Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 7.5

    HIGH
    CVE-2024-46307

    A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.... Read more

    Affected Products : sparkshop
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.8

    HIGH
    CVE-2024-8048

    In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.... Read more

    Affected Products : telerik_reporting
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 9.1

    CRITICAL
    CVE-2024-8015

    In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-8014

    In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.... Read more

    Affected Products : telerik_reporting
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.8

    HIGH
    CVE-2024-7840

    In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.... Read more

    Affected Products : telerik_reporting
    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.5

    HIGH
    CVE-2024-7294

    In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-7293

    In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-7292

    In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.... Read more

    • Published: Oct. 09, 2024
    • Modified: Oct. 15, 2024

  • 7.5

    HIGH
    CVE-2024-9156

    The TI WooCommerce Wishlist WordPress plugin through 2.8.2 is vulnerable to SQL Injection due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated... Read more

    Affected Products : ti_woocommerce_wishlist
    • Published: Oct. 10, 2024
    • Modified: Oct. 15, 2024

  • 6.4

    MEDIUM
    CVE-2024-9074

    The Advanced Blocks Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated... Read more

    Affected Products : advanced_blocks_pro
    • Published: Oct. 10, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-8198

    Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.113 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)... Read more

    Affected Products : chrome edge_chromium
    • Published: Aug. 28, 2024
    • Modified: Oct. 15, 2024

  • 8.8

    HIGH
    CVE-2024-7534

    Heap buffer overflow in Layout in Google Chrome prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)... Read more

    Affected Products : chrome edge_chromium
    • Published: Aug. 06, 2024
    • Modified: Oct. 15, 2024

  • 9.8

    CRITICAL
    CVE-2024-46045

    Tenda CH22 V1.0.0.6(468) has a stack overflow vulnerability located in the frmL7PlotForm function.... Read more

    Affected Products : ch22_firmware ch22
    • Published: Sep. 13, 2024
    • Modified: Oct. 15, 2024

  • 4.4

    MEDIUM
    CVE-2024-44096

    there is a possible arbitrary read due to an insecure default value. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.... Read more

    Affected Products : android
    • Published: Sep. 13, 2024
    • Modified: Oct. 15, 2024

  • 7.8

    HIGH
    CVE-2024-44095

    In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possible corrupt memory due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitati... Read more

    Affected Products : android
    • Published: Sep. 13, 2024
    • Modified: Oct. 15, 2024

  • 6.3

    MEDIUM
    CVE-2024-9520

    The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers wi... Read more

    Affected Products : userplus
    • Published: Oct. 10, 2024
    • Modified: Oct. 15, 2024

  • 4.8

    MEDIUM
    CVE-2024-25707

    There is a reflected cross site scripting in Esri Portal for ArcGIS 11.1 and below on Windows and Linux x64 allows a remote authenticated attacker with administrative access to supply a crafted string which could potentially execute arbitrary JavaScript c... Read more

    Affected Products : linux_kernel windows portal_for_arcgis
    • Published: Oct. 04, 2024
    • Modified: Oct. 15, 2024

  • 7.2

    HIGH
    CVE-2024-9022

    The TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of s... Read more

    Affected Products : ts_poll
    • Published: Oct. 10, 2024
    • Modified: Oct. 15, 2024

  • 5.4

    MEDIUM
    CVE-2024-38039

    There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser (no stateful change ... Read more

    Affected Products : portal_for_arcgis
    • Published: Oct. 04, 2024
    • Modified: Oct. 15, 2024

  • 4.3

    MEDIUM
    CVE-2024-9067

    The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'delete_attachment' function in all version... Read more

    Affected Products : youzify
    • Published: Oct. 10, 2024
    • Modified: Oct. 15, 2024
Showing 20 of 291335 Results