Updated 9 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,779exploited flaws on CISA’s list

40added in the last 30 days

573new WordPress flaws this week

398,071entries in the database

38,884 results · page 326 of 778

Jun 21, 2024Themify – WooCommerce Product Filter: Time-based SQL InjectionCVE-2024-6027 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditions’ parameter in all versions up to, and including, 1.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Themify – WooCommerce Product Filter
Affected
up to 1.4.9
What to do
Affects up to 1.4.9. Update Themify – WooCommerce Product Filter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 21, 2024Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce: Time-based SQL InjectionCVE-2024-5756 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce
Affected
up to 5.7.23
What to do
Affects up to 5.7.23. Update Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 20, 2024XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.CVE-2024-37899 · Other software · xwiki · reported by GitHubCritical 9
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin disables a user account, the user's profile is executed with the admin's rights. This allows a user to place malicious code in the user profile before getting an admin to disable the user account. To reproduce, as a user without script nor programming rights, edit the about section of your user profile and add `{{groovy}}services.logging.getLogger("attacker").error("Hello from Groovy!"){{/groovy}}`. As an admin, go to the user profile and click the "Disable this account" button. Then, reload the page. If the logs show `attacker - Hello from Groovy!` then the instance is vulnerable. This has been patched in XWiki 14.10.21, 15.5.5, 15.10.6 and 16.0.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. ### Workarounds We're not aware of any workaround except upgrading. ### References * https://jira.xwiki.org/browse/XWIKI-21611 * https://github.com/xwiki/xwiki-platform/commit/f89c8f47fad6e5cc7e68c69a7e0acde07f5eed5a
Product
xwiki-platform
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 20, 2024An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.CVE-2024-37699 · Other software · softnews_media_group · reported by MITRECritical 9.8
An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.
Product
datalife_engine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record dle-news.ru exploit.az
Jun 20, 2024In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain records The function tipc_mon_rcv() allCVE-2022-48711 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain records The function tipc_mon_rcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the network topology. This patch verifies that the number of members in a received domain record does not exceed the limit defined by MAX_MON_DOMAIN, something that may otherwise lead to a stack overflow. tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where we are reading a 32 bit message data length field into a uint16. To avert any risk of bit overflow, we add an extra sanity check for this in that function. We cannot see that happen with the current code, but future designers being unaware of this risk, may introduce it by allowing delivery of very large (> 64k) sk buffers from the bearer layer. This potential problem was identified by Eric Dumazet. This fixes CVE-2022-0435
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 20, 2024Shariff Wrapper: Local File InclusionCVE-2024-4098 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Shariff Wrapper
Affected
up to 4.6.13
What to do
Affects up to 4.6.13. Update Shariff Wrapper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024Lifeline Donation: Authentication bypassCVE-2024-5432 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.6. This is due to insufficient verification on the user being supplied during the checkout through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Product
Lifeline Donation
Affected
up to 1.2.6
What to do
Affects up to 1.2.6. Update Lifeline Donation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jun 19, 2024WP Hotel Booking: SQL InjectionCVE-2024-3605 · WordPress plugins & themes · reported by WordfenceCritical 10
The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Product
WP Hotel Booking
Affected
up to 2.1.0
What to do
Affects up to 2.1.0. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 19, 2024A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process toCVE-2024-5182 · Other software · mudler · reported by security@huntr.devCritical 9.1
A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.
Product
mudler/localai
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.com
Jun 19, 2024In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection.CVE-2024-36684 · Other software · promokit · reported by MITRECritical 9.8
In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
Product
pk_customlinks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Jun 19, 2024In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection.CVE-2024-36679 · Websites & servers · prestashop · reported by MITRECritical 10
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file.
Product
livechatpro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Jun 19, 2024In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection.CVE-2024-36678 · Other software · promokit · reported by MITRECritical 9.8
In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
Product
promokit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.friendsofpresta.org security.friendsofpresta.org
Jun 19, 2024In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontControllCVE-2024-34994 · Websites & servers · prestashop · reported by MITRECritical 9.8
In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontController::postProcess()`.
Product
channable
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2024In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files.CVE-2024-34990 · Websites & servers · prestashop · reported by MITRECritical 10
In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers.
Product
helpdesk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2024In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php.CVE-2024-33836 · Websites & servers · prestashopmodules · reported by MITRECritical 9.8
In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X, the method `JmarketplaceproductModuleFrontController::init()` and in version 8.X, the method `JmarketplaceSellerproductModuleFrontController::init()` allow upload of .php files, which will lead to a critical vulnerability.
Product
jamarketplace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 19, 2024Avada: Missing AuthorizationCVE-2023-39312 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.
Product
Avada
Affected
up to 7.11.1
What to do
