CVEs published in September 2024
3,764 vulnerabilities, 306 critical, 13 exploited.
- wpsoul greenshiftWordPress Greenshift plugin <= 9.3.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- skt themes templates – elementor & gutenberg templates, sktthemes skt templates, sonalsinha21 skt templates – elementor & gutenberg templates +2 moreWordPress SKT Templates – Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wc lovers wcfm marketplaceWordPress WCFM Marketplace <= 3.6.11 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- idx broker impress for idx brokerWordPress IMPress for IDX Broker plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themehunk gutenberg blocksWordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerability6.5 Medium
- jeroen peters name directoryWordPress Name Directory plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mage-people bus ticket booking with seat reservationWordPress Bus Ticket Booking with Seat Reservation plugin <= 5.3.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- posimyth the plus addons for elementor page builder lite, the plus addons for elementor +1 moreWordPress The Plus Addons for Elementor plugin <= 5.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- likebtn like button ratingWordPress Like Button Rating LikeBtn plugin <= 2.6.53 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- spiffy plugins calendarWordPress Spiffy Calendar plugin <= 4.9.12 - SQL Injection vulnerability7.6 High
- microsoft windows 11 version 22h2, windows 11 version 22h3, windows 11 22h2 +1 more +3 moreWindows Kernel Information Disclosure Vulnerability5.9 Medium
- highwarden super store finderWordPress Super Store Finder plugin <= 6.9.7 - SQL Injection vulnerability9.3 Critical
- highwarden super store finderWordPress Super Store Finder plugin < 6.9.8 - SQL Injection vulnerability9.3 Critical
- arni cinco wpcargo track & trace, wptaskforce track \& trace, wpcargo track \& trace +2 moreWordPress WPCargo Track & Trace plugin <= 8.0.2 - SQL Injection vulnerability9.3 Critical
- cryout-creations verbosaWordPress Verbosa theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- johan van der wijk content blocks (custom post widget), vanderwijk content blocks +1 moreWordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cryout-creations rosetaWordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cryout-creations septeraWordPress Septera theme <= 1.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- vercel next.jsCache Poisoning in next.js7.5 High
- linux, linux kernel +1 morex86/platform/uv: Use alternate source for socket to node data5.5 Medium
- google chromeInappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a...4.3 Medium
- google chromeInappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote...4.3 Medium
- google chromeInsufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58...6.1 Medium
- google chromeIncorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote...4.3 Medium
- google chromeInappropriate implementation in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote...8.8 High
- google chromeType Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to...8.8 High
- backstagePrototype pollution in @backstage/plugin-catalog-backend6.5 Medium
- backstageStorage bucket Directory Traversal in @backstage/plugin-techdocs-backend6.5 Medium
- backstageCircumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend6.5 Medium
- ptzoptics pt30x-sdi, pt30x-ndi, pt30x-ndi-xx-g2 firmware +3 more +5 morePTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration7.2 High
- oretnom23 resort reservation systemSourceCodester Resort Reservation System manage_fee.php cross site scripting5.3 Medium
- ptzoptics pt30x-sdi, pt30x-ndi, pt30x-ndi-xx-g2 firmware +2 more +4 morePTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication9.1 Critical
pl.allegro.tech.hermes:hermes-managementMavenhermes-management is vulnerable to RCE due to Apache commons-jxpath9.3 Critical- vitejs viteDOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite6.4 Medium
- oretnom23 online eyewear shopSourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management5.3 Medium
- micropythonMicroPython objint.c mpz_as_bytes heap-based overflow6.9 Medium
- vitejs viteserver.fs.deny bypassed when using ?import&raw in vite4.8 Medium
- apache druidApache Druid: Users can provide MySQL JDBC properties not on allow list6.5 Medium
kimai/kimaiPackagistKimai has an XXE Leading to Local File Read8.5 High- apache druidApache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack5.3 Medium
- micropythonMicroPython objarray.c use after free6.3 Medium
- micropythonMicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflow6.9 Medium
- wireuiCross site scripting (XSS) Vulnerability on route /wireui/button?label=Content in wireui5.1 Medium
- microsoft dynamics 365 business central, dynamics 365 business central online +1 moreDynamics 365 Business Central Elevation of Privilege Vulnerability8.1 High
- microsoft groupmeGroupMe Elevation of Privilege Vulnerability9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could write data to the user's clipboard, bypassing the user prompt, during a certain...7.5 High
- concrete cms cms, concretecms concrete cms +1 moreStored XSS in the "Top Navigator Bar" block4.6 Medium
- arduino core, espressif arduino-esp32 +1 moreMultiple Poisoned Pipeline Execution (PPE) vulnerabilities10.0 Critical
- codecanyon rise ultimate project managerCodeCanyon RISE Ultimate Project Manager save sql injection5.3 Medium
- Show moreLoading…