Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-25 05:42Z
2024-04-17
2024-04-17 10:15Z
HIGH

CVE-2024-26822 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-26822

In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the values from the parent mount. CVSSv3.1 8.7 (HIGH) · EPSS 13th percentile

TYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2024-04-16
2024-04-16 10:15Z
MED

CVE-2024-3867 — The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3867

The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in version 2.7.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVSSv3.1 6.1 (MEDIUM) · EPSS 95th percentile

CWECWE 79TYPVulnerability
6.1
CVSS v3.1
86
Edit Score
2024-04-15
2024-04-15 18:15Z
CRIT

CVE-2024-28056 — Amazon Aws_amplify_cli: When the Authentication component is removed from an Amplify project, a Condition property is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-28056

Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between Augu CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile

CWECWE 276VNDAmazonTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-04-15
2024-04-15 10:15Z
HIGH

CVE-2024-31424 — Site: Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-31424

Cross-Site Request Forgery (CSRF) vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93. CVSSv3.1 8.8 (HIGH)

CWECWE 352TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-12
2024-04-12 10:15Z
HIGH

CVE-2024-3211 — Shopping: The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to SQL Injection

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3211

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to SQL Injection via the 'productid' attribute of the ec_addtocart shortcode in all versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile

CWECWE 89VNDShoppingTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-12
2024-04-12 10:15Z
HIGH

CVE-2024-3054 — Wpvivid Migration\,_backup\,_staging: Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3054

WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. This is due to the plugin not providing sufficient path validation on the tree_node[node][id] parameter. This makes it possible for authenticated attackers, with admin-level access and above, to call files using a PHAR wrapper that will deserialize the da CVSSv3.1 7.2 (HIGH) · EPSS 96th percentile

CWECWE 502VNDWpvividTYPVulnerability
7.2
CVSS v3.1
92
Edit Score
2024-04-10
2024-04-10 19:15Z
HIGH

CVE-2023-52070 — Jfree Jfreechart: v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-52070

JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method. NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. CVSSv3.1 8.4 (HIGH) · EPSS 17th percentile

CWECWE 125VNDJfreeVNDJfreechartTYPVulnerability
8.4
CVSS v3.1
92
Edit Score
728 × 90 / responsive · programmatic ad slot
2024-04-10
2024-04-10 19:15Z
CRIT

CVE-2021-47215 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix crash

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47215

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix crash in RX resync flow For the TLS RX resync flow, we maintain a list of TLS contexts that require some attention, to communicate their resync information to the HW. Here we fix list corruptions, by protecting the entries against movements coming from resync_handle_seq_match(), until their resync handling in napi is fully completed. CVSSv3.1 9.8 (CRITICAL) · EPSS 10th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-04-10
2024-04-10 19:15Z
HIGH

CVE-2021-47203 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add()

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47203

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "fail_msg" string is set and a log message output. The job is then added to a completions list for cancellation. Processing of any further jobs from the txq list continues, but since "fail_msg" remains set, jobs CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 787TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-10
2024-04-10 19:15Z
HIGH

CVE-2021-47184 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47184

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops. CVSSv3.1 8.8 (HIGH) · EPSS 15th percentile

CWECWE 476TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-10
2024-04-10 19:15Z
HIGH

CVE-2021-47183 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix link

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2021-47183

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix link down processing to address NULL pointer dereference If an FC link down transition while PLOGIs are outstanding to fabric well known addresses, outstanding ABTS requests may result in a NULL pointer dereference. Driver unload requests may hang with repeated "2878" log messages. The Link down processing results in ABTS requests for outstanding ELS requests. The Abort WQEs are sent for th CVSSv3.1 8.8 (HIGH) · EPSS 14th percentile

CWECWE 476TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-10
2024-04-10 16:15Z
CRIT

CVE-2024-3566 — Haskell Process_library: A command inject vulnerability allows an attacker to perform command injection on Windows applications

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3566

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile

CWECWE 77VNDHaskellVNDRust LangTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-04-10
2024-04-10 13:51Z
CRIT

CVE-2024-23080 — Joda: Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale).

