CVEs published in May 2024
5,284 vulnerabilities, 411 critical, 14 exploited.
- ibm planning analytics localIBM Planning Analytics Local cross-site scripting6.4 Medium
- ibm planning analytics localIBM Planning Analytics Local cross-site scripting5.4 Medium
- ibm security verify access oidc providerIBM Security Verify Access OIDC Provider information disclosure4.0 Medium
- rejetto http file serverRejetto HTTP File Server 2.3m Unauthenticated RCE9.8 Critical
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion6.4 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation Widget6.4 Medium
- codename065 download managerDownload Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode6.4 Medium
- snap snapchat lenscoreType Confusion in Snapchat Lenscore7.3 High
- astrotalksImproper privilege management vulnerability in Astrotalks8.3 High
- astrotalksInformation exposure vulnerability in Astrotalks5.3 Medium
- astrotalksSQL injection vulnerability in Astrotalks8.8 High
- themewinter wpcafe, arraytics wpcafe – restaurant menu, online food ordering & table booking system +1 moreWPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode6.4 Medium
- yokogawa rental & lease corporation unifier, unifier cast +1 moreMissing authorization vulnerability exists in Unifier and Unifier Cast Version.5.0 or later, and...9.8 Critical
- yokogawa rental & lease corporation unifier, unifier cast +1 moreIncorrect default permissions issue exists in Unifier and Unifier Cast Version.5.0 or later, and...7.8 High
- unknown wp staging wordpress backup plugin, wp-staging wp staging +1 moreMigration Backup Restore < 3.5.0 - Admin+ SSRF7.5 High
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Global Tooltip5.4 Medium
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget6.4 Medium
- leap13 premium addons for elementor, premium addons for elementor – powerful elementor templates & widgets +1 morePremium Addons for Elementor <= 4.10.31 - Missing Authorization to Information Disclosure4.3 Medium
- atarim visual collaboration, wpfeedback atarim – visual feedback, review & ai collaboration +1 moreVisual Website Collaboration, Feedback & Project Management – Atarim <= 3.30 - Unauthenticated Stored Cross-Site Scripting7.2 High
- detheme dethemekit for elementorDethemeKit For Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via slitems Attribute6.4 Medium
- thenahidul responsive owl carousel for elementorResponsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion8.8 High
- seiko solutions inc. skybridge basic mb-a130, skybridge mb-a100/mb-a110, seiko-sol skybridge basic mb-a130 firmware +1 more +3 moreImproper neutralization of special elements used in a command ('Command Injection') exists in...9.8 Critical
- linuxfoundation opendaylightThe OpenDaylight 0.15.3 controller allows topology poisoning via API requests because an...9.1 Critical
icuOSS-FuzzHeap-buffer-overflow in ubidi_writeReordered_76No score- ollamaOllama does not validate the format of the digest (sha256 with 64 hex digits)8.8 High
- libmodbuslibmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function.7.5 High
- debian as dcp libasdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader...8.1 High
- google chrome, fedoraproject fedora +1 moreOut of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote...8.8 High
- google chrome, fedoraproject fedora +1 moreOut of bounds memory access in Keyboard Inputs in Google Chrome prior to 125.0.6422.141 allowed a...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Media Session in Google Chrome prior to 125.0.6422.141 allowed a remote...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreHeap buffer overflow in WebRTC in Google Chrome prior to 125.0.6422.141 allowed a remote attacker...8.8 High
typo3/cmsPackagistTYPO3 Frontend vulnerable to Unauthenticated Path Disclosure5.3 Mediumtypo3/cmsPackagistTYPO3 Brute Force Protection Bypass in backend login6.5 Mediumtypo3/cmsPackagistTYPO3 Information Disclosure Vulnerability Exploitable by Editors6.5 Mediumtypo3/cmsPackagistTYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors5.4 Mediumtypo3/cmsPackagistTYPO3 frontend login vulnerable to Session Fixation7.1 Hightypo3/cmsPackagistTYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts8.8 High- statamic cmsPassword confirmation stored in plain text via registration form in statamic/cms1.8 Low
- tianocore edk2Integer Overflow caused by divide by zero during S3 suspension6.0 Medium
typo3/cmsPackagistTYPO3 possible cache poisoning on the homepage when anchors are usedNo scoretypo3/cmsPackagistExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting6.1 Medium- fuji electric monitouch v-sftFuji Electric Monitouch V-SFT Stack-Based Buffer Overflow8.5 High
- fuji electric monitouch v-sftFuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')8.5 High
- yiiframework yii, yiisoft yii2 +1 moreReflected Cross-site Scripting in yiisoft/yii2 Debug mode4.2 Medium
- ethyca fidesSensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides6.5 Medium
typo3/cmsPackagistTYPO3 Arbitrary Shell Execution in Swiftmailer library8.1 High- wagtailImproper Handling of Insufficient Permissions in Wagtail5.5 Medium
- Show moreLoading…