CVEs published in April 2024
3,718 vulnerabilities, 293 critical, 10 exploited.
- mattermost, mattermost server +1 moreExcessive resource consumption due to lack to request path size limits3.1 Low
- cbutlerjr wp-members membership pluginWP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files5.3 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget6.4 Medium
- adenion blog2social, pr-gateway blog2social: social media auto post & scheduler +1 moreBlog2Social: Social Media Auto Post & Scheduler <= 7.4.2 - Information Exposure5.3 Medium
- hanwha vision co., ltd. xrn-420sRemote Code Execution without authentication using stack overflow8.9 High
- ekojr advanced post listWordPress Advanced Post List plugin <= 0.5.6.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- accessally popupallyWordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- twinpictures annual archiveWordPress Annual Archive plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- hanwha vision co., ltd. hrx-1620, hanwhavision arn-3250, hrx-1621 +15 more +17 moreusing a inappropriate encryption logic7.4 High
- brijesh kothari smart maintenance modeWordPress Smart Maintenance Mode plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- cryout creations serious sliderWordPress Serious Slider plugin <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- matthew fries mf gig calendar, mf gig calendar project gig calendar +1 moreWordPress MF Gig Calendar plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- hanwha vision co., ltd. hrx-1620, hanwhavision ane-l6012r +1 moreRemote Code Execution without authentication using memory overflow8.9 High
- m-files serverDenial of service condition in M-Files Server7.5 High
- getshortcodes shortcodes ultimate, gn themes wp shortcodes plugin — shortcodes ultimate +1 moreShortcodes Ultimate < 7.1.0 - Contributor+ Stored XSS6.3 Medium
- mmilan81 mm-email2imageMM-email2image <= 0.2.5 - Contributor+ Stored XSS8.1 High
- unknown enl newsletter, enl newsletter plugin project enl-newsletter +1 moreENL Newsletter <= 1.0.1 - Admin+ SQL Injection4.5 Medium
- unknown enl newsletter, enl newsletter plugin project enl-newsletter +1 moreENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF5.7 Medium
- unknown enl newsletter, enl newsletter plugin project enl-newsletter +1 moreENL Newsletter <= 1.0.1 - Stored XSS via CSRF5.4 Medium
- unknown bannerlidBannerlid <= 1.1.0 - Reflected XSS5.5 Medium
- callnowbutton call now buttonCall Now Button < 1.4.7 - Admin+ Stored XSS4.3 Medium
- ninjateam wp chat appWP Chat App < 3.6.4 - Admin+ Stored XSS5.4 Medium
- dimitri grassi salon booking system, salon booking system booking system +1 moreSalon booking system <= 9.6.5 - Editor+ Stored XSS via Email Settings6.3 Medium
- dimitri grassi salon booking systemSalon booking system <= 9.6.5 - Editor+ Stored XSS4.8 Medium
- dimitri grassi salon booking systemSalon booking system <= 9.6.5 - Settings Update via CSRF4.3 Medium
- jgwhite33 wp google review sliderWP Google Review Slider < 13.6 - Admin+ Stored XSS5.9 Medium
- heateor sassy social share, social rocket sharing plugin, unknown social sharing plugin +2 moreSassy Social Share < 3.3.61 - Contributor+ Stored XSS4.7 Medium
- radykal fancy product designerFancy Product Designer < 6.1.8 - Reflected Cross Site Scripting6.3 Medium
- red hat openshift container platform 3.11, openshift container platform 4.12, openshift container platform 4.13 +2 more +4 moreCri-o: arbitrary command injection via pod annotation7.2 High
- skylab igx iiot gateway, iiot gateway (igx) +1 morePrivilege Escalation on Skylab IIoT Gateway (IGX)8.0 High
- google chromeHeap buffer overflow in PDF in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to...7.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Dawn in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to...6.5 Medium
- google chrome, fedoraproject fedora +1 moreOut of bounds read in V8 API in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to...6.5 Medium
- google chrome, fedoraproject fedora +1 moreType confusion in ANGLE in Google Chrome prior to 124.0.6367.78 allowed a remote attacker to...8.8 High
- veritas backup execAn issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access...7.8 High
- veritas netbackupAn issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in...7.7 High
- veritas backup execAn issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec...7.7 High
- passbolt apiPassbolt API allows HTML injection4.3 Medium
- passbolt api, browser extension +1 morePassbolt Browser Extension leaks password information6.1 Medium
- zammadAn issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially...9.1 Critical
- zammadAn issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote...6.5 Medium
- zammad, zimmad +1 moreAn issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have...8.6 High
angular-translateTuxCareangular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate...6.1 Medium- d-link dir-822, dlink dir-822\+ firmware +1 moreD-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of...9.8 Critical
- dlink dir-822\+ firmware, dir-822 firmware +1 moreD-Link DIR-822+ V1.0.5 was found to contain a command injection in ChgSambaUserSettings function...8.8 High
- d-link dir-822, dlink dir-822\+ firmware +1 moreD-Link DIR-822+ V1.0.5 was found to contain a command injection in SetPlcNetworkpwd function of...7.5 High
- bellard quickjs, ubuntu +1 moreQuickJS commit 3b45d15 was discovered to contain an Assertion Failure via JS_FreeRuntime...4.0 Medium
- jerryscriptJerryscript commit cefd391 was discovered to contain a segmentation violation via the component...5.1 Medium
- jerryscriptJerryscript commit cefd391 was discovered to contain a segmentation violation via the component...5.5 Medium
- jerryscriptJerryscript commit ff9ff8f was discovered to contain a segmentation violation via the component...7.1 High
- Show moreLoading…