Week 48, 2024
25 November to 1 December 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 507CVEs publishedin the whole week
- 63CriticalCVSS 9.0 and above
- 167HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-28461
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using…
Product not named
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2024-52490
WordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerability
pathomation · Pathomation
Critical10.0 - CVE-2024-42327
SQL injection in user.get API
Zabbix · Zabbix
Critical9.9 - CVE-2024-8672
Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution
marketingfire · Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets
Critical9.9 - CVE-2024-11082
Tumult Hype Animations <= 1.9.15 - Authenticated (Author+) Arbitrary File Upload via hypeanimations_panel Function
tumultinc · Tumult Hype Animations
Critical9.9 - CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
ProjectSend · ProjectSend
ExploitedCritical9.8 - CVE-2024-53676
A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.
Hewlett Packard Enterprise (HPE) · HPE Insight Remote Support
Critical9.8 - CVE-2024-10542
Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation
cleantalk · Spam protection, Honeypot, Anti-Spam by CleanTalk
Critical9.8 - CVE-2024-36622
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper…
Product not named
Critical9.8 - CVE-2024-11482
A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection,…
Trellix · Trellix Enterprise Security Manager (ESM)
Critical9.8 - CVE-2024-52338
Apache Arrow R package: Arbitrary code execution when loading a malicious data file
Apache Software Foundation · Apache Arrow R package
Critical9.8