CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreZDI-CAN-23466: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 1 of 27.8 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreTALOS-2024-1952 - Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerability5.5 Medium
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreTALOS-2024-1946 - Adobe Acrobat Reader Font gvar GlyphVariationData out-of-bounds read vulnerability5.5 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreZDI-CAN-23475: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- adobe acrobat, acrobat reader, acrobat dc +1 more +3 moreZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 2 of 27.8 High
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreZDI-CAN-23472: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreZDI-CAN-23473: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreZDI-CAN-23474: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability7.8 High
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreZDI-CAN-23327: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability7.8 High
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 moreEmail Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request8.8 High
- optimole – optimize images in real timeImage Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload6.4 Medium
- unknown base64 encoder/decoder, mranderson base64 encoder\/decoder +1 moreBase64 Encoder/Decoder <= 0.9.2 - Settings Reset via CSRF5.5 Medium
- unknown base64 encoder/decoder, mranderson base64 encoder\/decoder +1 moreBase64 Encoder/Decoder <= 0.9.2 - Stored XSS via CSRF2.4 Low
- unknown base64 encoder/decoder, mranderson base64 encoder\/decoder +1 moreBase64 Encoder/Decoder <= 0.9.2 - Reflected XSS4.8 Medium
- smartypants sp project & document manager, smartypantsplugins sp project \& document manager +1 moreSP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR6.5 Medium
- smartypants sp project & document manager, smartypantsplugins sp project \& document manager +1 moreSP Project & Document Manager <= 4.71 - Data Update via IDOR6.5 Medium
- benaceur-php month name translation benaceur, month name translation benaceur wordpress plugin name translation benaceur wordpress plugin +1 moremonth name translation benaceur < 2.3.8 - Admin+ Stored XSS4.8 Medium
- dachande663 hl twitterHL Twitter <= 2014.1.18 - Unlink Twitter Account via CSRF4.3 Medium
- dachande663 hl twitterHL Twitter <= 2014.1.18 - Admin+ Stored XSS via Widget5.4 Medium
- dachande663 hl twitterHL Twitter <= 2014.1.18 - Settings Update via CSRF2.4 Low
- getshortcodes shortcodes ultimate, gn themes wp shortcodes plugin — shortcodes ultimate +1 moreShortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS6.1 Medium
- goprayer wp prayerWP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRF5.3 Medium
- goprayer wp prayerWP Prayer <= 2.0.9 - Email Settings Update via CSRF8.8 High
- goprayer wp prayerWP Prayer <= 2.0.9 - Settings Update via CSRF7.6 High
bpftoolAlmaLinux,bpftool-debuginfoRed Hat,dtb-aarch64openSUSE +219 more +221 moreHardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R...7.5 High- itpison omicard edmITPison OMICARD EDM - Server-Side Request Forgery5.3 Medium
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect6.4 Medium
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreGutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- digiwin easyflow .netDigiWin EasyFlow .NET - SQL Injection9.8 Critical
- aws amazon-redshift-jdbc-driverAmazon JDBC Driver for Redshift SQL Injection via line comment generation10.0 Critical
- idccmsidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component ...6.5 Medium
- idccmsidccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component ...8.8 High
- carazo import and export users and customersImport and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- shaonsina sina extension for elementorSina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.3 - Authenticated (Contributor+) Stored Cross-site Scriping…6.4 Medium
- alttextai alt text ai – automatically generate image alt text for seo and accessibilityAlt Text AI – Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection8.8 High
- ithemelandco wpbulkit – bulk edit wordpress posts & pagesBulk Posts Editing For WordPress <= 4.2.3 - Authenticated (Subscriber+) Missing Authorization4.3 Medium
- carazo import and export users and customersImport and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- exclusiveaddons exclusive addons for elementorExclusive Addons for Elementor <= 2.6.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget6.4 Medium
- kubernetes azure-file-csi-driverKubernetes azure-file-csi-driver in versions before 1.29.4 and 1.30.1 discloses service account tokens in logs6.5 Medium
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo scorelibvpxOSS-FuzzUse-of-uninitialized-value in vpx_codec_peek_stream_infoNo score- bonitasoft bonita webBonitasoft Runtime Community edition's contains an insecure direct object references vulnerability6.5 Medium
- wpzoom addons for elementor, addons for elementor – starter templates & widgets, elementor addons +2 moreWPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget6.4 Medium
- saadiqbal password protected — lock entire site, pages, posts, categories, and partial contentPassword Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure4.3 Medium
- nk visual portfolio, photo gallery & post gridVisual Portfolio, Photo Gallery & Post Grid <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via title_tag Parameter6.4 Medium
- arubanetworks arubaos, instant, hewlett packard enterprise (hpe) aos-8 instant and aos-10 ap +2 more +4 moreAn authenticated sensitive information disclosure vulnerability exists in the CLI service...4.9 Medium
- arubanetworks arubaos, instant, hewlett packard enterprise (hpe) aos-8 instant and aos-10 ap +2 more +4 moreAn unauthenticated Denial-of-Service (DoS) vulnerability exists in the ANSI escape code service...5.3 Medium
- arubanetworks arubaos, instant, hewlett packard enterprise (hpe) aos-8 instant and aos-10 ap +2 more +4 moreUnauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the...5.3 Medium
- arubanetworks arubaos, instant, hewlett packard enterprise (hpe) aos-8 instant and aos-10 ap +2 more +4 moreUnauthenticated Denial of Service (DoS) vulnerabilities exist in the CLI service accessed via the...5.3 Medium
- Show moreLoading…