Week 46, 2024

11–17 November 2024

New CVEs: 1,114
Critical: 124
High: 409
Newly exploited: 7
Advisories: 616
Malicious pkgs: 202

Newly exploited 7

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.9
CVE-2024-9463 KEV Nov 14, 2024 Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
Palo Alto Networks · Expedition

EPSS 99%
Critical 9.2
CVE-2024-9465 KEV Nov 14, 2024 Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
Palo Alto Networks · Expedition

EPSS 100%
Critical 10.0
CVE-2021-41277 KEV Nov 12, 2024 GeoJSON URL validation can expose server files and environment variables to unauthorized users
metabase · metabase

EPSS 97%
High 8.8
CVE-2024-49039 KEV Nov 12, 2024 · ransomware Windows Task Scheduler Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 14%
Medium 6.5
CVE-2024-43451 KEV Nov 12, 2024 NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 84%
Medium 5.4
CVE-2014-2120 KEV Nov 12, 2024 Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitra…
EPSS 23%
Medium 5.3
CVE-2021-26086 KEV Nov 12, 2024 Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerability in the /WEB-INF/w…
Atlassian · Jira Server · Jira Data Center

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2024-8856 Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload
revmakx · Backup and Staging by WP Time Capsule

EPSS 94%
Critical 9.8
CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
Really Simple Plugins · rogierlankhorst · Really Simple Security Pro · Really Simple Security Pro multisite

EPSS 82%
Critical 9.8
CVE-2024-50330 SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to …
ivanti · Endpoint Manager

EPSS 40%
Critical 9.8
CVE-2024-10443 Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before…
Synology · Synology Photos · BeePhotos

EPSS 29%
Critical 9.8
CVE-2024-11120 GeoVision EOL devices - OS Command Injection
GeoVision · GVLX 4 V3 · GVLX 4 V2 · GV-VS11

EPSS 28%
Critical 9.9
CVE-2023-20036 Cisco Industrial Network Director Command Injection Vulnerability
Cisco · Cisco Industrial Network Director

EPSS 14%
Critical 9.8
CVE-2024-43639 Windows KDC Proxy Remote Code Execution Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

EPSS 8.9%
Critical 9.8
CVE-2024-50667 The boa httpd of Trendnet TEW-820AP 1.01.B01 has a stack overflow vulnerability in /boafrm/formIPv6Addr, /boafrm/formIpv6Setup, /boafrm/formDnsv6. The reason i…
EPSS 6.7%
Critical 9.8
CVE-2024-10571 Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source
Ays Pro · Chartify – WordPress Chart Plugin

EPSS 4.8%
Critical 9.8
CVE-2024-43498 .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft · Microsoft Visual Studio 2022 version 17.6 · Microsoft Visual Studio 2022 version 17.8 · Microsoft Visual Studio 2022 version 17.10

EPSS 3.6%
Critical 9.8
CVE-2024-4741 Use After Free with SSL_free_buffers
OpenSSL · OpenSSL

EPSS 3.3%
Critical 9.8
CVE-2024-49369 Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections
Icinga · icinga2

EPSS 2.9%
Critical 9.8
CVE-2024-4343 Python Command Injection in imartinez/privategpt
imartinez · imartinez/privategpt

EPSS 2.7%
Critical 9.9
CVE-2024-43602 Azure CycleCloud Remote Code Execution Vulnerability
Microsoft · Azure CycleCloud 8.2.0 · Azure CycleCloud 8.0.0 · Azure CycleCloud 8.6.0

EPSS 2.3%
Critical 9.1
CVE-2024-48510 DotNetZip Directory Traversal vulnerability
EPSS 2%

All 124 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 6.5
CVE-2024-43451 NTLM Hash Disclosure Spoofing Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 84%
High 7.5
CVE-2024-49754 LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php
librenms · librenms

EPSS 74%
High 7.2
CVE-2024-34781 SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with …
ivanti · EPM

EPSS 68%
High 7.5
CVE-2024-43642 Windows SMB Denial of Service Vulnerability
Microsoft · Windows Server 2022 · Windows Server 2025 · Windows Server 2025 (Server Core installation)

EPSS 63%
High 8.7
CVE-2024-52301 Laravel allows environment manipulation via query string
laravel · framework

EPSS 45%
Medium 4.8
CVE-2024-50352 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php
librenms · librenms

EPSS 41%
High 7.5
CVE-2024-50320 An infinite loop in Ivanti Avalanche before 6.4.6 allows a remote unauthenticated attacker to cause a denial of service.
ivanti · Avalanche

EPSS 40%
High 8.8
CVE-2024-10728 PostX <= 4.1.16 - Missing Authorization to Arbitrary Plugin Installation/Activation
wpxpo · Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX

EPSS 39%

Advisories

RHSA-2024:9315 Red Hat Security Advisory: kernel security update 594 CVEs
openSUSE-SU-2024:14500-1 kernel-devel-6.11.8-1.1 on GA media 486 CVEs
SUSE-SU-2024:3984-1 Security update for the Linux Kernel 282 CVEs
SUSE-SU-2024:3986-1 Security update for the Linux Kernel 268 CVEs
USN-7100-2 linux-aws vulnerabilities 223 CVEs
USN-7100-1 linux, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi, linux-xilinx-zynqmp vulnerabilities 223 CVEs
SUSE-SU-2024:3985-1 Security update for the Linux Kernel 211 CVEs
SUSE-SU-2024:3983-1 Security update for the Linux Kernel 204 CVEs
USN-7089-6 linux-gke vulnerabilities 196 CVEs
USN-7089-5 linux-raspi vulnerabilities 196 CVEs