackOct 23, 2024

  • CVE-2024-47575
    97Now

    A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, Fo

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    fortinet · fortimanagerOct 23, 2024

  • CVE-2024-5764
    23Monitor

    Nexus Repository 3 - Static hard-coded encryption passphrase used by default

    MediumCVSS 5.9Proof of conceptEPSS 0%

    sonatype · nexus repository managerOct 23, 2024

  • CVE-2024-49653
    39Monitor

    WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    james-eggers · portfolleoOct 23, 2024

  • CVE-2024-49668
    40Plan

    WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    christopherdewese1099 · verbalize wpOct 23, 2024

  • CVE-2024-20384
    23Monitor

    A vulnerability in the Network Service Group (NSG) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat De

    MediumCVSS 5.8No exploitEPSS 0%

    cisco · adaptive security appliance softwareOct 23, 2024

  • CVE-2024-20481
    60This week

    A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defe

    MediumCVSS 5.8KEVWeaponizedEPSS 15%

    cisco · secure firewall threat defenseOct 23, 2024

  • CVE-2024-40431
    35Monitor

    A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUG

    HighCVSS 8.8Proof of conceptEPSS 1%

    Oct 23, 2024

  • CVE-2024-40432
    26Monitor

    A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_C

    MediumCVSS 6.5Proof of conceptEPSS 0%

    Oct 23, 2024

  • CVE-2024-6049
    31Monitor

    Unauthenticated Path Traversal

    HighCVSS 7.5Proof of conceptEPSS 4%

    lawo ag · vsm ltc time sync (vtimesync)Oct 24, 2024

  • CVE-2024-49681
    37Monitor

    WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.0.9 - SQL Injection vulnerability

    CriticalCVSS 9.3Proof of conceptEPSS 1%

    activity-log.com · wp sessions time monitoring full automaticOct 24, 2024

  • CVE-2024-48139
    30Monitor

    A prompt injection vulnerability in the chatbox of Blackbox AI v1.3.95 allows attackers to access and exfiltrate all previous and subsequent

    HighCVSS 7.5Proof of conceptEPSS 0%

    Oct 24, 2024

  • CVE-2024-48427
    35Monitor

    A SQL injection vulnerability in Sourcecodester Packers and Movers Management System v1.0 allows remote authenticated users to execute arbit

    HighCVSS 8.8Proof of conceptEPSS 0%

    oretnom23 · packers and movers management systemOct 24, 2024

  • CVE-2024-45242
    42Plan

    EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping o

    HighCVSS 7.8No exploitEPSS 35%

    Oct 24, 2024

  • CVE-2024-48208
    34Monitor

    pure-ftpd before 1.0.52 is vulnerable to Buffer Overflow.

    HighCVSS 8.6Proof of conceptEPSS 1%

    pureftpd · pure-ftpdOct 24, 2024

  • CVE-2024-49357
    37Monitor

    ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak

    HighCVSS 7.5Proof of conceptEPSS 23%

    zimaspace · zimaosOct 24, 2024

  • CVE-2024-10354
    20Monitor

    SourceCodester Petrol Pump Management Software print.php sql injection

    MediumCVSS 5.1Proof of conceptEPSS 0%

    mayurik · petrol pump managementOct 24, 2024

  • CVE-2024-10355
    20Monitor

    SourceCodester Petrol Pump Management Software invoice.php sql injection

    MediumCVSS 5.1Proof of conceptEPSS 0%

    mayurik · petrol pump managementOct 24, 2024

  • CVE-2024-49380
    36Monitor

    Plenti arbitrary file write vulnerability

    HighCVSS 8.9Proof of conceptEPSS 2%

    plenti · plentiOct 25, 2024

  • CVE-2024-49757
    20Monitor

    Zitadel User Registration Bypass Vulnerability

    MediumCVSS 4.9Proof of conceptEPSS 2%

    zitadel · zitadelOct 25, 2024

  • CVE-2024-10386
    43Plan

    Rockwell Automation FactoryTalk ThinManager Authentication Vulnerability

    CriticalCVSS 9.3No exploitEPSS 19%

    rockwellautomation · thinmanagerOct 25, 2024

  • CVE-2024-9890
    35Monitor

    User Toolkit <= 1.2.3 - Authenticated (Subscriber+) Authentication Bypass

    HighCVSS 8.8Proof of conceptEPSS 1%

    deryck · user toolkitOct 25, 2024

  • CVE-2024-9932
    50Plan

    Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 36%

    jurredeklijn · wux blog editorOct 25, 2024

  • CVE-2024-9933
    40Plan

    WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value Check

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    watchtowerhq · watchtowerhqOct 25, 2024

