CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- linux, linux kernel +1 morethermal: Fix NULL pointer dereferences in of_thermal_ functions5.5 Medium
- linux, linux kernel +1 moreiavf: free q_vectors before queues in iavf_disable_vf7.8 High
- linux, linux kernel +1 moredrm/prime: Fix use after free in mmap with drm_gem_ttm_mmap7.8 High
- linux, linux kernel +1 morenet/mlx5e: CT, Fix multiple allocations and memleak of mod acts5.5 Medium
- linux, linux kernel +1 morescsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine7.8 High
- linux, linux kernel +1 morenet/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove()7.8 High
- linux, linux kernel +1 moreRDMA/core: Set send and receive CQ before forwarding to the driver7.8 High
- linux, linux kernel +1 morespi: fix use-after-free of the add_lock mutex5.5 Medium
- linux, linux kernel +1 morecfg80211: call cfg80211_stop_ap when switch from P2P_GO type7.8 High
- linux, linux kernel +1 morescsi: pm80xx: Fix memory leak during rmmod5.5 Medium
- linux, linux kernel +1 morescsi: core: sysfs: Fix hang when device state is set via sysfs5.3 Medium
- linux, linux kernel +1 morescsi: scsi_debug: Fix out-of-bound read in resp_readcap16()7.1 High
- linux, linux kernel +1 moreperf bpf: Avoid memory leak from perf_env__insert_btf()5.5 Medium
- linux, linux kernel +1 morebtrfs: fix memory ordering between normal and ordered work functions7.8 High
- linux, linux kernel +1 morescsi: ufs: core: Improve SCSI abort handling7.8 High
- linux, linux kernel +1 morearm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and residency5.5 Medium
- linux, linux kernel +1 moretipc: check for null after calling kmemdup5.5 Medium
- linux, linux kernel +1 moretty: tty_buffer: Fix the softlockup issue in flush_to_ldisc4.4 Medium
- linux, linux kernel +1 morei40e: Fix NULL ptr dereference on VSI filter sync8.8 High
- linux, linux kernel +1 morescsi: lpfc: Fix link down processing to address NULL pointer dereference8.8 High
- linux, linux kernel +1 morescsi: core: Fix scsi_mode_sense() buffer length handling5.5 Medium
- linux, linux kernel +1 moreusb: musb: tusb6010: check return value after calling platform_get_resource()5.5 Medium
- hidekazu ishikawa lightning, x-t9, jetmonsters emmet lite +12 more +14 moreMultiple WordPress themes affected by Cross-Site Request Forgery vulnerability4.3 Medium
- google chrome, fedoraproject fedora +1 moreUse after free in Dawn in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to...6.5 Medium
- google chrome, fedoraproject fedora +1 moreHeap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker...6.5 Medium
- google chrome, fedoraproject fedora +1 moreOut of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a...9.6 Critical
- bricksforgeWordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary Email Sending vulnerability5.3 Medium
- shortpixel adaptive imagesWordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerability5.3 Medium
- octolize usps shipping for woocommerce – live ratesWordPress USPS Shipping for WooCommerce plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- octolize woocommerce ups shipping – live rates and access pointsWordPress WooCommerce UPS Shipping plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- makeplane planePlane Server-Side Request Forgery (SSRF) Vulnerability9.1 Critical
- traccarTraccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution from account through UIExtension parameters10.0 Critical
- xwiki commons, xwiki, xwiki xwiki-commons +2 moreXWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution10.0 Critical
- digitalbazaar zcapzcap has incomplete expiration checks in capability chains.4.3 Medium
- fastify fastify-secure-session@fastify/secure-session: Reuse of destroyed secure session cookie7.4 High
github.com/kopia/kopiaGoKopia: Storage connection credentials written to console on "repository status" CLI command with JSON output2.0 Low- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF remote code execution through the realtime HTML Converter API9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution from account via custom skins support10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF remote code execution through scheduler job's document reference9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform CSRF in the job scheduler5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution through space title and Solr space facet10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution from edit in multilingual wikis via translations10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution as guest via DatabaseSearch10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Privilege escalation (PR) from user registration through PDFClass10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform: Remote code execution from account via SearchSuggestSourceSheet10.0 Critical
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreStored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm0.0 None
- aimhubio aim, aimhubio/aim +1 moreCSRF Vulnerability in aimhubio/aim8.8 High
- aimhubio aim, aimhubio/aim +1 moreRemote Code Execution in aimhubio/aim9.8 Critical
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 morePrivilege Escalation via Improper Input Validation in mintplex-labs/anything-llm6.7 Medium
- Show moreLoading…