CVEs published in December 2024
3,523 vulnerabilities, 294 critical, 11 exploited.
- gsarig out of the block: openstreetmapOut of the Block: OpenStreetMap <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode6.4 Medium
- hay86 comfyui-ace-nodesComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval()...10.0 Critical
- bmad4ever comfyui-bmad-nodesComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in...10.0 Critical
- secomea gatemanagerMissing security header: Referrer-Policy URL3.5 Low
- rti connext professionalPotential stack corruption in Routing Service when using a malicious XML configuration document8.3 High
- rti connext professionalPotential stack buffer write overflow in Persistence Service while parsing malicious environment variable on non-Windows systems6.9 Medium
- rti connext professionalPotential stack buffer write overflow in Connext applications while parsing malicious license file6.9 Medium
- rti connext professionalPotential stack buffer write overflow in Connext applications while parsing malicious XML types document8.3 High
- rti connext professionalPotential stack buffer write overflow in Connext applications while parsing malicious XML types document6.9 Medium
- rti connext professionalPotential stack buffer overflow when parsing an XML type8.3 High
- rti connext professionalPotential stack overflow when using XML configuration file referencing environment variables8.3 High
- rti connext professionalBuffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Heap-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in RTI Connext Professional (Security Plugins) allows O…6.9 Medium
- rti connext professionalPotential arbitrary command execution in System Designer while parsing malicious HTTP/REST requests8.6 High
- rti connext professionalPotential arbitrary SQL query execution in Queuing Service while parsing malicious remote commands or configuration files9.1 Critical
- mainwp child – securely connects to the mainwp dashboard to manage multiple sitesMainWP Child <= 5.3.3 - Missing Authorization to Unauthenticated Privilege Escalation8.1 High
- azzaroco super backup & clone - migrate for wordpressSuper Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload9.8 Critical
- ninjateam notibar – notification bar for wordpressNotibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text6.3 Medium
- propertyhive property hive stamp duty calculatorProperty Hive Stamp Duty Calculator <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- arraytics timetics – appointment booking & schedulingWP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion4.3 Medium
- quantumcloud simple link directorySimple Link Directory <= 8.4.5 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- collizo4sky rate my post – star rating plugin by feedbackwpRate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts5.3 Medium
- inspireui mstore api – create native android & ios apps on the cloud, mstore api +1 moreMStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)5.4 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation4.3 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- elliotvs coupon affiliates – affiliate plugin for woocommerceCoupon Affiliates – Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting6.5 Medium
- amauri wpmobile.appWPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- ameliabooking booking system trafftBooking System Trafft <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themify store locator, themifyme themify store locator +1 moreThemify Store Locator <= 1.1.9 - Cross-Site Request Forgery4.3 Medium
- fastlinemedia beaver builder, beaverbuilder beaver builder page builder – drag and drop website builder +1 moreBeaver Builder – WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- stellarwp image widgetImage Widget < 4.4.11 - Admin+ Stored XSS4.8 Medium
- dotcamp ultimate blocks, ultimate blocks blocks +1 moreUltimate Blocks < 3.2.4 - Contributor+ Stored XSS5.4 Medium
- plextracInsecure Deserialization via Runbooks Imports8.6 High
- plextracLocal File Inclusion8.6 High
- plextracN1QL Injection8.6 High
- plextracServer-side Request Forgery8.6 High
- plextracDenial of Service7.0 High
- plextracArbitrary File Write via PTRAC Import8.9 High
- plextracArbitrary Directory Write via Runbooks Artifact Upload8.9 High
- kadencewp gutenberg blocks with ai, stellarwp kadence blocks — page builder toolkit for gutenberg editor +1 moreKadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
djoserDebiandjoser Authentication Bypass5.7 Mediumspatie/browsershotPackagistBrowsershot Local File Inclusion7.7 High- teckel minify htmlMinify HTML <= 2.1.10 - - Regular Expressions Denial of Service5.3 Medium
- amrendesign svg shortcodeSVG Shortcode <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload5.4 Medium
- primersoftware primer mydata for woocommercePrimer MyData for Woocommerce <= 4.2.1 - Reflected Cross-Site Scripting6.1 Medium
- newsman newsmanappNewsmanApp <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- webandprint ar for wordpressAR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload3.7 Low
- i13websolution responsive filterable portfolioResponsive Filterable Portfolio <=1.0.8 - Authenticated (Admin+) SQL Injection6.5 Medium
- stathisg hello in all languagesHello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- tecno com.transsion.applockA logic vulnerability in the the mobile application (com.transsion.applock) can lead to bypassing...9.8 Critical
- horner automation cscapeHorner Automation Cscape Out-of-bounds Read8.5 High
- Show moreLoading…