  • CVE-2024-9772
    29Monitor

    Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution

    HighCVSS 7.3Proof of conceptEPSS 1%

    uiux · uix shortcodesOct 26, 2024

  • CVE-2024-10410
    21Monitor

    SourceCodester Online Hotel Reservation System controller.php upload unrestricted upload

    MediumCVSS 5.3Proof of conceptEPSS 1%

    janobe · online hotel reservation systemOct 27, 2024

  • CVE-2024-50602
    23Monitor

    An issue was discovered in libexpat before 2.6.4.

    MediumCVSS 5.9Proof of conceptEPSS 1%

    netapp · active iq unified managerOct 27, 2024

  • CVE-2024-10428
    38Monitor

    WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set_ipv6 command injection

    HighCVSS 8.6No exploitEPSS 14%

    wavlink · wn530h4 firmwareOct 27, 2024

  • CVE-2024-10429
    39Monitor

    WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set_ipv6 command injection

    HighCVSS 8.6No exploitEPSS 18%

    wavlink · wn530h4 firmwareOct 27, 2024

  • CVE-2024-50623
    99Now

    In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download th

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    cleo · harmonyOct 28, 2024

  • CVE-2024-9162
    29Monitor

    All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection

    HighCVSS 7.2Proof of conceptEPSS 2%

    servmask · all-in-one wp migration and backupOct 28, 2024

  • CVE-2024-38821
    37Monitor

    Authorization Bypass of Static Resources in WebFlux Applications

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    spring · springOct 28, 2024

  • CVE-2024-50450
    39Monitor

    WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    pluginus · wordpress meta data and taxonomies filterOct 28, 2024

  • CVE-2024-50477
    41Plan

    WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    stacksmarket · stacks mobile app builderOct 28, 2024

  • CVE-2024-50492
    39Monitor

    WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    wpplugin · scottcartOct 28, 2024

  • CVE-2024-50498
    55Plan

    WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    lubus · wp query consoleOct 28, 2024

  • CVE-2024-50478
    39Monitor

    WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    swoopnow · 1-click login\Oct 28, 2024

  • CVE-2024-50483
    40Plan

    WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    tareqhasan · meetupOct 28, 2024

  • CVE-2024-50488
    35Monitor

    WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    priyabratasarkar · token loginOct 28, 2024

  • CVE-2024-50491
    39Monitor

    WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    micahblu · rsvp meOct 28, 2024

  • CVE-2024-10448
    27Monitor

    code-projects Blood Bank Management System delete.php cross-site request forgery

    MediumCVSS 6.9Proof of conceptEPSS 0%

    fabian · blood bank management systemOct 28, 2024

  • CVE-2024-10449
    27Monitor

    Codezips Hospital Appointment System loginAction.php sql injection

    MediumCVSS 6.9Proof of conceptEPSS 1%

    codezips · hospital appointment systemOct 28, 2024

  • CVE-2024-45802
    44Plan

    Squid Denial of Service

    HighCVSS 7.5No exploitEPSS 47%

    squid-cache · squidOct 28, 2024

  • CVE-2024-39205
    60This week

    An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request

    CriticalCVSS 9.8WeaponizedEPSS 16%

    Oct 28, 2024

  • CVE-2024-44236
    25Monitor

    An out-of-bounds access issue was addressed with improved bounds checking.

    MediumCVSS 5.5No exploitEPSS 11%

    apple · macosOct 28, 2024

  • CVE-2024-44258
    28Monitor

    This issue was addressed with improved handling of symlinks.

    HighCVSS 7.1Proof of conceptEPSS 0%

    apple · ipadosOct 28, 2024

  • CVE-2024-44285
    31Monitor

    A use-after-free issue was addressed with improved memory management.

    HighCVSS 7.8Proof of conceptEPSS 0%

    apple · ipadosOct 28, 2024

  • CVE-2024-48594
    40Plan

    File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the file upload component

    HighCVSS 8.8WeaponizedEPSS 3%

    fast5 · prison management systemOct 28, 2024

  • CVE-2024-50482
    40Plan

    WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    chetan khandla · woocommerce product designOct 29, 2024

  • CVE-2024-50493
    40Plan

    WordPress Automatic Translation plugin <= 1.0.4 - Arbitrary File Upload vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    masterhomepage · automatic translationOct 29, 2024