Week 28, 2024
8 July to 14 July 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 997CVEs publishedin the whole week
- 66CriticalCVSS 9.0 and above
- 488HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-23692
Rejetto HTTP File Server 2.3m Unauthenticated RCE
Rejetto · HTTP File Server
ExploitedCritical9.8 - CVE-2024-38080
Windows Hyper-V Elevation of Privilege Vulnerability
Microsoft · Windows Server 2022
ExploitedHigh7.8 - CVE-2024-38112
Windows MSHTML Platform Spoofing Vulnerability
Microsoft · Windows 10 Version 22H2
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2024-37112
WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerability
Membership Software · WishList Member X
Critical10.0 - CVE-2024-37424
WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability
Automattic · Newspack Blocks
Critical9.9 - CVE-2024-37418
WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability
andy_moyle · Church Admin
Critical9.9 - CVE-2024-3604
OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection
photoweblog · OSM – OpenStreetMap
Critical9.9 - CVE-2024-37420
WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability
WPZita · Zita Elementor Site Library
Critical9.9 - CVE-2023-3287
A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0
easyappointments
Critical9.9 - CVE-2023-38049
A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0
easyappointments
Critical9.9 - CVE-2023-38054
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0
easyappointments
Critical9.9 - CVE-2023-38053
A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0
easyappointments
Critical9.9 - CVE-2023-38052
A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0
easyappointments
Critical9.9