Week 27, 2024
1 July to 7 July 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 444CVEs publishedin the whole week
- 53CriticalCVSS 9.0 and above
- 143HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-20399
Cisco NX-OS Software CLI Command Injection Vulnerability
Cisco · Cisco NX-OS Software
ExploitedMedium6.0
Most severe new CVEsBy CVSS score
- CVE-2024-38366
CoacoaPods trunk RCE in email verification system rfc-822
CocoaPods · CocoaPods
Critical10.0 - CVE-2024-39008
robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep. This vulnerability allows attackers to execute…
Product not named
Critical10.0 - CVE-2024-38999
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to…
Product not named
Critical10.0 - CVE-2024-39251
An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information,…
Product not named
Critical10.0 - CVE-2023-41917
Improper input validation in Kiloview P1/P2 devices allows for remote code execution
Kiloview · P1/P2
Critical10.0 - CVE-2024-38513
Fiber Session Middleware Token Injection Vulnerability
gofiber · fiber
Critical10.0 - CVE-2023-41918
Missing Authentication for Critical Function in Kiloview P1/P2 devices
Kiloview · P1/P2
Critical10.0 - CVE-2024-39931
Gogs through 0.13.0 allows deletion of internal files.
Product not named
Critical9.9 - CVE-2024-39943
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload…
Product not named
Critical9.9 - CVE-2024-39932
Gogs through 0.13.0 allows argument injection during the previewing of changes.
Product not named
Critical9.9