Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

577new WordPress flaws this week

391,397entries in the database

3,436 results · page 36 of 69

Jul 22, 2024Search & Replace: Deserialization of Untrusted DataCVE-2024-38759 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2.
Product
Search & Replace
Affected
up to 3.2.2
What to do
Affects up to 3.2.2. Update Search & Replace to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 12, 2024The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source wiCVE-2024-36522 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source without validation. Users are recommended to upgrade to versions 10.1.0, 9.18.0 or 8.16.0, which fix this issue.
Product
Apache Wicket
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com lists.apache.org
Jul 9, 2024Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution.CVE-2024-34123 · Other software · Adobe · reported by AdobeHigh 7
Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search path, which the application might execute instead of the legitimate file. This could occur when the application uses a search path to locate executables or libraries. Exploitation of this issue requires user interaction, attack complexity is high.
Product
Premiere Pro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com helpx.adobe.com
Jul 9, 2024WooCommerce Social Login: Deserialization of Untrusted DataCVE-2024-37502 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in wpweb WooCommerce Social Login woo-social-login.This issue affects WooCommerce Social Login: from n/a through <= 2.6.3.
Product
WooCommerce Social Login
Affected
up to 2.6.3
What to do
Affects up to 2.6.3. Update WooCommerce Social Login to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 8, 2024Buffer overflow in "rcar_dev_init" due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMACVE-2024-6564 · Other software · Renesas · reported by cve@asrg.ioMedium 6.7
Buffer overflow in "rcar_dev_init" due to using due to using untrusted data (rcar_image_number) as a loop counter before verifying it against RCAR_MAX_BL3X_IMAGE. This could lead to a full bypass of secure boot.
Product
rcar_gen3_v2.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record asrg.io github.com
Jul 6, 2024Academy LMS: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-37234 · WordPress plugins & themes · reported by PatchstackLow 3.5
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.
Product
Academy LMS
Affected
up to 2.0.4
What to do
Affects up to 2.0.4. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 27, 2024NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used.CVE-2024-39705 · Other software · nltk · reported by MITRECritical 9.8
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
Product
nltk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 27, 2024An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.CVE-2024-35260 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
Product
Microsoft Power Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com msrc.microsoft.com
Jun 26, 2024URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magarsus Consultancy SSO (Single Sign On) allows Manipulating Hidden Fields.CVE-2024-4604 · Other software · Magarsus Consultancy · reported by iletisim@usom.gov.trMedium 6.1
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magarsus Consultancy SSO (Single Sign On) allows Manipulating Hidden Fields. This issue affects SSO (Single Sign On): from 1.0 before 1.1.
Product
SSO (Single Sign On)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Jun 21, 2024Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval oCVE-2014-5470 · Other software · actualscripts · reported by MITRECritical 9.8
Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation.
Product
actualanalyzer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulmon.com exploit-db.com
Jun 19, 2024Page Builder: Live Composer: Deserialization of Untrusted DataCVE-2024-35780 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Deserialization of Untrusted Data vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.42.
Product
Page Builder: Live Composer
Affected
up to 1.5.42
What to do
Affects up to 1.5.42. Update Page Builder: Live Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 16, 2024htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.CVE-2024-38448 · Other software · gnu · reported by MITRECritical 9.1
htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.
Product
global
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cvs.savannah.gnu.org lists.gnu.org
Jun 13, 2024NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where an untrusted guest VM can cause improper control of the interaction frCVE-2024-0094 · Other software · nvidia · reported by psirt@nvidia.comMedium 5.5
NVIDIA vGPU software for Linux contains a vulnerability in the Virtual GPU Manager, where an untrusted guest VM can cause improper control of the interaction frequency in the host. A successful exploit of this vulnerability might lead to denial of service.
Product
vGPU software and Cloud Gaming
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Jun 13, 2024NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API.CVE-2024-0091 · Other software · nvidia · reported by psirt@nvidia.comHigh 7.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where a user can cause an untrusted pointer dereference by executing a driver API. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.
Product
GPU display driver, vGPU software, and Cloud Gaming
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nvidia.custhelp.com nvidia.custhelp.com
Jun 11, 2024Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability CVE-2024-35250 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comExploitedHigh 7.8
Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.
Product
Windows
On CISA’s list since
Dec 16, 2024 (federal fix deadline Jan 6, 2025)
What to do
Attackers are using this now. Install Microsoft’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog msrc.microsoft.com msrc.microsoft.com
Jun 10, 2024SAP Financial Consolidation allows data to enter a Web application through an untrusted source.CVE-2024-37177 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and integrity of the application.
Product
SAP Financial Consolidation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
Jun 10, 2024Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python scriCVE-2024-37014 · Other software · langflow · reported by MITRECritical 9.8
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.
Product
langflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 6, 2024Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35.CVE-2024-5675 · Other software · Summar Software · reported by cve-coordination@incibe.esCritical 10
Untrusted data deserialization vulnerability has been found in Mentor - Employee Portal, affecting version 3.83.35. This vulnerability could allow an attacker to execute arbitrary code, by injecting a malicious payload into the “ViewState” field.
Product
Mentor – Employee Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es incibe.es
Jun 4, 2024Element Pack Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted DataCVE-2024-33568 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Deserialization of Untrusted Data vulnerability in BdThemes Element Pack Pro allows Path Traversal, Object Injection.This issue affects Element Pack Pro: from n/a before 7.19.3.
Product
Element Pack Pro
Fixed in
7.19.3
What to do
Update Element Pack Pro to 7.19.3 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 4, 2024Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on CVE-2024-37065 · Other software · Skops-dev · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to run arbitrary code on an end user's system when loaded.
Product
Skops
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset toCVE-2024-37064 · Other software · YdataAI · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciously crafted dataset to run arbitrary code on an end user's system when loaded.
Product
ydata-profiling
