Week 18, 2024
29 April to 5 May 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,619CVEs publishedin the whole week
- 103CriticalCVSS 9.0 and above
- 815HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-7028
Weak Password Recovery Mechanism for Forgotten Password in GitLab
GitLab · GitLab
ExploitedCritical10.0 - CVE-2024-29988
SmartScreen Prompt Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2024-33566
WordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerability
N-Media · OrderConvo
Critical10.0 - CVE-2024-32962
XML signature verification bypass due improper verification of signature / signature spoofing
node-saml · xml-crypto
Critical10.0 - CVE-2024-4306
Unrestricted Upload of File with Dangerous Type vulnerability in HubBank
Ofofonobs · HubBank
Critical9.9 - CVE-2023-40504
LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability
LG · Simple Editor
Critical9.8 - CVE-2023-40498
LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability
LG · Simple Editor
Critical9.8 - CVE-2023-38096
NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability
NETGEAR · ProSAFE Network Management System
Critical9.8 - CVE-2023-49606
A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can…
Tinyproxy · Tinyproxy
Critical9.8 - CVE-2024-2876
Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection
icegram · Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress
Critical9.8 - CVE-2023-32165
D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability
D-Link · D-View
Critical9.8 - CVE-2023-40497
LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability
LG · Simple Editor
Critical9.8