Affects up to 7.11.1. Update Avada to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jun 19, 2024In the Linux kernel, the following vulnerability has been resolved: net: systemport: Add global locking for descriptor lifecycle The descriptor list is a sharCVE-2021-47587 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: net: systemport: Add global locking for descriptor lifecycle The descriptor list is a shared resource across all of the transmit queues, and the locking mechanism used today only protects concurrency across a given transmit queue between the transmit and reclaiming. This creates an opportunity for the SYSTEMPORT hardware to work on corrupted descriptors if we have multiple producers at once which is the case when using multiple transmit queues. This was particularly noticeable when using multiple flows/transmit queues and it showed up in interesting ways in that UDP packets would get a correct UDP header checksum being calculated over an incorrect packet length. Similarly TCP packets would get an equally correct checksum computed by the hardware over an incorrect packet length. The SYSTEMPORT hardware maintains an internal descriptor list that it re-arranges when the driver produces a new descriptor anytime it writes to the WRITE_PORT_{HI,LO} registers, there is however some delay in the hardware to re-organize its descriptors and it is possible that concurrent TX queues eventually break this internal allocatio
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 19, 2024In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and tCVE-2024-38570 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100d1b started exploiting this behavior to speed up filesystem unmount: gfs2 would simply free glocks it didn't want to unlock and then release the lockspace. This didn't take the bast callbacks for asynchronous lock contention notifications into account, which remain active until until a lock is unlocked or its lockspace is released. To prevent those callbacks from accessing deallocated objects, put the glocks that should not be unlocked on the sd_dead_glocks list, release the lockspace, and only then free those glocks. As an additional measure, ignore unexpected ast and bast callbacks if the receiving glock is dead.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 19, 2024In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has CVE-2024-38558 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 10
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACKET_CMD_EXECUTE has 3 main attributes: - OVS_PACKET_ATTR_KEY - Packet metadata in a netlink format. - OVS_PACKET_ATTR_PACKET - Binary packet content. - OVS_PACKET_ATTR_ACTIONS - Actions to execute on the packet. OVS_PACKET_ATTR_KEY is parsed first to populate sw_flow_key structure with the metadata like conntrack state, input port, recirculation id, etc. Then the packet itself gets parsed to populate the rest of the keys from the packet headers. Whenever the packet parsing code starts parsing the ICMPv6 header, it first zeroes out fields in the key corresponding to Neighbor Discovery information even if it is not an ND packet. It is an 'ipv6.nd' field. However, the 'ipv6' is a union that shares the space between 'nd' and 'ct_orig' that holds the original tuple conntrack metadata parsed from the OVS_PACKET_ATTR_KEY. ND packets should not normally have conntrack state, so it's fine to share the space, but normal ICMPv6 Echo packets or maybe other types of ICMPv6 can have the state attached and it should not be overwritten. The issue res
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 19, 2024In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming responseCVE-2024-38544 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67Critical 9.8
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incoming response packet skb is enqueued to the resp_pkts queue and then a decision is made whether to run the completer task inline or schedule it. Finally the skb is dereferenced to bump a 'hw' performance counter. This is wrong because if the completer task is already running in a separate thread it may have already processed the skb and freed it which can cause a seg fault. This has been observed infrequently in testing at high scale. This patch fixes this by changing the order of enqueuing the packet until after the counter is accessed.
Product
Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.kernel.org git.kernel.org
Jun 19, 2024Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client.CVE-2024-37124 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpCritical 9.8
Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited, an attacker may create an arbitrary file in the PC where the product is installed.
Product
Ricoh Streamline NX PC Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp ricoh.com
Jun 19, 2024Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier.CVE-2024-36480 · Other software · CVE-2024-36480 · reported by vultures@jpcert.or.jpCritical 9.8
Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability is exploited, an attacker may obtain LocalSystem Account of the PC where the product is installed. As a result, unintended operations may be performed on the PC.
Product
Ricoh Streamline NX PC Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp ricoh.com
Jun 19, 2024Image Optimizer, Resizer and CDN – Sirv: Arbitrary file uploadsCVE-2024-5853 · WordPress plugins & themes · reported by WordfenceCritical 9.9
The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the sirv_upload_file_by_chanks AJAX action in all versions up to, and including, 7.2.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Image Optimizer, Resizer and CDN – Sirv
Affected
up to 7.2.6
What to do
Affects up to 7.2.6. Update Image Optimizer, Resizer and CDN – Sirv to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024Salon booking system: Arbitrary file uploadsCVE-2024-3229 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Product
Salon booking system
Affected
up to 10.2
What to do
Affects up to 10.2. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 19, 2024WordPress Picture / Portfolio / Media Gallery: Server-Side Request ForgeryCVE-2024-5021 · WordPress plugins & themes · reported by WordfenceCritical 9.3
The WordPress Picture / Portfolio / Media Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.1 via the 'file_get_contents' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Product
WordPress Picture / Portfolio / Media Gallery
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update WordPress Picture / Portfolio / Media Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 18, 2024vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol.CVE-2024-37080 · Other software · vmware · reported by security@vmware.comCritical 9.8
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
Product
cloud_foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com support.broadcom.com
Jun 18, 2024Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityCVE-2024-37079 · Other software · Broadcom · reported by security@vmware.comExploitedCritical 9.8
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution.
Product
VMware vCenter Server
On CISA’s list since
Jan 23, 2026 (federal fix deadline Feb 13, 2026)
What to do
Attackers are using this now. Install Broadcom’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog support.broadcom.com support.broadcom.com
Jun 17, 2024Insecure Permissions vulnerability in JLINK Unionman Technology Co.CVE-2023-37058 · Other software · Unionman · reported by MITRECritical 9.8
Insecure Permissions vulnerability in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to escalate privileges via a crafted command.
