Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-36315 | not reported | — | No | Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sens... | 2026-10-27 |
| CVE-2024-43384 | high | 8.0 | No | A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. | 2026-10-27 |
| CVE-2024-13362 | medium | 6.1 | No | Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due... | 2026-10-27 |
| CVE-2024-7083 | low | 3.5 | No | The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, which could allow high privilege users su... | 2026-10-27 |
| CVE-2024-27480 | critical | 9.8 | No | givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. | 2026-10-27 |
| CVE-2024-25183 | high | 7.5 | No | givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. | 2026-10-27 |
| CVE-2024-25182 | critical | 9.8 | No | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. | 2026-10-27 |
| CVE-2024-30855 | high | 8.8 | No | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php. | 2026-10-27 |
| CVE-2024-25181 | critical | 9.1 | No | A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary fil... | 2026-10-27 |
| CVE-2024-44065 | critical | 9.8 | No | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults paramet... | 2026-10-27 |
| CVE-2024-42718 | medium | 6.5 | No | A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files via a specially crafted path in the 'edit... | 2026-10-27 |
| CVE-2024-29720 | medium | 5.5 | No | An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local attacker to obtain sensitive information via the adopt component... | 2026-10-27 |
| CVE-2024-39037 | medium | 6.5 | No | MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter. | 2026-10-27 |
| CVE-2024-35322 | medium | 6.1 | No | MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the ficheiro parameter. | 2026-10-27 |
| CVE-2024-57521 | critical | 10.0 | No | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in S... | 2026-10-27 |
| CVE-2024-9684 | high | 7.5 | No | FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a denial of service by sending specific message sequences. | 2026-10-27 |
| CVE-2024-24844 | high | 7.5 | No | Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Elementor allows Exploiting Incorrectly Configured Access Control... | 2026-10-27 |
| CVE-2024-35321 | medium | 4.3 | No | MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter. | 2026-10-27 |
| CVE-2024-25814 | medium | 6.1 | No | MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msg parameter. | 2026-10-27 |
| CVE-2024-46062 | high | 7.8 | No | Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home direc... | 2026-10-27 |