CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- academy lms lms, kodezen academy lms +1 moreWordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability7.1 High
- hamid alinia login with phone numberWordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerability4.3 Medium
- addonmaster post grid masterWordPress Post Grid Master plugin <= 3.4.7 - Broken Access Control vulnerability5.3 Medium
- a wp life video gallery – api gallery, youtube and vimeo, link galleryWordPress Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control vulnerability4.3 Medium
- leadconnectorWordPress LeadConnector plugin <= 1.7 - API Broken Access Control vulnerability8.6 High
- af themes wp post authorWordPress WP Post Author plugin <= 3.6.4 - Rating Value Manipulation vulnerability4.3 Medium
- af themes wp post authorWordPress WP Post Author plugin <= 3.6.4 - Broken Access Control vulnerability4.3 Medium
- alttext.ai download alt text aiWordPress AltText.ai plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- webpushrWordPress Web Push Notifications – Webpushr plugin <= 4.35.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- ietf dhcp, cisco anyconnect vpn client, secure client +7 more +9 moreDHCP routing options can manipulate interface-based VPN traffic7.6 High
- posimyth the plus addons for elementor page builder lite, the plus addons for elementor +1 moreWordPress The Plus Addons for Elementor plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- quomodosoft elementsready, elementsready addons for elementor +1 moreWordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wppool sheets to wp table live syncWordPress Sheets to WP Table Live Sync plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- aveva edgeWordPress Edge theme <= 2.0.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- chatbot for wordpress - wpbot conversational forms for chatbotWordPress ChatBot Conversational Forms plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- property hive propertyhiveWordPress PropertyHive plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- addonmaster post grid masterWordPress Post Grid Master plugin <= 3.4.8 - Auth. Cross Site Scripting (XSS) vulnerability6.5 Medium
- rara theme restaurant and cafeWordPress Restaurant and Cafe theme <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- popup box team box, unknown popup box +1 moreWordPress Popup Box plugin <= 4.1.2 - CSRF to XSS vulnerability7.1 High
- lucian apostol auto affiliate linksWordPress Auto Affiliate Links plugin <= 6.4.3.1 - SQL Injection vulnerability7.6 High
- parcel panel parcelpanelWordPress ParcelPanel plugin <= 3.8.1 - Auth. SQL Injection vulnerability8.5 High
- mooberry dreams book managerWordPress Mooberry Book Manager plugin <= 4.15.12 - Sensitive Data Exposure vulnerability5.3 Medium
- robosoft robo gallery, robogallery +1 moreWordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.18 - Sensitive Data Exposure vulnerability5.3 Medium
- seopressWordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerability5.3 Medium
- scribit gdpr complianceWordPress GDPR Compliance plugin <= 1.2.5 - Sensitive Data Exposure vulnerability7.5 High
- brevo sendinblue for woocommerceWordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability8.5 High
- matthiask html-sanitizerhtml-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization6.1 Medium
- qualcomm ar8035 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +113 more +115 moreBuffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio7.3 High
- qualcomm aqt1000 firmware, ar8035 firmware, csr8811 firmware +188 more +190 moreBuffer Over-read in WLAN Firmware7.5 High
- qualcomm aqt1000 firmware, ar8035 firmware, fastconnect 6200 firmware +53 more +55 moreImproper Input Validation in Secure Processor7.8 High
- qualcomm ar8035 firmware, fastconnect 6900 firmware, fastconnect 7800 firmware +23 more +25 moreStack-based Buffer Overflow in PMIC8.4 High
- qualcomm ar8035 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +140 more +142 moreAccess of Uninitialized Pointer in SPS Applications8.4 High
- qualcomm aqt1000 firmware, ar8035 firmware, fastconnect 6200 firmware +156 more +158 moreInteger Overflow or Wraparound in HLOS5.9 Medium
- qualcomm 315 5g iot modem firmware, aqt1000 firmware, ar8035 firmware +159 more +161 moreReachable Assertion in Data Modem7.5 High
- qualcomm fastconnect 6800 firmware, fastconnect 6900 firmware, fastconnect 7800 firmware +58 more +60 moreBuffer Over-read in Video6.8 Medium
- qualcomm ar8035 firmware, c-v2x 9150 firmware, fastconnect 6800 firmware +81 more +83 moreUse After Free in HLOS6.7 Medium
- qualcomm aqt1000 firmware, ar8035 firmware, fastconnect 6200 firmware +160 more +162 moreTime-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor8.4 High
- pallets werkzeug, debian linux, fedoraproject fedora +2 moreWerkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution7.5 High
- pallets jinja, fedoraproject fedora +1 moreJinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter5.4 Medium
- litestar-org litestar, starliteproject starlite +1 moreLitestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8.2 High
- ethereum go-ethereum, go ethereum +1 morego-ethereum denial of service via malicious p2p message7.5 High
- delta electronics diaenergieDelta Electronics DIAEnergie SQL Injection7.5 High
- delta electronics diaenergieDelta Electronics DIAEnergie SQL Injection9.8 Critical
- delta electronics diaenergieDelta Electronics DIAEnergie Unauthenticated SQL Injection9.8 Critical
- moxa nport 5100a series, nport 5100a series firmware +1 moreNPort 5100A Series Store XSS Vulnerability8.3 High
- codesys development system v2.3CODESYS: Use after free vulnerability through corrupted project files5.5 Medium
- codesys development system v2.3, development system +1 moreCODESYS: Out-of-bounds write through corrupted project files7.8 High
- breakdanceBreakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta6.4 Medium
skopeoopenSUSESecurity update for skopeoNo score- open-xchange ox app suiteE-Mails exported as PDF were stored in a cache that did not consider specific session information...5.3 Medium
- Show moreLoading…