Week 19, 2024
6 May to 12 May 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 827CVEs publishedin the whole week
- 87CriticalCVSS 9.0 and above
- 257HighCVSS 7.0 to 8.9
- 0Added to KEVknown exploited, newly listed
Most severe new CVEsBy CVSS score
- CVE-2024-4701
Path Traversal vulnerability via File Uploads in Genie
Netflix · Genie
Critical9.9 - CVE-2024-4434
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection
thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Critical9.8 - CVE-2024-4548
Delta Electronics DIAEnergie SQL Injection
Delta Electronics · DIAEnergie
Critical9.8 - CVE-2024-32735
CyberPower PowerPanel Enterprise Missing Authentication
CyberPower · CyberPower PowerPanel Enterprise
Critical9.8 - CVE-2024-34257
TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands,…
Product not named
Critical9.8 - CVE-2024-3806
Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
P-THEMES · Porto
Critical9.8 - CVE-2024-27280
A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods…
Product not named
Critical9.8 - CVE-2024-34204
TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName…
Product not named
Critical9.8 - CVE-2024-4547
Delta Electronics DIAEnergie Unauthenticated SQL Injection
Delta Electronics · DIAEnergie
Critical9.8 - CVE-2023-46012
Buffer Overflow vulnerability LINKSYS EA7500 3.0.1.207964 allows a remote attacker to execute arbitrary code via an HTTP request to the IGD UPnP.
Product not named
Critical9.8