Week 11, 2024

Most severe new CVEsBy CVSS score

• CVE-2024-28354

  There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post…

  Product not named

  Critical10.0
• CVE-2024-25139

  In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After…

  Product not named

  Critical10.0
• CVE-2024-22039

  A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3),…

  Siemens · Cerberus PRO EN Engineering Tool

  Critical10.0
• CVE-2024-27957

  WordPress Pie Register plugin <= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability

  Pie Register · Pie Register

  Critical10.0
• CVE-2024-27102

  Improper isolation of server file access in github.com/pterodactyl/wings

  pterodactyl · wings

  Critical10.0
• CVE-2023-6825

  File Manager And File Manager Pro (Multiple Versions) - Directory Traversal

  mndpsingh287 · File Manager

  Critical9.9
• CVE-2024-1071

  The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL…

  ultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

  Critical9.8
• CVE-2024-28255

  Authentication Bypass in OpenMetadata

  open-metadata · OpenMetadata

  Critical9.8
• CVE-2024-25153

  Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114

  Fortra · FileCatalyst

  Critical9.8
• CVE-2024-21334

  Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

  Microsoft · System Center Operations Manager (SCOM) 2019

  Critical9.8