CVE-2024-38216 — Microsoft Azure_stack_hub: Azure Stack Hub Elevation of Privilege Vulnerability
Azure Stack Hub Elevation of Privilege Vulnerability CVSSv3.1 8.2 (HIGH) · EPSS 55th percentile
8.2
CVSS v3.1
91
Edit Score
Latest intel// live feed
25 results//sorted by published//last sync 2026-10-24 12:23Z
CVE-2024-38194 — Microsoft Azure_web_apps: An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to
An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network. CVSSv3.1 8.4 (HIGH) · EPSS 67th percentile
8.4
CVSS v3.1
92
Edit Score
CVE-2024-38045 — Microsoft Windows_10_1809: Windows TCP/IP Remote Code Execution Vulnerability
Windows TCP/IP Remote Code Execution Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 71th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-38014 — Microsoft Windows_10_1507: Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability CVSSv3.1 7.8 (HIGH) · EPSS 93th percentile
7.8
CVSS v3.1
91
Edit Score
CVE-2024-37980 — Microsoft Sql_server_2016: SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 69th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-37965 — Microsoft Sql_server_2016: SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 75th percentile
8.8
CVSS v3.1
95
Edit Score
CVE-2024-37341 — Microsoft Sql_2016_azure_connect_feature_pack: SQL Server Elevation of Privilege Vulnerability
Microsoft SQL Server Elevation of Privilege Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 71th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-37340 — Microsoft Sql_2016_azure_connect_feature_pack: SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-37339 — Microsoft Sql_2016_azure_connect_feature_pack: SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-37338 — Microsoft Sql_2016_azure_connect_feature_pack: SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-37335 — Microsoft Sql_2016_azure_connect_feature_pack: SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-26191 — Microsoft Sql_2016_azure_connect_feature_pack: SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-26186 — Microsoft Sql_2016_azure_connect_feature_pack: SQL Server Native Scoring Remote Code Execution Vulnerability
Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability CVSSv3.1 8.8 (HIGH) · EPSS 74th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2024-21416 — Microsoft Windows_10_1809: Windows TCP/IP Remote Code Execution Vulnerability
Windows TCP/IP Remote Code Execution Vulnerability CVSSv3.1 8.1 (HIGH) · EPSS 70th percentile
8.1
CVSS v3.1
91
Edit Score
CVE-2024-44902 — Thinkphp Thinkphp: A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 90th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2024-7015 — Profelis Passbox: Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication
Missing Authentication for Critical Function vulnerability in Profelis Informatics and Consulting PassBox allows Authentication Abuse. This issue affects PassBox: before v1.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-8428 — Ultimatemember Forumwp: The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to
The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submit_form_handler due to missing validation on the 'user_id' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to change the email address of administrative user accounts which can then be leveraged to reset the administr CVSSv3.1 8.8 (HIGH)
8.8
CVSS v3.1
94
Edit Score
CVE-2024-7493 — Wpcom Wpcom_member: The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions
The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wp_insert_user() during registration. This makes it possible for unauthenticated attackers to update their role to that of an administrator during registration. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2024-45159 — Trustedfirmware Mbed_tls: With TLS 1.3, when a server enables optional authentication of the client, if the
An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtls_ssl_get_verify_result() would incorrectly have the MBEDTLS_X509_BADCERT_KEY_USAGE and MBEDTLS_X509_BADCERT_KEY_USAGE bits clear. As a result, an attacker that had a certificate valid for uses other than TLS c CVSSv3.1 9.8 (CRITICAL) · EPSS 69th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-45158 — Trustedfirmware Mbed_tls: A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter
An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_ecdsa_raw_to_der() can occur when the bits parameter is larger than the largest supported curve. In some configurations with PSA disabled, all values of bits are affected. (This never happens in internal library calls, but can affect applications that call these functions directly.) CVSSv3.1 9.8 (CRITICAL) · EPSS 72th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2024-44998 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use
In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb" after calling vcc->push() because the skb is released. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score
CVE-2024-44994 — Linux Linux_kernel: Instead the return was accidently deleted which results in trying to process the fault
In the Linux kernel, the following vulnerability has been resolved: iommu: Restore lost return in iommu_report_device_fault() When iommu_report_device_fault gets called with a partial fault it is supposed to collect the fault into the group and then return. Instead the return was accidently deleted which results in trying to process the fault and an eventual crash. Deleting the return was a typo, put it back. CVSSv3.1 8.8 (HIGH)
8.8
CVSS v3.1
94
Edit Score
CVE-2024-44988 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array). CVSSv3.1 8.8 (HIGH)
8.8
CVSS v3.1
94
Edit Score
CVE-2024-44986 — Debian Debian_linux: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive. CVSSv3.1 8.1 (HIGH)
8.1
CVSS v3.1
91
Edit Score
CVE-2024-44985 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a possible UAF. CVSSv3.1 9.8 (CRITICAL)
9.8
CVSS v3.1
99
Edit Score