Week 29, 2024

15–21 July 2024

New CVEs: 691
Critical: 67
High: 178
Newly exploited: 4
Advisories: 254
Malicious pkgs: 41

Newly exploited 4

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2024-34102 KEV Jul 17, 2024 XXE can expose crypt key and other secrets granting full admin access
Adobe · Adobe Commerce

EPSS 100%
High 8.6
CVE-2024-28995 KEV Jul 17, 2024 SolarWinds Serv-U L Directory Transversal Vulnerability
SolarWinds · SolarWinds Serv-U

EPSS 100%
Medium 6.5
CVE-2022-22948 KEV Jul 17, 2024 The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to th…
EPSS 13%
Critical 9.8
CVE-2024-36401 KEV Jul 15, 2024 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
geoserver · geoserver

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2024-20419 A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change th…
Cisco · Cisco Smart Software Manager On-Prem

EPSS 81%
Critical 9.8
CVE-2024-6220 简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload
zhengdon

EPSS 35%
Critical 9.8
CVE-2024-39907 a sqlinjection in 1Panel
1Panel-dev · 1Panel

EPSS 29%
Critical 9.8
CVE-2024-6457 HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection
RealMag777 · HUSKY – Products Filter Professional for WooCommerce

EPSS 20%
Critical 9.6
CVE-2024-23472 SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability
SolarWinds · Access Rights Manager

EPSS 19%
Critical 9.6
CVE-2024-23469 SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability
SolarWinds · Access Rights Manager

EPSS 18%
Critical 9.6
CVE-2024-28074 SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability
SolarWinds · Access Rights Manager

EPSS 11%
Critical 10.0
CVE-2024-39911 1Panel SQL injection
1Panel-dev · 1Panel

EPSS 4.5%
Critical 9.6
CVE-2024-23467 SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability
SolarWinds · Access Rights Manager

EPSS 2.9%
Critical 9.6
CVE-2024-23466 SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability
SolarWinds · Access Rights Manager

EPSS 2.5%
Critical 9.8
CVE-2024-20401 A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwri…
Cisco · Cisco Secure Email

EPSS 2.3%
Critical 9.6
CVE-2024-23475 SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability
SolarWinds · Access Rights Manager

EPSS 2.1%
Critical 9.8
CVE-2024-39962 D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router v21_D240126 was discovered to contain a remote code execution (RCE) vulnerability in the ntp_zone_val …
EPSS 2.1%
Critical 9.1
CVE-2024-40898 Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows
Apache Software Foundation · Apache HTTP Server

EPSS 1.6%
Critical 9.8
CVE-2024-40524 Directory Traversal vulnerability in xmind2testcase v.1.5 allows a remote attacker to execute arbitrary code via the webtool\application.py component.
EPSS 1.4%

All 67 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2024-21182 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1…
Oracle · WebLogic Server

EPSS 74%
Medium 5.4
CVE-2024-39123 Calibre-Web Cross Site Scripting (XSS)
EPSS 23%
High 8.1
CVE-2024-41107 Apache CloudStack: SAML Signature Exclusion
Apache Software Foundation · Apache CloudStack

EPSS 18%
High 8.8
CVE-2024-6497 SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter
cifi · SEO Plugin by Squirrly SEO

EPSS 11%
Medium 6.3
CVE-2024-6802 SourceCodester Computer Laboratory Management System Master.php sql injection
SourceCodester · Computer Laboratory Management System

EPSS 9.1%
High 8.2
CVE-2024-40348 An issue in the component /api/swaggerui/static of Bazaar v1.4.3 allows unauthenticated attackers to execute a directory traversal.
EPSS 8.2%
High 8.8
CVE-2024-6779 Out of bounds memory access in V8 in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML…
Google · Chrome

EPSS 6.3%
Medium 4.3
CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
Apache Software Foundation · Apache Superset

EPSS 4.7%

Advisories

USN-6893-2 linux-gke, linux-nvidia vulnerabilities 179 CVEs
SUSE-SU-2024:2561-1 Security update for the Linux Kernel 176 CVEs
USN-6898-3 linux-aws, linux-hwe-5.15 vulnerabilities 152 CVEs
USN-6898-2 linux-ibm-5.15, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-oracle-5.15 vulnerabilities 152 CVEs
USN-6898-1 linux, linux-gcp, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle vulnerabilities 152 CVEs
USN-6896-4 linux-raspi, linux-raspi-5.4 vulnerabilities 147 CVEs
USN-6896-3 linux-oracle, linux-xilinx-zynqmp vulnerabilities 147 CVEs
USN-6896-2 linux-hwe-5.4, linux-oracle-5.4 vulnerabilities 147 CVEs
DSA-5730-1 linux - security update 124 CVEs
USN-6900-1 linux-hwe-6.5 vulnerabilities 104 CVEs