Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 8.2

    HIGH
    CVE-2024-48770

    An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process.... Read more

    Affected Products :
    • Published: Oct. 11, 2024
    • Modified: Oct. 15, 2024

  • 9.8

    CRITICAL
    CVE-2024-42640

    angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/... Read more

    Affected Products :
    • Published: Oct. 11, 2024
    • Modified: Oct. 15, 2024

  • 5.1

    MEDIUM
    CVE-2024-9471

    A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS admin... Read more

    Affected Products : pan-os prisma_access
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 6.8

    MEDIUM
    CVE-2024-47944

    The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin interface. This leads to an unauthenticated code execution via the firmware upgrade function.... Read more

    Affected Products :
    • Published: Oct. 15, 2024
    • Modified: Oct. 15, 2024

  • 7.2

    HIGH
    CVE-2024-45754

    An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x before 23.04.11, and 22.10.x before 22.10.11. SQL injection can occur in the listing of configured reporting jobs. Ex... Read more

    Affected Products : centreon
    • Published: Oct. 11, 2024
    • Modified: Oct. 15, 2024

  • 6.5

    MEDIUM
    CVE-2024-45806

    Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue ar... Read more

    Affected Products : envoy
    • Published: Sep. 20, 2024
    • Modified: Oct. 15, 2024

  • 5.5

    MEDIUM
    CVE-2024-47661

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid overflow from uint32_t to uint8_t [WHAT & HOW] dmub_rb_cmd's ramping_boundary has size of uint8_t and it is assigned 0xFFFF. Fix it by changing it to uint8_t with... Read more

    Affected Products : linux_kernel
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.5

    HIGH
    CVE-2024-48792

    An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process.... Read more

    Affected Products :
    • Published: Oct. 14, 2024
    • Modified: Oct. 15, 2024

  • 7.8

    HIGH
    CVE-2024-43701

    Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.... Read more

    Affected Products : ddk
    • Published: Oct. 14, 2024
    • Modified: Oct. 15, 2024

  • 7.0

    HIGH
    CVE-2024-9467

    A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Exp... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.5

    HIGH
    CVE-2024-46307

    A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.... Read more

    Affected Products : sparkshop
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.8

    HIGH
    CVE-2024-8048

    In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.... Read more

    Affected Products : telerik_reporting
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 9.1

    CRITICAL
    CVE-2024-8015

    In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-8014

    In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.... Read more

    Affected Products : telerik_reporting
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.8

    HIGH
    CVE-2024-7840

    In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.... Read more

    Affected Products : telerik_reporting
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.5

    HIGH
    CVE-2024-7294

    In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-7293

    In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-7292

    In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.5

    HIGH
    CVE-2024-9156

    The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated... Read more

    Affected Products : ti_woocommerce_wishlist
    • Published: Oct. 10, 2024
    • Modified: Oct. 15, 2024

  • 6.4

    MEDIUM
    CVE-2024-9074

    The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated... Read more

    Affected Products : advanced_blocks_pro
    • Published: Oct. 10, 2024
    • Modified: Oct. 15, 2024
Showing 20 of 291265 Results