Week 8, 2024
19 February to 25 February 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 606CVEs publishedin the whole week
- 73CriticalCVSS 9.0 and above
- 207HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-1709
Authentication bypass using an alternate path or channel
ConnectWise · ScreenConnect
ExploitedCritical10.0
Most severe new CVEsBy CVSS score
- CVE-2024-1709
Authentication bypass using an alternate path or channel
ConnectWise · ScreenConnect
ExploitedCritical10.0 - CVE-2024-1212
LoadMaster Pre-Authenticated OS Command Injection
Progress Software · LoadMaster
ExploitedCritical10.0 - CVE-2024-1651
Torrentpier 2.4.1 - RCE
Torrentpier · Torrentpier
Critical10.0 - CVE-2024-1597
pgjdbc SQL Injection via line comment generation
pgjdbc · pgjdbc
Critical10.0 - CVE-2023-45318
A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004. A specially crafted network…
Silicon Labs · Gecko Platform
Critical10.0 - CVE-2024-1644
Suite CRM v7.14.2 - RCE via Local File Inclusion
Suite CRM · Suite CRM
Critical9.9 - CVE-2024-0455
SSRF on AWS deployed instances of AnythingLLM via /metadata
mintplex-labs · mintplex-labs/anything-llm
Critical9.9 - CVE-2023-52440
ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()
Linux · Linux
Critical9.8 - CVE-2024-25850
Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter
Product not named
Critical9.8 - CVE-2024-1676
Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page.…
Google · Chrome
Critical9.8