Week 20, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2024-29895 Cacti command injection in cmd_realtime.php

  Cacti · cacti

  EPSS 99%
• Critical 9.1
  CVE-2024-25641 Cacti RCE vulnerability when importing packages

  Cacti · cacti

  EPSS 86%
• Critical 9.1
  CVE-2024-22120 Time Based SQL Injection in Zabbix Server Audit Log

  Zabbix · Zabbix

  EPSS 77%
• Critical 9.3
  CVE-2024-27954 WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability

  WP Automatic · Automatic

  EPSS 73%
• Critical 9.7
  CVE-2024-34716 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload

  PrestaShop · PrestaShop

  EPSS 59%
• Critical 10.0
  CVE-2024-22476 Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation o…
  EPSS 36%
• Critical 9.1
  CVE-2024-32002 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

  git · git

  EPSS 29%
• Critical 9.6
  CVE-2024-4947 Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr…

  Google · Chrome

  EPSS 15%
• Critical 9.4
  CVE-2024-4999 Ligowave Unity/Pro/Mimo/APC Arbitrary Command Injection

  Ligowave · UNITY · MIMO · PRO

  EPSS 12%
• Critical 9.8
  CVE-2024-34982 An arbitrary file upload vulnerability in the component /include/file.php of lylme_spage v1.9.5 allows attackers to execute arbitrary code via uploading a craf…
  EPSS 4.7%
• Critical 9.8
  CVE-2023-37999 WordPress HT Mega Absolute Addons for Elementor plugin <= 2.2.0 - Unauthenticated Privilege Escalation vulnerability

  HasThemes · HT Mega

  EPSS 3.3%
• Critical 9.8
  CVE-2024-2771 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privileg…

  techjewel · Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

  EPSS 2.9%
• Critical 9.8
  CVE-2023-26540 WordPress Houzez theme <= 2.7.1 - Privilege Escalation

  Fave Themes · Houzez

  EPSS 2.7%
• Critical 9.8
  CVE-2023-26009 WordPress Houzez Login Register plugin <= 2.6.3 - Privilege Escalation

  Fave Themes · Houzez Login Register

  EPSS 2.7%
• Critical 10.0
  CVE-2024-32700 WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability

  kognetiks · Kognetiks Chatbot for WordPress

  EPSS 2.6%

All 138 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.2
  CVE-2024-30044 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 81%
• Medium 5.6
  CVE-2024-4367 PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

  Mozilla · Firefox · Thunderbird · Firefox ESR

  EPSS 71%
• Medium 6.5
  CVE-2024-30043 Microsoft SharePoint Server Information Disclosure Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 56%
• High 7.5
  CVE-2024-3848 Path Traversal Bypass in mlflow/mlflow

  MLflow · mlflow/mlflow

  EPSS 43%
• High 7.5
  CVE-2024-4322 Path Traversal in parisneo/lollms-webui

  parisneo · parisneo/lollms-webui

  EPSS 31%
• High 8.8
  CVE-2024-31445 SQL Injection vulnerability in automation_get_new_graphs_sql

  Cacti · cacti

  EPSS 26%
• High 7.5
  CVE-2024-4956 Nexus Repository 3 - Path Traversal

  Sonatype · Nexus Repository

  EPSS 19%
• High 7.5
  CVE-2024-31142 x86: Incorrect logic for BTC/SRSO mitigations

  Xen · Xen

  EPSS 17%