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-23080

Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). NOTE: this is disputed by multiple third parties who believe there was not reasonable evidence to determine the existence of a vulnerability. The submission may have been based on a tool that is not sufficiently robust for vulnerability identification. CVSSv3.1 9.1 (CRITICAL) · EPSS 58th percentile

CWECWE 476VNDJodaTYPVulnerability
9.1
CVSS v3.1
96
Edit Score
2024-04-09
2024-04-09 19:15Z
CRIT

CVE-2024-3136 — Stylemixthemes Masterstudy_lms: The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3136

The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and in CVSSv3.1 9.8 (CRITICAL) · EPSS 98th percentile

CWECWE 98VNDStylemixthemesVNDMasterstudyTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2024-04-09
2024-04-09 19:15Z
MED

CVE-2024-3097 — Imagely Nextgen_gallery: The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-3097

The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. This makes it possible for unauthenticated attackers to extract sensitive data including EXIF and other metadata of any image uploaded through the plugin. CVSSv3.1 5.3 (MEDIUM) · EPSS 96th percentile

CWECWE 862VNDWordpressVNDImagelyTYPVulnerability
5.3
CVSS v3.1
83
Edit Score
2024-04-09
2024-04-09 19:15Z
CRIT

CVE-2024-2804 — Network: The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category'

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2804

The Network Summary plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter in all versions up to, and including, 2.0.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 66th percentile

CWECWE 89VNDNetworkTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-2693 — Link: The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2693

The Link Whisper Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 0.7.1 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could a CVSSv3.1 8.8 (HIGH) · EPSS 75th percentile

CWECWE 502VNDLinkTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-2342 — Nsquared Simply_schedule_appointments: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2342

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the customer_id parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries CVSSv3.1 8.8 (HIGH) · EPSS 65th percentile

CWECWE 89VNDNsquaredVNDAppointmentTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-2341 — Nsquared Simply_schedule_appointments: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2341

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the keys parameter in all versions up to, and including, 1.6.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber access and above, to append additional SQL queries into already existing queries that ca CVSSv3.1 8.8 (HIGH) · EPSS 68th percentile

CWECWE 89VNDNsquaredVNDAppointmentTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
MED

CVE-2024-2340 — Theme-fusion Avada: The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2340

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with a file upload mechanism. CVSSv3.1 5.3 (MEDIUM) · EPSS 98th percentile

CWECWE 548VNDTheme FusionVNDAvadaTYPVulnerability
5.3
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-2125 — Donweb Envialosimple: The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2125

The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect nonce validation on the gallery_add function. This makes it possible for unauthenticated attackers to upload malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The Cross-Site Request Forgery was patched CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile

CWECWE 434CWECWE 352VNDDonwebTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-2018 — Melapress Wp_activity_log: The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-2018

The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry->roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the da CVSSv3.1 8.8 (HIGH) · EPSS 68th percentile

CWECWE 89VNDMelapressVNDActivityTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-1991 — Metagauss Registrationmagic: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1991

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an administrator CVSSv3.1 8.8 (HIGH) · EPSS 53th percentile

CWECWE 862VNDMetagaussVNDRegistrationmagicTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-1990 — Metagauss Registrationmagic: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1990

The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append addition CVSSv3.1 8.8 (HIGH) · EPSS 73th percentile

CWECWE 89VNDMetagaussVNDRegistrationmagicTYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2024-04-09
2024-04-09 19:15Z
HIGH

CVE-2024-1974 — Hasthemes Ht_mega: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2024-1974

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4.6 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to read the contents of arbitrary files on the server, which can contain sensitive information. CVSSv3.1 8.8 (HIGH) · EPSS 86th percentile

CWECWE 22VNDHasthemesVNDMegaTYPVulnerability
8.8
CVSS v3.1
95
Edit Score