Week 19, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.1
  CVE-2024-32113 Apache OFBiz: Path traversal leading to RCE

  Apache Software Foundation · Apache OFBiz

  EPSS 100%
• Critical 9.0
  CVE-2024-28075 SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution

  SolarWinds · Access Rights Manager

  EPSS 78%
• Critical 9.0
  CVE-2024-32964 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

  lobehub · lobe-chat

  EPSS 53%
• Critical 9.8
  CVE-2024-4434 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection

  ThimPress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

  EPSS 37%
• Critical 9.8
  CVE-2024-4548 Delta Electronics DIAEnergie SQL Injection

  Delta Electronics · DIAEnergie

  EPSS 29%
• Critical 9.7
  CVE-2024-34359 llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata

  abetlen · llama-cpp-python

  EPSS 26%
• Critical 9.9
  CVE-2024-4701 Path Traversal vulnerability via File Uploads in Genie

  Netflix · Genie

  EPSS 25%
• Critical 9.0
  CVE-2024-0087 CVE

  NVIDIA · NVIDIA Triton Inference Server

  EPSS 20%
• Critical 9.6
  CVE-2024-4671 Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a …

  Google · Chrome

  EPSS 8.3%
• Critical 9.8
  CVE-2024-32735 CyberPower PowerPanel Enterprise Missing Authentication

  CyberPower · CyberPower PowerPanel Enterprise

  EPSS 6.8%
• Critical 9.8
  CVE-2024-34257 TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowin…
  EPSS 3.8%
• Critical 9.8
  CVE-2024-3806 Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts

  p-themes · Porto

  EPSS 2.7%
• Critical 9.8
  CVE-2024-27280 StringIO buffer overread vulnerability
  EPSS 2.4%
• Critical 9.8
  CVE-2024-34204 TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName par…
  EPSS 1.9%
• Critical 9.8
  CVE-2024-4547 Delta Electronics DIAEnergie Unauthenticated SQL Injection

  Delta Electronics · DIAEnergie

  EPSS 1.9%

All 87 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.1
  CVE-2024-29889 GLPI contains an SQL injection through the saved searches

  GLPI · glpi

  EPSS 65%
• High 7.7
  CVE-2024-31456 GLPI contains an authenticated SQL injection

  GLPI · glpi

  EPSS 59%
• Medium 6.5
  CVE-2024-2454 Allocation of Resources Without Limits or Throttling in GitLab

  GitLab · GitLab

  EPSS 33%
• Medium 6.5
  CVE-2024-2651 Inefficient Regular Expression Complexity in GitLab

  GitLab · GitLab

  EPSS 33%
• High 8.6
  CVE-2024-34219 TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.
  EPSS 21%
• Medium 5.5
  CVE-2024-0088 CVE

  NVIDIA · NVIDIA Triton Inference Server

  EPSS 19%
• Low 3.8
  CVE-2024-34218 TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime …
  EPSS 18%
• High 7.8
  CVE-2024-4044 Deserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudio

  NI · InstrumentStudio · FlexLogger

  EPSS 15%