CVEs published in November 2024
4,194 vulnerabilities, 370 critical, 16 exploited.
- asaduzzaman abir rig elements for elementorWordPress Rig Elements For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- phil spectrum icon widgetWordPress Icon Widget plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jakir hasan blocks post gridWordPress Blocks Post Grid plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- marketever azonboxWordPress AzonBox plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ironfeet custom url shortenerWordPress Custom URL Shortener plugin <= 0.3.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- christian ladewig cookie nonsense for ytWordPress Cookie Nonsense for YT plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- saif kings tab sliderWordPress Kings Tab Slider plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- sam perrow fast video and image displayWordPress Fast Video and Image Display plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- uri lazcano ekiline block collectionWordPress Ekiline Block Collection plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bnisia ia map analytics basicWordPress IA Map Analytics Basic plugin <= 20170413 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- esparkbiz esb testimonialsWordPress ESB Testimonials plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nicheaddons charity addon for elementorWordPress Charity Addon for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- harmonic design hd quiz – save results lightWordPress HD Quiz – Save Results Light plugin <= 0.5 - Broken Access Control vulnerability5.4 Medium
- rextheme wp vrWordPress WP VR plugin <= 8.5.5 - Broken Access Control vulnerability4.3 Medium
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability4.3 Medium
- binsaifullah easy accordion gutenberg blockWordPress Easy Accordion Gutenberg Block plugin <= 1.2.3 - Broken Access Control vulnerability4.3 Medium
- bold-themes bold page builderWordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerability4.3 Medium
- codezel combo wp rewrite slugsWordPress Combo WP Rewrite Slugs plugin <= 1.0 - Settings Change vulnerability5.4 Medium
- themeisle otter - gutenberg blockWordPress Otter Blocks plugin <= 3.0.3 - Broken Access Control vulnerability2.7 Low
- quantumcloud floating buttons for woocommerce, floating buttons +1 moreWordPress Floating Buttons for WooCommerce plugin <= 2.8.8 - Broken Access Control vulnerability5.3 Medium
- statamic cms, statamic +1 moreStatamic CMS has Path Traversal in Asset Upload5.3 Medium
- containerbuildsystem cachi2cachi2 allows traceback prints locals4.7 Medium
- dassault edrawingsHeap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in eDrawings from Release SOLIDWORKS 2024 through Release SOLIDWORKS 20257.8 High
- sick ag incoming goods suiteSICK Incoming Goods Suite privilege escalation vulnerability8.8 High
- wp-royal-themes asheAshe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter6.1 Medium
- wproyal bardBard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter6.1 Medium
- gdragon gd rating systemGD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter6.4 Medium
- thehowarde parallax imageParallax Image <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via position Parameter6.4 Medium
- techlabpro1 classified listing – ai-powered classified ads & business directory plugin, classified listing plugin +1 moreClassified Listing – Classified ads & Business Directory Plugin <= 3.1.15.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update8.8 High
- i13websolution email subscription popupEmail Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode6.4 Medium
- gamipress, rubengc gamipress – gamification plugin to reward points, achievements, badges & ranks in wordpress +1 moreGamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings7.3 High
- wpbean wpb popup for contact form 7, wpb popup for contact form 7 – showing contact form 7 popup on button click, wpb advanced faq +2 moreWPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form7.3 High
- apache kafka, apache software foundation kafka clients +1 moreApache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider6.5 Medium
- welaunch wordpress gdpr, wordpress gdpr\&ccpa +1 moreWordPress GDPR <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- welaunch wordpress gdpr, wordpress gdpr\&ccpa +1 moreWordPress GDPR <= 2.0.2 - Missing Authorization to Unauthenticated Arbitrary User Deletion6.5 Medium
- sonaar mp3 audio player – music player, podcast player & radio by sonaar, mp3 audio player for music\, radio \& podcast +1 moreMP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode6.4 Medium
- mr2p svg blockSVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload5.5 Medium
- automattic mailpoetMailPoet < 5.3.2 - Admin+ Stored XSS6.1 Medium
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 9 +1 more +3 moreAvahi: avahi wide-area dns predictable transaction ids5.3 Medium
- avahi, red hat enterprise linux 10, enterprise linux 7 +3 more +5 moreAvahi: avahi wide-area dns uses constant source port5.3 Medium
- mitsubishi electric corporation melsec iq-f series fx5-enet, melsec iq-f series fx5-enet/ip, mitsubishi electric melsec iq-f series fx5-enet ip +2 moreDenial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP Module7.5 High
- debian linux, linux kernel, google android +3 more +5 moreHID: core: zero-initialize the report buffer5.5 Medium
- linux, linux kernel, siemens ruggedcom rst2428p +6 more +8 moresecurity/keys: fix slab-out-of-bounds in key_task_permission7.8 High
- linux, linux kernel +1 moreregulator: rtq2208: Fix uninitialized use of regulator_config7.8 High
- linux, linux kernel, siemens ruggedcom rst2428p +6 more +8 moresctp: properly validate chunk size in sctp_sf_ootb()8.2 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: enetc: allocate vf_state during PF probes5.5 Medium
- linux, linux kernel +1 morenet: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts7.5 High
- linux, linux kernel +1 morenet: hns3: fix kernel crash when uninstalling driver5.5 Medium
- linux, linux kernel +1 morenet: arc: fix the device for dma_map_single/dma_unmap_single5.5 Medium
- linux, linux kernel +1 morerxrpc: Fix missing locking causing hanging calls7.8 High
- Show moreLoading…