Week 21, 2024
20 May to 26 May 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,041CVEs publishedin the whole week
- 66CriticalCVSS 9.0 and above
- 370HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2020-17519
Apache Flink directory traversal attack: reading remote files through the REST API
Apache Software Foundation · Apache Flink
ExploitedCritical9.1 - CVE-2023-43208
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the…
Product not named
ExploitedCritical9.8 - CVE-2024-4947
Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.…
Google · Chrome
ExploitedCritical9.6
Most severe new CVEsBy CVSS score
- CVE-2024-4985
An authentication bypass vulnerability was present in the GitHub Enterprise Server (GHES) when utilizing SAML single sign-on authentication with the optional…
GitHub · Enterprise Server
Critical10.0 - CVE-2023-3939
Multiple command injection in ZkTeco-based OEM devices
ZkTeco · ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
Critical10.0 - CVE-2023-3943
Multiple buffer overflow in ZkTeco-based OEM devices
ZkTeco · ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
Critical10.0 - CVE-2023-3941
Multiple arbitrary file writes in ZkTeco-based OEM devices
ZkTeco · ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
Critical10.0 - CVE-2024-33226
An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and execute arbitrary…
Product not named
Critical9.9 - CVE-2024-5084
Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution
hashthemes · Hash Form – Drag & Drop Form Builder
Critical9.8 - CVE-2024-29849
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
Veeam · Backup & Replication
Critical9.8 - CVE-2023-52755
ksmbd: fix slab out of bounds write in smb_inherit_dacl()
Linux · Linux
Critical9.8 - CVE-2024-4323
Fluent Bit Memory Corruption Vulnerability
Fluent Bit · Fluent Bit
Critical9.8 - CVE-2024-3495
Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection
trustyplugins · Country State City Dropdown CF7
Critical9.8