Skip to content
OpenAdvisories

Archive

16 April 2024

Vulnerabilities first published on this day (UTC), newest first.

← March 2024 2024 / April /16 May 2024 →
  1. 1103
  2. 2173
  3. 3232
  4. 4139
  5. 5102
  6. 640
  7. 762
  8. 8119
  9. 9387
  10. 10218
  11. 1181
  12. 12128
  13. 1316
  14. 1414
  15. 15221
  16. 16243
  17. 17298
  18. 18124
  19. 19115
  20. 206
  21. 215
  22. 2281
  23. 2364
  24. 24131
  25. 2595
  26. 26138
  27. 2727
  28. 2844
  29. 29150
  30. 3074
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.8
    CVE-2024-21111 Public exploit

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…

    Oracle VM VirtualBox virtualbox Virtualization Ubuntu
  • Medium 6.7
    CVE-2024-21107 Public exploit

    Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that a…

    Oracle VM VirtualBox virtualbox Virtualization Ubuntu
  • High 7.5
    CVE-2024-21006 Public exploit

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
  • Critical 9.8
    CVE-2024-3660 Public exploit

    Arbitrary code injection vulnerability in Keras framework < 2.13

    A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

    TensorFlow keras keras keras Debian Ubuntu Azure Linux PyPI
  • High 8.3
    CVE-2023-40000 Public exploit Scanner template EPSS 55%

    WordPress LiteSpeed Cache plugin <= 5.7 - Unauthenticated Site Wide Stored XSS vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7.

    LiteSpeed Technologies LiteSpeed Cache
  • Critical 9.1
    CVE-2024-32022 Public exploit

    Kohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019)

    Kohya_ss is a GUI for Kohya's Stable Diffusion trainers. Kohya_ss is vulnerable to command injection in basic_caption_gui.py. This vulnerability is fixed in 23.1.5.

    bmaltais kohya_ss
  • Medium 6.1
    CVE-2024-3867 Public exploit

    Tainacan Interface <= 2.7.2 - Reflected Cross-Site Scripting

    The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in version 2.7.2. This makes it possible for unauthenticated attackers to inject arbitr…

    Tainacan.org Tainacan Interface Web / CMS
  • High 8.1
    CVE-2024-22262 Public exploit

    CVE-2024-22262: Spring Framework URL Parsing with Host Validation

    Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html  a…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • High 7.5
    CVE-2024-1561 Public exploit Scanner template

    Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

    An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` met…

    gradio-app gradio-app/gradio gradio PyPI
  • Critical 9.9
    CVE-2024-2083 Public exploit EPSS 37%

    Directory Traversal in zenml-io/zenml

    A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing…

    zenml-io zenml-io/zenml zenml PyPI
  • Unscored —
    CVE-2024-29291 Public exploit

    An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/lo…

  • High 8.8
    CVE-2024-31680 Public exploit

    File Upload vulnerability in Shibang Communications Co., Ltd. IP network intercom broadcasting system v.1.0 allows a lo…