CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- gitlabIncorrect Authorization in GitLab3.1 Low
- gitlabURL Redirection to Untrusted Site ('Open Redirect') in GitLab8.7 High
- huawei harmonyosRead/Write vulnerability in the image decoding module Impact: Successful exploitation of this...7.1 High
- huawei harmonyosNull pointer dereference vulnerability in the image decoding module Impact: Successful...7.1 High
- python protobufCrash due to uncontrolled recursion in protobuf crate5.9 Medium
- huawei harmonyosRead/Write vulnerability in the image decoding module Impact: Successful exploitation of this...5.1 Medium
- huawei harmonyosCross-process screen stack vulnerability in the UIExtension module Impact: Successful...6.2 Medium
- huawei harmonyosVulnerability of improper access control in the album module Impact: Successful exploitation of...6.1 Medium
- huawei harmonyosRace condition vulnerability in the DDR module Impact: Successful exploitation of this...6.1 Medium
- huawei emui, harmonyos +1 moreDenial of service (DoS) vulnerability in the installation module Impact: Successful exploitation...6.2 Medium
- gitlabPrivilege Context Switching Error in GitLab6.7 Medium
- gitlabInsertion of Sensitive Information into Log File in GitLab4.0 Medium
- huawei emui, harmonyos +1 moreVulnerability of improper access control in the secure input module Impact: Successful...6.2 Medium
- huawei emui, harmonyos +1 moreFile replacement vulnerability on some devices Impact: Successful exploitation of this...6.7 Medium
- huawei emui, harmonyos +1 moreService logic error vulnerability in the system service module Impact: Successful exploitation of...8.5 High
- huawei emui, harmonyos +1 moreSecurity vulnerability in the HiView module Impact: Successful exploitation of this vulnerability...7.3 High
- huawei emui, harmonyos +1 moreVulnerability of improper access control in the MTP module Impact: Successful exploitation of...5.3 Medium
- red hat cryostat 3, cryostat 4 on rhel 9, hawtio hawtio 4.2.0 +12 more +14 moreIo.quarkus.http/quarkus-http-core: quarkus http cookie smuggling7.4 High
- seraphinitesoft seraphinite bulk discounts for woocommerceSeraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site Scripting6.1 Medium
- xtemos woodmartWoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- falselight currency converter widget ⚡ proCurrency Converter Widget ⚡ PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- comfy-org comfyui-managerThe issue stems from a missing validation of the pip field in a POST request sent to the ...10.0 Critical
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- open design alliance cde inweb sdkExposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.36.9 Medium
- g5plus essential real estateEssential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure4.3 Medium
- john weissberg print science designerPrint Science Designer <= 1.3.152 - Unauthenticated PHP Object Injection8.1 High
- hashthemes hash form – drag & drop form builder, hash form +1 moreHash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation4.3 Medium
- wpeka wp cookie consent, wplegalpages cookie banner for gdpr / ccpa – wplp cookie consent +1 moreCookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script4.3 Medium
- code-atlantic popup maker, danieliser popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builder +1 morePopup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- wpdevteam notificationx – fomo, live sales notification, woocommerce sales popup, gdpr, social proof, announcement banner & floating notification barNotificationX – Live Sales Notification, WooCommerce Sales Popup, FOMO, Social Proof, Announcement Banner & Floating Notification Top Bar <= 2.9.3 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- wpsoul greenshift – animation and page builder blocks, greenshiftwp greenshift - animation and page builder blocks +1 moreGreenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure4.3 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.126 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- thimpress learnpressLearnPress < 4.2.7.2 - Admin+ Stored XSS4.8 Medium
- theluckywp luckywp table of contentsLuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS4.8 Medium
- ghozylab popup builderPopup Builder < 4.3.5 - Admin+ Stored XSS4.8 Medium
- kadencewp gutenberg blocks with ai, unknown gutenberg blocks with ai by kadence wp +1 moreKadence Blocks < 3.2.54 - Admin+ Stored XSS5.4 Medium
- unknown ajax search lite, wp-dreams ajax search +1 moreAjax Search Lite < 4.12.4 - Admin+ Stored XSS4.7 Medium
- properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 moreProfilePress < 4.15.15 - Admin+ Stored XSS4.8 Medium
- properfraction profilepress, unknown paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content +1 moreProfilePress < 4.15.15 - Admin+ Stored XSS4.8 Medium
- jordy meow ai engineAI-Engine < 2.6.5 - Admin+ SQLi7.2 High
- thimpress learnpressLearnPress < 4.2.7.2 - Admin+ Stored XSS4.8 Medium
- lordspace child theme creator by orbisiusChild Theme Creator by Orbisius <= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete4.3 Medium
- depayfi web3 crypto payments by depay for woocommerceWeb3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure5.3 Medium
- element invader elementinvader addons for elementor, elementinvader addons for elementor +1 moreElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read4.3 Medium
- kstover ninja forms – the contact form builder that grows with you, ninjaforms ninja forms +1 moreNinja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations7.2 High
- hanthuy integrate firebaseIntegrate Firebase <= 0.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- samdani gs books showcase – display books in grid, slider & more | library for wordpressWordPress Book Plugin for Displaying Books in Grid, Flip, Slider, Popup Layout and more <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- zealopensource accept stripe payments using contact form 7Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure5.3 Medium
- tw2113 social media shortcodesSocial Media Shortcodes <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jacques malgrange wp geonamesWP GeoNames <= 1.9.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…