Week 26, 2024
24 June to 30 June 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 548CVEs publishedin the whole week
- 77CriticalCVSS 9.0 and above
- 184HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-24816
Improper Control of Generation of Code in jai-ext
geosolutions-it · jai-ext
ExploitedCritical10.0 - CVE-2020-13965
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the…
Product not named
ExploitedMedium6.3 - CVE-2022-2586
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted.
The Linux Kernel Organization · linux
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2024-6071
PTC Creo Elements/Direct License Server Missing Authorization
PTC · Creo Elements/Direct License
Critical10.0 - CVE-2024-2973
Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed
Juniper Networks · Session Smart Router
Critical10.0 - CVE-2024-6297
Several WordPress.org Plugins <= Various Versions - Injected Backdoor
warfareplugins · Social Sharing Plugin – Social Warfare
Critical10.0 - CVE-2023-50029
PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary…
Product not named
Critical10.0 - CVE-2024-4196
Avaya IP Office Web Control RCE Vulnerability
Avaya · IP Office
Critical10.0 - CVE-2024-1839
Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker…
Intrado · 911 Emergency Gateway (EGW)
Critical10.0 - CVE-2024-37228
WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability
InstaWP · InstaWP Connect
Critical10.0 - CVE-2024-5261
TLS certificate are not properly verified when utilizing LibreOfficeKit
The Document Foundation · LibreOffice
Critical10.0 - CVE-2024-38369
XWiki programming rights may be inherited by inclusion
xwiki · xwiki-platform
Critical10.0 - CVE-2024-37091
WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability
StylemixThemes · Consulting Elementor Widgets
Critical9.9