Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 7.1

    CVSS31
    CVE-2024-49320

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dennis Hoppe Encyclopedia / Glossary / Wiki allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through 1.7.60.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 4.3

    CVSS31
    CVE-2024-48047

    Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through 1.0.5.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 7.6

    CVSS31
    CVE-2024-48043

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through 5.6.3.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 4.3

    CVSS31
    CVE-2024-48038

    Cross-Site Request Forgery (CSRF) vulnerability in Hans Matzen wp-Monalisa allows Cross Site Request Forgery.This issue affects wp-Monalisa: from n/a through 6.4.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 7.5

    CVSS31
    CVE-2024-48024

    : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through 2.0.7.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 6.4

    CVSS31
    CVE-2024-9898

    The Parallax Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dd-parallax shortcode in all versions up to, and including, 1.8 due to insufficient input sanitization and output escaping on user supplied attributes. T... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 5.1

    CVSS31
    CVE-2024-45713

    SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes.... Read more

    Affected Products : kiwi_cattools
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 7.8

    CVSS31
    CVE-2024-10068

    A vulnerability was found in OpenSight Software FlashFXP 5.4.0.3970. It has been classified as critical. Affected is an unknown function in the library libcrypto-1_1.dll of the file FlashFXP.exe. The manipulation leads to uncontrolled search path. An atta... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 7.2

    CVSS31
    CVE-2024-9184

    The SendPulse Free Web Push plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3.6 due to incorrect use of the wp_kses_allowed_html function. This makes it possible for unauthenticated attackers to in... Read more

    Affected Products : free_web_push
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 6.4

    CVSS31
    CVE-2024-8920

    The Fonto – Custom Web Fonts Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for ... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 5.7

    CVSS30
    CVE-2024-49392

    Stored cross-site scripting (XSS) vulnerability on enrollment invitation page. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 6.7

    CVSS30
    CVE-2024-49391

    Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 7.3

    CVSS30
    CVE-2024-49390

    Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 7.8

    CVSS30
    CVE-2024-49389

    Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 5.7

    CVSS30
    CVE-2024-49386

    Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24.... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 9.1

    CVSS31
    CVE-2024-10025

    A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has no... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 6.1

    CVSS31
    CVE-2024-9951

    The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output escaping. This makes it possible f... Read more

    Affected Products :
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 5.9

    CVSS31
    CVE-2024-3187

    This issue tracks two CWE-416 Use After Free (UAF) and one CWE-415 Double Free vulnerabilities in Goahead versions <= 6.0.0. These are caused by JST values not being nulled when freed during parsing of JST templates. If the ME_GOAHEAD_JAVASCRIPT flag is e... Read more

    Affected Products : goahead
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 5.3

    CVSS31
    CVE-2024-3186

    CWE-476 NULL Pointer Dereference vulnerability in the evalExpr() function of GoAhead Web Server (version <= 6.0.0) when compiled with the ME_GOAHEAD_JAVASCRIPT flag. This vulnerability allows a remote attacker with the privileges to modify JavaScript temp... Read more

    Affected Products : goahead
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024

  • 5.9

    CVSS31
    CVE-2024-3184

    Multiple CWE-476 NULL Pointer Dereference vulnerabilities were found in GoAhead Web Server up to version 6.0.0 when compiled with the ME_GOAHEAD_REPLACE_MALLOC flag. Without a memory notifier for allocation failures, remote attackers can exploit these vul... Read more

    Affected Products : goahead
    • Published: Oct. 17, 2024
    • Modified: Oct. 17, 2024
Showing 20 of 294 Results