By publication date
Exploited and new serious CVEs: November 2024
205 records · 16 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 3 of 3
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
53Plan | CVE-2024-8672Proof of concept | Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Executionmarketingfire · widget options – advanced conditional visibility for gutenberg blocks & classic widgets · CWE-94 | Critical9.9 | — | 45.3% | Nov 28, 2024 |
40Plan | CVE-2024-52475Proof of concept | WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerabilityinformation technology · wawp · CWE-288 | Critical9.8 | — | 1.8% | Nov 28, 2024 |
31Monitor | CVE-2024-48651Proof of concept | In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplementCWE-863 | High7.5 | — | 2.1% | Nov 29, 2024 |
9Monitor | CVE-2024-52800Proof of concept | Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLIverapdf · verapdf-library · CWE-611 | Low2.3 | — | 1.1% | Nov 29, 2024 |
24Monitor | CVE-2024-11252Proof of concept | Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameterheateor · sassy social share · CWE-79 | Medium6.1 | — | 0.9% | Nov 30, 2024 |
- CVE-2024-867253Plan
Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution
CriticalCVSS 9.9Proof of conceptEPSS 45%marketingfire · widget options – advanced conditional visibility for gutenberg blocks & classic widgetsNov 28, 2024
- CVE-2024-5247540Plan
WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 1%information technology · wawpNov 28, 2024
- CVE-2024-4865131Monitor
In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplement
HighCVSS 7.5Proof of conceptEPSS 2%Nov 29, 2024
- CVE-2024-528009Monitor
Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI
LowCVSS 2.3Proof of conceptEPSS 1%verapdf · verapdf-libraryNov 29, 2024
- CVE-2024-1125224Monitor
Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter
MediumCVSS 6.1Proof of conceptEPSS 0%heateor · sassy social shareNov 30, 2024