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to rCVE-2024-37062 · Other software · YdataAI · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 7.8
Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicously crafted report to run arbitrary code on an end user's system when loaded.
Product
ydata-profiling
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to executeCVE-2024-37060 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to CVE-2024-37059 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExCVE-2024-37058 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow modCVE-2024-37057 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-CVE-2024-37056 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model tCVE-2024-37055 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to rCVE-2024-37054 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn modeCVE-2024-37053 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 4, 2024Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn modeCVE-2024-37052 · Other software · MLflow · reported by 6f8de1f0-f67e-45a6-b68f-98777fdb759cHigh 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
Product
MLflow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record hiddenlayer.com hiddenlayer.com
Jun 3, 2024A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow aCVE-2024-23664 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.1
A URL redirection to untrusted site ('open redirect') in Fortinet FortiAuthenticator version 6.6.0, version 6.5.3 and below, version 6.4.9 and below may allow an attacker to to redirect users to an arbitrary website via a crafted URL.
Product
FortiAuthenticator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fortiguard.fortinet.com fortiguard.fortinet.com
May 30, 2024In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host tCVE-2024-36911 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The netvsc driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
May 30, 2024In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted hCVE-2024-36910 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 8.4
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. The VMBus device UIO driver could free decrypted/shared pages if set_memory_decrypted() fails. Check the decrypted field in the gpadl to decide whether to free the memory.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
May 29, 2024In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possibleCVE-2024-36373 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2024.03.2 several stored XSS in untrusted builds settings were possible
Product
TeamCity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jetbrains.com jetbrains.com
May 29, 2024Site Reviews: Retrieves client IP addresses from potentially untrusted headersCVE-2024-3050 · WordPress plugins & themes · reported by WPScanCritical 9.1
The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to bypass IP-based blocking
Product
Site Reviews
Fixed in
7.0.0
What to do
Update Site Reviews to 7.0.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 28, 2024TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.CVE-2024-22641 · Other software · tcpdf_project · reported by MITREHigh 7.5
TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG file.
Product
tcpdf
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 27, 2024Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 bCVE-2024-26289 · Other software · PMB Services · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Critical 9.8
Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18.
Product
PMB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record forge.sigb.net github.com
May 24, 2024Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or comCVE-2024-36361 · Other software · pugjs · reported by MITREMedium 6.8
Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.
Product
pug
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com pugjs.org
May 21, 2024OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data.CVE-2024-34274 · Other software · openbd · reported by MITRELow 3.9
OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. The cookies bdglobals and bdclient_spot of the OpenBD software uses serialized data, which can be used to execute arbitrary code on the system. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Product
bdclient_spot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 21, 2024PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.CVE-2024-36039 · Other software · reported by MITREMedium 6.3
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com lists.debian.org
May 17, 2024In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler.CVE-2024-25742 · Other software · reported by MITREMedium 6.5
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and can trigger its handler. This affects AMD SEV-SNP and AMD SEV-ES.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cdn.kernel.org git.kernel.org
May 17, 2024The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-looCVE-2023-52424 · Other software · ieee · reported by MITREHigh 7.4
The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an "SSID Confusion" issue. This occurs because the SSID is not always used to derive the pairwise master key or session keys, and because there is not a protected exchange of an SSID during a 4-way handshake.
Product
802.11_wireless_protocol
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mentor.ieee.org top10vpn.com
May 16, 2024Order Export & Order Import for WooCommerce: Deserialization of Untrusted DataCVE-2024-34751 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in WebToffee Order Export & Order Import for WooCommerce.This issue affects Order Export & Order Import for WooCommerce: from n/a through 2.4.9.
Product
Order Export & Order Import for WooCommerce
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update Order Export & Order Import for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2024In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler iCVE-2024-25743 · Computers, phones & browsers · linux · reported by MITREHigh 7.1
In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time and can trigger the SIGFPE signal handler in userspace applications. This affects AMD SEV-SNP and AMD SEV-ES.
Product
kernel
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.suse.com
May 14, 2024 Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attackCVE-2024-32733 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify sensitive information with no impact on availability of the application
Product
SAP NetWeaver Application Server ABAP and ABAP Platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record me.sap.com support.sap.com
May 14, 2024 A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.CVE-2024-28133 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 7.8
A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges.
Product
CHARX SEC-3000
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.vde.com cert.vde.com
May 14, 2024Ultimate Store Kit Elementor Addons: Deserialization of Untrusted DataCVE-2024-4606 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Deserialization of Untrusted Data vulnerability in BdThemes Ultimate Store Kit Elementor Addons.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.0.3.
Product
Ultimate Store Kit Elementor Addons
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update Ultimate Store Kit Elementor Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 14, 2024A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution.CVE-2024-4044 · Other software · NI · reported by security@ni.comHigh 7.8
A deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.
Product
FlexLogger
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ni.com ni.com
May 14, 2024One Click Demo Import: Deserialization of Untrusted DataCVE-2024-34433 · WordPress plugins & themes · reported by PatchstackMedium 4.4
Deserialization of Untrusted Data vulnerability in OCDI One Click Demo Import.This issue affects One Click Demo Import: from n/a through 3.2.0.
Product
One Click Demo Import
Affected
up to 3.2.0
What to do
Affects up to 3.2.0. Update One Click Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.