Exploited and new serious CVEs: April 2024
218 records · 10 KEV. In publication order.
Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.
Month boundaries are UTC, the same rule as the publication date on each record page.
Page 3 of 3
| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
42Plan | CVE-2024-27322No exploit | Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not includthe r project · r · CWE-502 | High8.8 | — | 23.4% | Apr 29, 2024 |
32Monitor | CVE-2024-4309Proof of concept | SQL injection vulnerability in HubBankofofonobsdev · hubbank · CWE-89 | High8.1 | — | 0.4% | Apr 29, 2024 |
24Monitor | CVE-2024-23995Proof of concept | Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a CWE-79 | Medium6.1 | — | 0.9% | Apr 29, 2024 |
48Plan | CVE-2024-31621Proof of concept | An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 cflowiseai · flowise · CWE-94 | High7.6 | — | 59.8% | Apr 29, 2024 |
32Monitor | CVE-2024-33438Proof of concept | File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.cubecart · cubecart · CWE-434 | High8.0 | — | 1.1% | Apr 29, 2024 |
31Monitor | CVE-2024-27518Proof of concept | An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a cCWE-269 | High7.8 | — | 0.6% | Apr 29, 2024 |
32Monitor | CVE-2023-46304Proof of concept | modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected vtiger · vtiger crm · CWE-74 | High8.1 | — | 1.6% | Apr 30, 2024 |
26Monitor | CVE-2024-23772Proof of concept | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.CWE-22 | Medium6.6 | — | 0.3% | Apr 30, 2024 |
31Monitor | CVE-2024-23773Proof of concept | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.CWE-22 | High7.8 | — | 0.3% | Apr 30, 2024 |
31Monitor | CVE-2024-23774Proof of concept | An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.CWE-22 | High7.8 | — | 0.4% | Apr 30, 2024 |
40Plan | CVE-2024-25575No exploit | A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object.foxit · pdf editor · CWE-843 | High8.8 | — | 17.7% | Apr 30, 2024 |
40Plan | CVE-2024-25648No exploit | A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget.foxit · pdf editor · CWE-416 | High8.8 | — | 15.6% | Apr 30, 2024 |
40Plan | CVE-2024-25938No exploit | A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget.foxit · pdf editor · CWE-416 | High8.8 | — | 15.6% | Apr 30, 2024 |
31Monitor | CVE-2024-4340Proof of concept | Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.CWE-674 | High7.5 | — | 3.2% | Apr 30, 2024 |
25Monitor | CVE-2024-33832Proof of concept | OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_inCWE-918 | Medium6.3 | — | 0.7% | Apr 30, 2024 |
45Plan | CVE-2024-26331Proof of concept | ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to CWE-287 | High7.5 | — | 51.2% | Apr 30, 2024 |
24Monitor | CVE-2024-33371No exploit | Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the mdedecms · dedecms · CWE-79 | Medium6.1 | — | 0.4% | Apr 30, 2024 |
18Monitor | CVE-2024-4348Proof of concept | osCommerce all-products cross site scriptingCWE-79 | Medium4.3 | — | 1.8% | Apr 30, 2024 |
- CVE-2024-2732242Plan
Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not includ
HighCVSS 8.8No exploitEPSS 23%the r project · rApr 29, 2024
- CVE-2024-430932Monitor
SQL injection vulnerability in HubBank
HighCVSS 8.1Proof of conceptEPSS 0%ofofonobsdev · hubbankApr 29, 2024
- CVE-2024-2399524Monitor
Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a
MediumCVSS 6.1Proof of conceptEPSS 0%Apr 29, 2024
- CVE-2024-3162148Plan
An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 c
HighCVSS 7.6Proof of conceptEPSS 59%flowiseai · flowiseApr 29, 2024
- CVE-2024-3343832Monitor
File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted .phar file.
HighCVSS 8.0Proof of conceptEPSS 1%cubecart · cubecartApr 29, 2024
- CVE-2024-2751831Monitor
An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a c
HighCVSS 7.8Proof of conceptEPSS 0%Apr 29, 2024
- CVE-2023-4630432Monitor
modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected
HighCVSS 8.1Proof of conceptEPSS 1%vtiger · vtiger crmApr 30, 2024
- CVE-2024-2377226Monitor
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.
MediumCVSS 6.6Proof of conceptEPSS 0%Apr 30, 2024
- CVE-2024-2377331Monitor
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.
HighCVSS 7.8Proof of conceptEPSS 0%Apr 30, 2024
- CVE-2024-2377431Monitor
An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0.
HighCVSS 7.8Proof of conceptEPSS 0%Apr 30, 2024
- CVE-2024-2557540Plan
A type confusion vulnerability vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Lock object.
HighCVSS 8.8No exploitEPSS 17%foxit · pdf editorApr 30, 2024
- CVE-2024-2564840Plan
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget.
HighCVSS 8.8No exploitEPSS 15%foxit · pdf editorApr 30, 2024
- CVE-2024-2593840Plan
A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget.
HighCVSS 8.8No exploitEPSS 15%foxit · pdf editorApr 30, 2024
- CVE-2024-434031Monitor
Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
HighCVSS 7.5Proof of conceptEPSS 3%Apr 30, 2024
- CVE-2024-3383225Monitor
OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_in
MediumCVSS 6.3Proof of conceptEPSS 0%Apr 30, 2024
- CVE-2024-2633145Plan
ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to
HighCVSS 7.5Proof of conceptEPSS 51%Apr 30, 2024
- CVE-2024-3337124Monitor
Cross Site Scripting vulnerability in DedeCMS v.5.7.113 allows a remote attacker to execute arbitrary code via the typeid parameter in the m
MediumCVSS 6.1No exploitEPSS 0%dedecms · dedecmsApr 30, 2024
- CVE-2024-434818Monitor
osCommerce all-products cross site scripting
MediumCVSS 4.3Proof of conceptEPSS 1%Apr 30, 2024