Product
Jlink Ax1800 Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2024An issue in JLINK Unionman Technology Co.CVE-2023-37057 · Other software · jlink · reported by MITRECritical 9.8
An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentication mechanism.
Product
ax1800
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record unionman.com.cn github.com
Jun 17, 2024DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java.CVE-2024-37902 · Other software · deepjavalibrary · reported by GitHubCritical 10
DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.
Product
djl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2024Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potCVE-2024-36543 · Other software · strimza_project · reported by MITRECritical 9.8
Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.
Product
kafka_connect_rest_api
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 17, 2024A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.CVE-2024-36575 · Other software · notabotai · reported by MITRECritical 9.8
A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.
Product
getsetprop
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jun 17, 2024almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/indexCVE-2024-36573 · Other software · almela · reported by MITRECritical 9.8
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
Product
obx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jun 17, 2024alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)CVE-2024-36582 · Other software · alykoshin · reported by MITRECritical 9.8
alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)
Product
mini-deep-assign
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jun 17, 2024A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.CVE-2024-36580 · Other software · cdr0 · reported by MITRECritical 9.8
A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.
Product
sg
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Jun 17, 2024Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an aCVE-2024-6057 · Other software · Devolutions · reported by security@devolutions.netCritical 9.8
Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.
Product
Remote Desktop Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record devolutions.net devolutions.net
Jun 17, 2024Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments.CVE-2024-6048 · Other software · Openfind · reported by twcert@cert.org.twCritical 9.8
Openfind's MailGates and MailAudit fail to properly filter user input when analyzing email attachments. An unauthenticated remote attacker can exploit this vulnerability to inject system commands and execute them on the remote server.
Product
MailGates 5.0
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Jun 17, 2024GeoVision Devices OS Command Injection VulnerabilityCVE-2024-6047 · Other software · GeoVision · reported by twcert@cert.org.twExploitedCritical 9.8
Multiple GeoVision devices contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to inject and execute arbitrary system commands. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Product
Multiple Devices
On CISA’s list since
May 7, 2025 (federal fix deadline May 28, 2025)
What to do
Attackers are using this now. Install GeoVision’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD record CISA catalog twcert.org.tw twcert.org.tw
Jun 16, 2024Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.CVE-2024-5163 · Other software · TECNO · reported by 907edf6c-bf03-423e-ab1a-8da27e1aa1eaCritical 9.8
Improper permission settings for mobile applications (com.transsion.carlcare) may lead to user password and account security risks.
Product
com.transsion.carlcare
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record security.tecno.com security.tecno.com
Jun 16, 2024Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different vaCVE-2024-34451 · Other software · ghost · reported by MITRECritical 9.1
Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers.
Product
ghost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.google.com ghost.org
Jun 16, 2024An issue was discovered in iTerm2 3.5.x before 3.5.2.CVE-2024-38396 · Other software · gnachman · reported by MITRECritical 9.8
An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395.
Product
iterm2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com gitlab.com
Jun 16, 2024Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.CVE-2024-38468 · Other software · Guoxinled · reported by MITRECritical 9.8
Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.
Product
Synthesis Image System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 16, 2024Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.CVE-2024-38466 · Other software · Guoxinled · reported by MITRECritical 9.8
Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.
Product
Synthesis Image System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 16, 2024iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.CVE-2024-38462 · Other software · irods · reported by MITRECritical 9.8
iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.
Product
irods
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 16, 2024htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.CVE-2024-38448 · Other software · gnu · reported by MITRECritical 9.1
htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.
Product
global
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cvs.savannah.gnu.org lists.gnu.org
Jun 16, 2024Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/aCVE-2024-38441 · Other software · netatalk · reported by MITRECritical 9.8
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions.
Product
netatalk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 16, 2024Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/CVE-2024-38439 · Other software · netatalk · reported by MITRECritical 9.8
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to '\0' in FPLoginExt in login in etc/uams/uams_pam.c. 2.4.1 and 3.1.19 are also fixed versions.
Product
netatalk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 15, 2024url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supCVE-2024-38428 · Other software · gnu · reported by MITRECritical 9.1
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
Product
wget
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.savannah.gnu.org lists.gnu.org
Jun 15, 2024In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitaCVE-2024-38395 · Other software · iterm2 · reported by MITRECritical 9.8
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
Product
iterm2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com gitlab.com
Jun 15, 2024Video Gallery – YouTube Playlist, Channel Gallery by YotuWP: Local File InclusionCVE-2024-4258 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Video Gallery – YouTube Playlist, Channel Gallery by YotuWP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.13 via the settings parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Product
Video Gallery – YouTube Playlist, Channel Gallery by YotuWP
Affected
up to 1.3.13
What to do
Affects up to 1.3.13. Update Video Gallery – YouTube Playlist, Channel Gallery by YotuWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.