Week 14, 2024
1 April to 7 April 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 840CVEs publishedin the whole week
- 60CriticalCVSS 9.0 and above
- 301HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-29748
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…
Google · Android
ExploitedHigh7.8 - CVE-2024-29745
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges…
Google · Android
ExploitedMedium5.5
Most severe new CVEsBy CVSS score
- CVE-2024-2389
Flowmon Unauthenticated Command Injection Vulnerability
Progress Software · Flowmon
Critical10.0 - CVE-2024-25096
WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability
Canto Inc. · Canto
Critical10.0 - CVE-2024-22004
Unchecked length in Trusted Application on Google Nest Wifi Pro, leading to out of bounds read
Google · Nest Wifi Pro
Critical10.0 - CVE-2023-48426
Chromecast Bootloader & Kernel-level code-execution including compromise of user-data
Google · Chromecast
Critical10.0 - CVE-2024-27972
WordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerability
Jack Arturo · WP Fusion Lite
Critical9.9 - CVE-2024-25693
Portal for ArcGIS has a directory traversal vulnerability.
Esri · Portal for ArcGIS
Critical9.9 - CVE-2024-31390
WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability
Soflyy · Breakdance
Critical9.9 - CVE-2024-31286
WordPress WP Photo Album Plus plugin < 8.6.03.005 - Arbitrary File Upload vulnerability
J.N. Breetvelt a.k.a. OpaJaap · WP Photo Album Plus
Critical9.9 - CVE-2024-31380
WordPress Oxygen plugin <= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability
Soflyy · Oxygen Builder
Critical9.9 - CVE-2024-24707
WordPress Cwicly plugin <= 1.4.0.2 - Auth. Remote Code Execution (RCE) vulnerability
Cwicly Builder, SL. · Cwicly
Critical9.9