Week 20, 2024
13 May to 19 May 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,227CVEs publishedin the whole week
- 118CriticalCVSS 9.0 and above
- 461HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-4761
Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.3 - CVE-2014-100005
Multiple cross-site request forgery (CSRF) vulnerabilities in D-Link DIR-600 router (rev. Bx) with firmware before 2.17b02 allow remote attackers to hijack the…
Product not named
ExploitedHigh8.0 - CVE-2021-40655
An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request…
Product not named
ExploitedHigh7.5 - CVE-2024-30040
Windows MSHTML Platform Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh8.8 - CVE-2024-30051
Windows DWM Core Library Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2024-4671
Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a…
Google · Chrome
ExploitedCritical9.6
Most severe new CVEsBy CVSS score
- CVE-2024-29895
Cacti command injection in cmd_realtime.php
Cacti · cacti
Critical10.0 - CVE-2024-22476
Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation…
Intel(R) Neural Compressor software
Critical10.0 - CVE-2024-32700
WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability
Kognetiks · Kognetiks Chatbot for WordPress
Critical10.0 - CVE-2024-31351
WordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability
Copymatic · Copymatic – AI Content Writer & Generator
Critical10.0 - CVE-2024-30207
A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10)…
Siemens · SIMATIC RTLS Locating Manager
Critical10.0 - CVE-2024-32888
Amazon JDBC Driver for Redshift SQL Injection via line comment generation
aws · amazon-redshift-jdbc-driver
Critical10.0 - CVE-2024-32741
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is used for the privileged…
Siemens · SIMATIC CN 4100
Critical10.0 - CVE-2024-32809
WordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerability
JumpDEMAND Inc. · ActiveDEMAND
Critical10.0 - CVE-2024-31377
WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability
J.N. Breetvelt a.k.a. OpaJaap · WP Photo Album Plus
Critical10.0 - CVE-2024-29212
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its…
Veeam · Service Provider Console
Critical9.9