Week 33, 2024
12 August to 18 August 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 927CVEs publishedin the whole week
- 73CriticalCVSS 9.0 and above
- 343HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-28986
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
SolarWinds · Web Help Desk
ExploitedCritical9.8 - CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
Microsoft · Microsoft Office 2019
ExploitedHigh8.8 - CVE-2024-38107
Windows Power Dependency Coordinator Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2024-38193
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Microsoft · Windows 11 Version 24H2
ExploitedHigh7.8 - CVE-2024-38178
Scripting Engine Memory Corruption Vulnerability
Microsoft · Windows 11 Version 24H2
ExploitedHigh7.5 - CVE-2024-38106
Windows Kernel Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.0 - CVE-2024-38213
Windows Mark of the Web Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedMedium6.5
Most severe new CVEsBy CVSS score
- CVE-2024-43160
WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability
BerqWP · BerqWP
Critical10.0 - CVE-2024-42479
llama.cpp allows write-what-where in rpc_server::set_tensor
ggerganov · llama.cpp
Critical10.0 - CVE-2024-6917
RCE in Veribilim Software's Veribase Order Management
Veribilim Software · Veribase Order Management
Critical10.0 - CVE-2024-42472
Flatpak may allow access to files outside sandbox for certain apps
flatpak · flatpak
Critical10.0 - CVE-2024-42489
Pro Macros Remote Code Execution via Viewpdf and similar macros
xwikisas · xwiki-pro-macros
Critical10.0 - CVE-2024-6500
InPost for WooCommerce <= 1.4.0 and InPost PL <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary File Read and Delete
inspirelabs · InPost for WooCommerce
Critical10.0 - CVE-2024-42462
Bypass multifactor authentication
upKeeper Solutions · upKeeper Manager
Critical10.0 - CVE-2024-6684
Authentication Bypass in GST Electronics' inohom Nova Panel N7
GST Electronics · inohom Nova Panel N7
Critical9.9 - CVE-2024-7593
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass…
Ivanti · vTM
ExploitedCritical9.8 - CVE-2024-28986
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
SolarWinds · Web Help Desk
ExploitedCritical9.8