Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 5.4

    MEDIUM
    CVE-2024-39418

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass securi... Read more

    Affected Products : commerce magento
    • Published: Aug. 14, 2024
    • Modified: Aug. 14, 2024

  • 4.3

    MEDIUM
    CVE-2024-39419

    Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass securi... Read more

    Affected Products : commerce magento
    • Published: Aug. 14, 2024
    • Modified: Aug. 14, 2024

  • 5.5

    MEDIUM
    CVE-2024-42258

    In the Linux kernel, the following vulnerability has been resolved: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines Yves-Alexis Perez reported commit 4ef9ad19e176 ("mm: huge_memory: don't force huge page alignment on 3... Read more

    Affected Products : linux_kernel
    • Published: Aug. 12, 2024
    • Modified: Aug. 14, 2024

  • 6.4

    MEDIUM
    CVE-2024-7588

    The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Accordion block in all versions up to, and including, 2.2.87 due to insufficient input sanitization and output escaping on ... Read more

    Affected Products : comboblocks
    • Published: Aug. 14, 2024
    • Modified: Aug. 14, 2024

  • 8.8

    HIGH
    CVE-2024-4389

    The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated at... Read more

    Affected Products : depicter
    • Published: Aug. 14, 2024
    • Modified: Aug. 14, 2024

  • 6.4

    MEDIUM
    CVE-2024-6532

    The Sheet to Table Live Sync for Google Sheet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STWT_Sheet_Table shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escap... Read more

    Affected Products :
    • Published: Aug. 14, 2024
    • Modified: Aug. 14, 2024

  • 7.2

    HIGH
    CVE-2024-7728

    The specific CGI of the CAYIN Technology CMS does not properly validate user input, allowing a remote attacker with administrator privileges to inject OS commands into the specific parameter and execute them on the remote server.... Read more

    Affected Products :
    • Published: Aug. 14, 2024
    • Modified: Aug. 14, 2024

  • 7.5

    HIGH
    CVE-2024-7729

    The CAYIN Technology CMS lacks proper access control, allowing unauthenticated remote attackers to download arbitrary CGI files.... Read more

    Affected Products :
    • Published: Aug. 14, 2024
    • Modified: Aug. 14, 2024

  • 5.4

    MEDIUM
    CVE-2024-6079

    A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application loads shared libraries, which are readable and writable by any user. If exploited, a malicious user could leverage a ... Read more

    Affected Products :
    • Published: Aug. 13, 2024
    • Modified: Aug. 14, 2024

  • 8.5

    HIGH
    CVE-2024-6618

    In Ocean Data Systems Dream Report, a path traversal vulnerability could allow an attacker to perform remote code execution through the injection of a malicious dynamic-link library (DLL).... Read more

    Affected Products :
    • Published: Aug. 13, 2024
    • Modified: Aug. 14, 2024

  • 8.7

    HIGH
    CVE-2024-7113

    If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack.... Read more

    Affected Products : batch_management historian intouch
    • Published: Aug. 13, 2024
    • Modified: Aug. 14, 2024

  • 8.5

    HIGH
    CVE-2024-6619

    In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service.... Read more

    Affected Products :
    • Published: Aug. 13, 2024
    • Modified: Aug. 14, 2024

  • 7.4

    HIGH
    CVE-2024-37015

    An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish connections to external services is done without proper hostname validation. This is exploitable by man-in-the-mid... Read more

    Affected Products :
    • Published: Aug. 13, 2024
    • Modified: Aug. 14, 2024

  • 6.5

    MEDIUM
    CVE-2024-42368

    OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. The bearertokenauth extension's server authenticator perf... Read more

    Affected Products :
    • Published: Aug. 13, 2024
    • Modified: Aug. 14, 2024

  • 6.9

    MEDIUM
    CVE-2024-7567

    A denial-of-service vulnerability exists via the CIP/Modbus port in the Rockwell Automation Micro850/870 (2080 -L50E/2080 -L70E). If exploited, the CIP/Modbus communication may be disrupted for short duration.... Read more

    Affected Products : micro850_firmware micro870_firmware
    • Published: Aug. 13, 2024
    • Modified: Aug. 14, 2024

  • 8.5

    HIGH
    CVE-2024-38206

    An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.... Read more

    Affected Products : copilot_studio
    • Published: Aug. 06, 2024
    • Modified: Aug. 14, 2024

  • 8.2

    HIGH
    CVE-2024-38166

    An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link.... Read more

    • Published: Aug. 06, 2024
    • Modified: Aug. 14, 2024

  • 8.8

    HIGH
    CVE-2024-39091

    An OS command injection vulnerability in the ccm_debug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request.... Read more

    Affected Products : crater_2_firmware crater_2
    • Published: Aug. 12, 2024
    • Modified: Aug. 13, 2024

  • 9.9

    CRITICAL
    CVE-2024-6684

    Authentication Bypass Using an Alternate Path or Channel vulnerability in GST Electronics inohom Nova Panel N7 allows Authentication Bypass.This issue affects inohom Nova Panel N7: through 1.9.9.6. NOTE: The vendor was contacted and it was learned that th... Read more

    Affected Products :
    • Published: Aug. 12, 2024
    • Modified: Aug. 13, 2024

  • 8.8

    HIGH
    CVE-2024-42742

    In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands.... Read more

    Affected Products : x5000r_firmware x5000r
    • Published: Aug. 12, 2024
    • Modified: Aug. 13, 2024
Showing 20 of 290006 Results