Week 24, 2024
10 June to 16 June 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,016CVEs publishedin the whole week
- 93CriticalCVSS 9.0 and above
- 295HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-4358
Registration Authentication Bypass Vulnerability
Progress Software Corporation · Telerik Report Server
ExploitedCritical9.8 - CVE-2024-32896
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…
Google · Android
ExploitedHigh8.1 - CVE-2024-26169
Windows Error Reporting Service Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2024-4577
Argument Injection in PHP-CGI
PHP Group · PHP
ExploitedCritical9.8 - CVE-2024-4610
Mali GPU Kernel Driver allows improper GPU memory processing operations
Arm Ltd · Bifrost GPU Kernel Driver
ExploitedHigh7.4
Most severe new CVEsBy CVSS score
- CVE-2024-3922
Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
wedevs · Dokan Pro
Critical10.0 - CVE-2024-36412
SuiteCRM unauthenticated SQL Injection
salesagility · SuiteCRM
Critical10.0 - CVE-2024-30299
Tenable Vulnerability Disclosure | API Auth Bypass
Adobe · Adobe Framemaker Publishing Server
Critical10.0 - CVE-2024-2013
An authentication bypass vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway component that if exploited allows attackers without any access to…
Hitachi Energy · FOXMAN-UN
Critical10.0 - CVE-2024-35746
WordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerability
Asghar Hatampoor · BuddyPress Cover
Critical10.0 - CVE-2024-3105
Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution
themeisle · Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts
Critical9.9 - CVE-2024-34762
Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability
WPENGINE INC · Advanced Custom Fields PRO
Critical9.9 - CVE-2024-3549
Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 - Authenticated (Subscriber+) SQL Injection
pr-gateway · Blog2Social: Social Media Auto Post & Scheduler
Critical9.9 - CVE-2024-34102
XXE can expose crypt key and other secrets granting full admin access
Adobe · Adobe Commerce
ExploitedCritical9.8 - CVE-2024-3552
Web Directory Free < 1.7.0 - Unauthenticated SQL Injection
Unknown · Web Directory Free
Critical9.8