Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 9.0

    HIGH
    CVE-2024-9910

    A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formSetPassword of the file /goform/formSetPassword. The manipulation of the argument curTime leads to buffer overflow. The attack may ... Read more

    Affected Products : dir-619l_firmware dir-619l
    • Published: Oct. 13, 2024
    • Modified: Oct. 16, 2024

  • 9.0

    HIGH
    CVE-2024-9909

    A vulnerability has been found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this vulnerability is the function formSetMuti of the file /goform/formSetMuti. The manipulation of the argument curTime leads to buffer overflow. The attack... Read more

    Affected Products : dir-619l_firmware dir-619l
    • Published: Oct. 13, 2024
    • Modified: Oct. 16, 2024

  • 7.1

    HIGH
    CVE-2024-6959

    A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process eac... Read more

    Affected Products : lollms_webui lollms_web_ui
    • Published: Oct. 13, 2024
    • Modified: Nov. 03, 2024

  • 8.8

    HIGH
    CVE-2024-9908

    A vulnerability, which was classified as critical, was found in D-Link DIR-619L B1 2.06. Affected is the function formSetMACFilter of the file /goform/formSetMACFilter. The manipulation of the argument curTime leads to buffer overflow. The exploit has bee... Read more

    Affected Products : dir-619l_firmware dir-619l
    • Published: Oct. 13, 2024
    • Modified: Oct. 16, 2024

  • 6.3

    MEDIUM
    CVE-2024-9907

    A vulnerability classified as problematic was found in QileCMS up to 1.1.3. This vulnerability affects the function sendEmail of the file /qilecms/user/controller/Forget.php of the component Verification Code Handler. The manipulation leads to weak passwo... Read more

    Affected Products :
    • Published: Oct. 13, 2024
    • Modified: Oct. 15, 2024

  • 5.4

    MEDIUM
    CVE-2024-9906

    A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument Code leads to cross site sc... Read more

    Affected Products : online_eyewear_shop
    • Published: Oct. 13, 2024
    • Modified: Oct. 16, 2024

  • 8.8

    HIGH
    CVE-2024-9905

    A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the file /admin/?page=inventory/view_inventory&id=2. The manipulation of the argument id leads to sq... Read more

    Affected Products : online_eyewear_shop
    • Published: Oct. 13, 2024
    • Modified: Oct. 16, 2024

  • 7.2

    HIGH
    CVE-2024-9904

    A vulnerability classified as critical was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This vulnerability affects the function pictureUpload of the file /admin/File/pictureUpload. The manipulation of the argument file leads to unrestricted uplo... Read more

    • Published: Oct. 13, 2024
    • Modified: Jul. 30, 2025

  • 7.2

    HIGH
    CVE-2024-9903

    A vulnerability classified as critical has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 1.2.0. This affects the function fileUpload of the file /admin/File/fileUpload. The manipulation of the argument file leads to unrestricted upload. It is possi... Read more

    • Published: Oct. 12, 2024
    • Modified: Jul. 30, 2025

  • 7.5

    HIGH
    CVE-2024-49193

    Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming e-mail messages and used to grant additional authorization for ticket viewing, the mechanism for detecting spoofed ... Read more

    Affected Products :
    • Published: Oct. 12, 2024
    • Modified: Oct. 16, 2024

  • 8.8

    HIGH
    CVE-2024-9894

    A vulnerability, which was classified as critical, was found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file reset.php. The manipulation of the argument useremail leads to sql injection. It is possible to launch the att... Read more

    Affected Products : blood_bank_system blood_bank_system
    • Published: Oct. 12, 2024
    • Modified: Oct. 16, 2024

  • 4.3

    MEDIUM
    CVE-2024-8902

    The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.8 via the render_column function in modules/data-table/widgets/data-table.php. This makes it possible for authenti... Read more

    • Published: Oct. 12, 2024
    • Modified: Jan. 16, 2025

  • 7.2

    HIGH
    CVE-2024-8757

    The WP Post Author – Boost Your Blog's Engagement with Author Box, Social Links, Co-Authors, Guest Authors, Post Rating System, and Custom User Registration Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the linked_us... Read more

    Affected Products : wp_post_author
    • Published: Oct. 12, 2024
    • Modified: Oct. 15, 2024

  • 6.4

    MEDIUM
    CVE-2024-9696

    The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rescue_tab' shortcode in all versions up to, and including, 2.8 due to insufficient input sanitization and output escaping on user supplied attribute... Read more

    Affected Products : rescue_shortcodes
    • Published: Oct. 12, 2024
    • Modified: Nov. 25, 2024

  • 6.4

    MEDIUM
    CVE-2024-9595

    The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes ... Read more

    Affected Products : tablepress
    • Published: Oct. 12, 2024
    • Modified: Aug. 09, 2025

  • 6.4

    MEDIUM
    CVE-2024-8915

    The Category Icon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attac... Read more

    Affected Products :
    • Published: Oct. 12, 2024
    • Modified: Oct. 15, 2024

  • 5.3

    MEDIUM
    CVE-2024-8760

    The Stackable – Page Builder Gutenberg Blocks plugin for WordPress is vulnerable to CSS Injection in all versions up to, and including, 3.13.6. This makes it possible for unauthenticated attackers to embed untrusted style information into comments resulti... Read more

    Affected Products : stackable
    • Published: Oct. 12, 2024
    • Modified: Oct. 15, 2024

  • 4.3

    MEDIUM
    CVE-2024-9756

    The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on the wcoa_add_attachment AJAX action in versions 2.0 to 2.4.1. This makes it possible for authentic... Read more

    Affected Products : order_attachments_for_woocommerce
    • Published: Oct. 12, 2024
    • Modified: Nov. 25, 2024

  • 6.4

    MEDIUM
    CVE-2024-9704

    The Social Sharing (by Danny) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dvk_social_sharing' shortcode in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user ... Read more

    Affected Products : social_sharing
    • Published: Oct. 12, 2024
    • Modified: Nov. 25, 2024

  • 9.8

    CRITICAL
    CVE-2024-9047

    The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originall... Read more

    Affected Products : wordpress_file_upload
    • Published: Oct. 12, 2024
    • Modified: Mar. 12, 2025
Showing 20 of 294837 Results