Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

6.4

MEDIUM

CVE-2024-10342

The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Affected Products : league_of_legends_shortcodes
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
6.5

MEDIUM

CVE-2024-10341

The League of Legends Shortcodes plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the e...

Affected Products : league_of_legends_shortcodes
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
6.4

MEDIUM

CVE-2024-10150

The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attribute...

Affected Products : button_generator
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
6.1

MEDIUM

CVE-2024-9607

The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.2.9. This makes it possible for unauthenticated...

Affected Products : 10web_social_post_feed
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
9.8

CRITICAL

CVE-2024-9302

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verify_otp_forgot_password() and update_passwo...

Affected Products : app_builder
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
8.8

HIGH

CVE-2024-9235

The Mapster WP Maps plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to an insufficient capability check on the mapster_wp_maps_set_option_from_js() function in all versions up to, and inclu...

Affected Products : mapster_wp_maps
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
6.3

MEDIUM

CVE-2024-50583

Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to improper permission settings....

Affected Products :
Published: Oct. 25, 2024

Modified: Oct. 25, 2024
6.2

MEDIUM

CVE-2024-48870

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of ot...

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
7.4

HIGH

CVE-2024-47801

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web brows...

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
7.4

HIGH

CVE-2024-47549

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on...

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
9.8

CRITICAL

CVE-2024-47406

Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability....

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
8.1

HIGH

CVE-2024-47005

Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs....

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
5.3

MEDIUM

CVE-2024-45842

Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retrieved when processing crafted HTTP requests....

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
7.5

HIGH

CVE-2024-45829

Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed....

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
7.5

HIGH

CVE-2024-43424

Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed....

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
7.5

HIGH

CVE-2024-42420

Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOAP messages. Crafted HTTP requests may cause affected products crashed....

Affected Products : bp-30c25_firmware bp-30c25t_firmware bp-30c25y_firmware bp-30c25z_firmware bp-30m28_firmware bp-30m28t_firmware bp-30m31_firmware bp-30m31t_firmware bp-30m35_firmware bp-30m35t_firmware +630 more products
Published: Oct. 25, 2024

Modified: Nov. 05, 2024
6.4

MEDIUM

CVE-2024-10148

The Awesome buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's btn2 shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This ma...

Affected Products : awesome_buttons
Published: Oct. 25, 2024

Modified: Nov. 06, 2024
8.1

HIGH

CVE-2024-10011

The BuddyPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 14.1.0 via the id parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on f...

Affected Products : buddypress
Published: Oct. 25, 2024

Modified: Nov. 06, 2024
9.8

CRITICAL

CVE-2024-9488

The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for una...

Affected Products : wpdiscuz
Published: Oct. 25, 2024

Modified: Nov. 06, 2024
4.3

MEDIUM

CVE-2024-9109

The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_oauth_data function in all versions up to, and including, 2.3.11. This make...

Affected Products : woocommerce_ups_shipping
Published: Oct. 25, 2024

Modified: Nov. 06, 2024

Showing 20 of 294690 Results

1
...
2107
2108
2109
2110
2111
2112
2113
...
14735

Browse by Apps

Latest CVE Feed

6.4

6.5

6.4

6.1

9.8

8.8

6.3

6.2

7.4

7.4

9.8

8.1

5.3

7.5

7.5

7.5

6.4

8.1

9.8

4.3

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable