CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- tenda w30e, w30e firmware +1 moreTenda W30E frmL7ProtForm frmL7PlotForm stack-based overflow8.8 High
- mightypirates opencomputersOpenComputers Denial of Service using xpcall7.7 High
- silabs gecko software development kitMicrium OS Network uC-HTTP server header parsing invalid pointer dereference vulnerability7.5 High
- tenda w30e, w30e firmware +1 moreTenda W30E WriteFacMac formWriteFacMac os command injection6.3 Medium
- tenda w30e, w30e firmware +1 moreTenda W30E setcfm formSetCfm stack-based overflow8.8 High
- very good plugins fatal error notifyWordPress Fatal Error Notify plugin <= 1.5.2 - Broken Access Control vulnerability4.3 Medium
- skymoon labs movetoWordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary File Deletion vulnerability8.6 High
- tenda f1202, f1202 firmware +1 moreTenda F1202 webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow8.8 High
- tenda f1202, f1202 firmware +1 moreTenda F1202 fromqossetting stack-based overflow8.8 High
- tenda f1202, f1202 firmware +1 moreTenda F1202 VirtualSer fromVirtualSer stack-based overflow8.8 High
- tenda f1202, f1202 firmware +1 moreTenda F1202 Natlimit fromNatlimit stack-based overflow8.8 High
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Broken Access Control on API vulnerability8.2 High
- litespeed technologies cache, litespeedtech litespeed cache +1 moreWordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability8.3 High
- aitthemes citadela, citadela listing +1 moreWordPress Citadela Listing plugin <= 5.18.1 - Unauth. Sensitive Data Exposure vulnerability7.5 High
kernelAlmaLinux,linuxDebian,rvAlmaLinux +223 more +225 moreModerate: kernel security and bug fix update6.5 Medium- tenda w20e, w20e firmware +1 moreTenda W20E SetRemoteWebManage formSetRemoteWebManage stack-based overflow8.8 High
- smi smi-ex-5414w, ex 5414w +1 moreSMI SMI-EX-5414W Web Interface cross-site request forgery4.3 Medium
- mozilla firefoxMemory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory...8.1 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreMemory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug...8.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreThere was no limit to the number of HTTP/2 CONTINUATION frames that would be processed. A server...3.7 Low
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .xrm-ms files. *Note: This issue...9.8 Critical
- mozilla firefoxThe MarkStack assignment operator, part of the JavaScript engine, could access uninitialized...5.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIf an AlignedBuffer were assigned to itself, the subsequent self-move could result in an...4.0 Medium
- mozilla firefoxAn out-of-memory condition during object initialization could result in an empty shape list. If...6.2 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreOn 32-bit versions there were integer-overflows that led to an out-of-bounds-read that...5.9 Medium
- mozilla firefoxIt was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This...7.5 High
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreThe JIT created incorrect code for arguments in certain cases. This led to potential use-after...7.8 High
- mozilla firefoxA use-after-free could occur during WASM execution if garbage collection ran during the creation...8.8 High
- mozilla firefoxIn certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreIn some code patterns the JIT incorrectly optimized switch statements and generated code with out...8.8 High
- mozilla firefoxA use-after-free could result if a JavaScript realm was in the process of being initialized when...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreGetBoundName could return the wrong version of an object when JIT optimizations were applied....7.5 High
- bmaltais kohya ssKohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019)9.1 Critical
- kohya ss ss, bmaltais kohya ss +1 moreKohya_ss is vulnerable to a command injection in `finetune_gui.py` (`GHSL-2024-022`)9.1 Critical
- kohya ss ss, bmaltais kohya ss +1 moreKohya_ss is vulnerable to a command injection in `git_caption_gui.py` (`GHSL-2024-020`)9.1 Critical
- bmaltais kohya ssKohya_ss is vulnerable to a command injection in `group_images_gui.py` (`GHSL-2024-021`)9.1 Critical
- bmaltais kohya ssKohya_ss vulenrable to path injection in `common_gui.py` `add_pre_postfix` function (`GHSL-2024-023`)6.5 Medium
- bmaltais kohya ssKohya_ss vulnerable to path injection in `common_gui.py` `find_and_replace` function (`GHSL-2024-024`)6.5 Medium
- arc53 docsgptLimited file write in routes.py (GHSL-2023-250)5.3 Medium
- open-webui, openwebui open webui +1 moreOpen WebUI vulnerable to server-side request forgery in utils.py6.4 Medium
- ba-booking ba book everythingBA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- cusrev customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search4.3 Medium
- cusrev customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.46.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending4.3 Medium
- wpmarketingrobot woocommerce google feed manager, aukejomm wpmr google feed manager for woocommerce – sell on google merchant center & shopping +1 moreWooCommerce Google Feed Manager <= 2.4.2 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting7.2 High
- checkmkArgument injection to runmqsc6.5 Medium
kubevirtopenSUSESecurity update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t…No score- averta shortcodes and extra features for phlox theme, depicter slider +1 moreShortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' Shortcode6.4 Medium
- tainacan interfaceTainacan Interface <= 2.7.2 - Reflected Cross-Site Scripting6.1 Medium
- mattermost, mattermost mobile +1 moreMattermost Mobile app versions 2.13.0 and earlier use a regular expression with polynomial...3.1 Low
- asr falcon/crane, asrmicro asr1602 firmware, asr1603 firmware +11 more +13 moreUninitialized scalar field5.8 Medium
- Show moreLoading…