Week 35, 2024
26 August to 1 September 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 504CVEs publishedin the whole week
- 63CriticalCVSS 9.0 and above
- 134HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-7965
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8 - CVE-2024-38856
Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Apache Software Foundation · Apache OFBiz
ExploitedHigh8.1 - CVE-2024-7971
Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security…
Google · Chrome
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2024-43918
WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability
WBW · WBW Product Table PRO
Critical10.0 - CVE-2024-43955
WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability
Themeum · Droip
Critical10.0 - CVE-2024-5991
Buffer overread in domain name matching
wolfSSL · wolfSSL
Critical10.0 - CVE-2024-44761
An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests.
Product not named
Critical9.9 - CVE-2024-3980
The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If…
Hitachi Energy · MicroSCADA X SYS600
Critical9.9 - CVE-2024-4872
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code…
Hitachi Energy · MicroSCADA X SYS600
Critical9.9 - CVE-2024-6670
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
Progress Software Corporation · WhatsUp Gold
ExploitedCritical9.8 - CVE-2024-45488
One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual…
Product not named
Critical9.8 - CVE-2024-8181
Flowise Authentication Bypass
FlowiseAI · Flowise
Critical9.8 - CVE-2024-6671
WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability
Progress Software Corporation · WhatsUp Gold
Critical9.8