Week 6, 2024
5 February to 11 February 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 606CVEs publishedin the whole week
- 98CriticalCVSS 9.0 and above
- 190HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-21762
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through…
Fortinet · FortiOS
ExploitedCritical9.6 - CVE-2023-4762
Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security…
Google · Chrome
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2024-24830
OpenObserve Privilege Escalation Vulnerability in Users API
openobserve · openobserve
Critical10.0 - CVE-2024-24594
A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a…
Allegro.AI · ClearML
Critical9.9 - CVE-2023-46359
An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute…
Product not named
Critical9.8 - CVE-2023-6989
Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion
paultgoodchild · Shield: Blocks Bots, Protects Users, and Prevents Security Breaches
Critical9.8 - CVE-2024-23917
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
JetBrains · TeamCity
Critical9.8 - CVE-2024-22836
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute…
Product not named
Critical9.8 - CVE-2024-24496
An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php…
Product not named
Critical9.8 - CVE-2021-4436
3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload
Unknown · 3DPrint Lite
Critical9.8 - CVE-2024-22853
D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a…
Product not named
Critical9.8 - CVE-2024-24112
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
Product not named
Critical9.8