Week 46, 2024
11 November to 17 November 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,106CVEs publishedin the whole week
- 124CriticalCVSS 9.0 and above
- 404HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-9463
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
Palo Alto Networks · Expedition
ExploitedCritical9.9 - CVE-2024-9465
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
Palo Alto Networks · Expedition
ExploitedCritical9.2 - CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
metabase · metabase
ExploitedCritical10.0 - CVE-2024-49039
Windows Task Scheduler Elevation of Privilege Vulnerability
Microsoft · Windows Server 2025
ExploitedHigh8.8 - CVE-2024-43451
NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows Server 2025
ExploitedMedium6.5 - CVE-2014-2120
Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject…
Product not named
ExploitedMedium5.4 - CVE-2021-26086
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the…
Atlassian · Jira Server
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2024-51793
WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability
Ateeq Rafeeq · RepairBuddy
Critical10.0 - CVE-2022-1884
Remote Command Execution in gogs/gogs
gogs · gogs/gogs
Critical10.0 - CVE-2024-52380
WordPress Picsmize plugin <= 1.0.0 - Arbitrary File Upload vulnerability
softpulseinfotech · Picsmize
Critical10.0 - CVE-2024-51788
WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability
Joshua Wolfe · The Novel Design Store Directory
Critical10.0 - CVE-2024-52375
WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability
Arttia Creative · Datasets Manager by Arttia Creative
Critical10.0 - CVE-2024-44102
A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured),…
Siemens · PP TeleControl Server Basic 1000 to 5000 V3.1
Critical10.0 - CVE-2024-48966
Life2000 service tools for test and calibration do not support user authentication
Baxter · Life2000 Ventilation System
Critical10.0 - CVE-2024-10575
CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected…
Schneider Electric · EcoStruxure IT Gateway
Critical10.0 - CVE-2024-48967
Life2000 ventilator and Service PC lack sufficient audit logging capabilities
Baxter · Life2000 Ventilation System
Critical10.0 - CVE-2024-51791
WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerability
Made I.T. · Forms
Critical10.0