Week 32, 2024
5 August to 11 August 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 594CVEs publishedin the whole week
- 79CriticalCVSS 9.0 and above
- 226HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-32113
Apache OFBiz: Path traversal leading to RCE
Apache Software Foundation · Apache OFBiz
ExploitedCritical9.1 - CVE-2024-36971
net: fix __dst_negative_advice() race
Linux · Linux
ExploitedHigh7.8 - CVE-2018-0824
A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows…
Product not named
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2024-6886
Inproper Sanitation of field leading to stored XSS
Gitea · Gitea Open Source Git Server
Critical10.0 - CVE-2024-3659
Command injection in KAON AR2140 routers
KAON Group · AR2140
Critical10.0 - CVE-2024-39791
Vonets WiFi Bridges Stack-based Buffer Overflow
Vonets · VAR1200-H
Critical10.0 - CVE-2024-42467
CometVisu Backend for openHAB affected by SSRF/XSS
openhab · openhab-webui
Critical10.0 - CVE-2024-22116
Remote code execution within ping script
Zabbix · Zabbix
Critical9.9 - CVE-2024-6782
Calibre Remote Code Execution
Calibre · Calibre
Critical9.8 - CVE-2024-39225
GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16,…
Product not named
Critical9.8 - CVE-2024-20450
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones…
Cisco · Cisco Small Business IP Phones
Critical9.8 - CVE-2024-20454
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones…
Cisco · Cisco Small Business IP Phones
Critical9.8 - CVE-2024-41570
An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating…
Product not named
Critical9.8