Week 44, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2024-51378 getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arb…
  EPSS 95%
• Critical 10.0
  CVE-2024-51567 upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary …
  EPSS 84%
• Critical 10.0
  CVE-2024-50498 WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

  Ajit Bohra · WP Query Console

  EPSS 53%
• Critical 9.8
  CVE-2024-48307 JeecgBoot SQL Injection vulnerability
  EPSS 50%
• Critical 10.0
  CVE-2024-51568 CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upl…
  EPSS 48%
• Critical 10.0
  CVE-2024-51482 Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64

  ZoneMinder · zoneminder

  EPSS 37%
• Critical 9.1
  CVE-2024-5982 Path Traversal in gaizhenbiao/chuanhuchatgpt

  gaizhenbiao · gaizhenbiao/chuanhuchatgpt

  EPSS 31%
• Critical 9.8
  CVE-2024-10456 Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data

  Delta Electronics · InfraSuite Device Master

  EPSS 18%
• Critical 9.8
  CVE-2024-39205 pyload-ng vulnerable to RCE with js2py sandbox escape
  EPSS 17%
• Critical 9.8
  CVE-2024-10392 AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload

  senols · AI Puffer – Your AI engine for WordPress (formerly AI Power)

  EPSS 15%
• Critical 9.9
  CVE-2024-33699 The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and…

  LevelOne · WBR-6012

  EPSS 11%
• Critical 9.8
  CVE-2024-50477 WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

  Stacks · Stacks Mobile App Builder

  EPSS 8.1%
• Critical 9.8
  CVE-2024-9989 Crypto <= 2.18 - Authentication Bypass via log_in

  odude · Crypto Tool

  EPSS 7.1%
• Critical 9.8
  CVE-2024-50483 WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability

  Tareq Hasan · Meetup

  EPSS 2.3%
• Critical 9.8
  CVE-2024-48359 Qualitor v8.24 was discovered to contain a remote code execution (RCE) vulnerability via the gridValoresPopHidden parameter.
  EPSS 2.3%

All 86 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.2
  CVE-2024-10525 Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback

  Eclipse Foundation · Mosquitto

  EPSS 59%
• High 7.5
  CVE-2024-45802 Squid Denial of Service

  squid-cache · squid

  EPSS 48%
• Medium 5.3
  CVE-2024-43919 WordPress Yet Another Related Posts Plugin (YARPP) plugin <= 5.30.10 - Broken Access Control vulnerability

  YARPP · YARPP

  EPSS 45%
• Medium 6.3
  CVE-2024-10697 Tenda AC6 API Endpoint WriteFacMac formWriteFacMac command injection

  Tenda · AC6

  EPSS 26%
• Medium 5.3
  CVE-2024-31152 The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series of crafted HTTP req…

  LevelOne · WBR-6012

  EPSS 18%
• Medium 4.9
  CVE-2024-8309 SQL Injection in langchain-ai/langchain

  langchain-ai · langchain-ai/langchain

  EPSS 14%
• Low 3.7
  CVE-2024-33623 A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request can lead to a rebo…

  LevelOne · WBR-6012

  EPSS 12%
• Medium 6.5
  CVE-2024-44236 An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1…

  Apple · macOS

  EPSS 11%