| CVE-2024-4671 Known exploited | Critical 9.6 | Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome | May 9, 2024 |
| CVE-2024-4761 Known exploited | High 8.3 | Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Assigned by Chrome | May 14, 2024 |
| CVE-2024-30040 Known exploited | High 8.8 | Windows MSHTML Platform Security Feature Bypass Vulnerability Assigned by microsoft | May 14, 2024 |
| CVE-2024-30051 Known exploited | High 7.8 | Windows DWM Core Library Elevation of Privilege Vulnerability Assigned by microsoft | May 14, 2024 |
| CVE-2024-4947 Known exploited | Critical 9.6 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome | May 15, 2024 |
| CVE-2024-4978 Known exploited | High 8.4 | Malicious Code in Justice AV Solutions (JAVS) Viewer Assigned by cisa-cg | May 23, 2024 |
| CVE-2024-5274 Known exploited | High 8.3 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome | May 28, 2024 |
| CVE-2024-24919 Known exploited | High 8.6 | Information disclosure Assigned by checkpoint | May 28, 2024 |
| CVE-2024-4358 Known exploited | Critical 9.8 | Registration Authentication Bypass Vulnerability Assigned by ProgressSoftware | May 29, 2024 |
| CVE-2024-23692 Known exploited | Critical 9.8 | Rejetto HTTP File Server 2.3m Unauthenticated RCE Assigned by VulnCheck | May 31, 2024 |
| CVE-2024-29824 Known exploited | Critical 9.6 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Assigned by hackerone | May 31, 2024 |
| CVE-2024-28995 Known exploited | High 8.6 | SolarWinds Serv-U L Directory Transversal Vulnerability Assigned by SolarWinds | Jun 6, 2024 |
| CVE-2024-37383 Known exploited | Medium 6.1 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. Assigned by mitre | Jun 7, 2024 |
| CVE-2024-4610 Known exploited | High 7.4 | Mali GPU Kernel Driver allows improper GPU memory processing operations Assigned by Arm | Jun 7, 2024 |
| CVE-2024-4577 Known exploited | Critical 9.8 | Argument Injection in PHP-CGI Assigned by php | Jun 9, 2024 |
| CVE-2024-36971 Known exploited | High 7.8 | net: fix __dst_negative_advice() race Assigned by Linux | Jun 10, 2024 |
| CVE-2024-35250 Known exploited | High 7.8 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Assigned by microsoft | Jun 11, 2024 |
| CVE-2024-30088 Known exploited | High 7.0 | Windows Kernel Elevation of Privilege Vulnerability Assigned by microsoft | Jun 11, 2024 |
| CVE-2024-34102 Known exploited | Critical 9.8 | XXE can expose crypt key and other secrets granting full admin access Assigned by adobe | Jun 13, 2024 |
| CVE-2024-32896 Known exploited | High 8.1 | there is a possible way to bypass due to a logic error in the code. Assigned by Google_Devices | Jun 13, 2024 |
| CVE-2024-6047 Known exploited | Critical 9.8 | GeoVision EOL device - OS Command Injection Assigned by twcert | Jun 17, 2024 |
| CVE-2024-37079 Known exploited | Critical 9.8 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. Assigned by vmware | Jun 18, 2024 |
| CVE-2024-37085 Known exploited | Medium 6.8 | VMware ESXi contains an authentication bypass vulnerability. Assigned by vmware | Jun 25, 2024 |
| CVE-2024-4885 Known exploited | Critical 9.8 | WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability Assigned by ProgressSoftware | Jun 25, 2024 |
| CVE-2024-36401 Known exploited | Critical 9.8 | Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver Assigned by GitHub_M | Jul 1, 2024 |
| CVE-2024-20399 Known exploited | Medium 6.0 | Cisco NX-OS Software CLI Command Injection Vulnerability Assigned by cisco | Jul 1, 2024 |
| CVE-2024-38475 Known exploited | Critical 9.1 | Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. Assigned by apache | Jul 1, 2024 |
| CVE-2024-39891 Known exploited | Medium 5.3 | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in Jun… Assigned by mitre | Jul 2, 2024 |
| CVE-2024-38080 Known exploited | High 7.8 | Windows Hyper-V Elevation of Privilege Vulnerability Assigned by microsoft | Jul 9, 2024 |
| CVE-2024-38112 Known exploited | High 7.5 | Windows MSHTML Platform Spoofing Vulnerability Assigned by microsoft | Jul 9, 2024 |
| CVE-2024-38094 Known exploited | High 7.2 | Microsoft SharePoint Remote Code Execution Vulnerability Assigned by microsoft | Jul 9, 2024 |
| CVE-2024-4879 Known exploited | Critical 9.8 | Jelly Template Injection Vulnerability in ServiceNow UI Macros Assigned by SN | Jul 10, 2024 |
| CVE-2024-5217 Known exploited | Critical 9.8 | Incomplete Input Validation in GlideExpression Script Assigned by SN | Jul 10, 2024 |
| CVE-2024-5910 Known exploited | Critical 9.3 | Expedition: Missing Authentication Leads to Admin Account Takeover Assigned by palo_alto | Jul 10, 2024 |
| CVE-2024-21182 Known exploited | High 7.5 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Assigned by oracle | Jul 16, 2024 |
| CVE-2023-45249 Known exploited | Critical 9.8 | Remote command execution due to use of default passwords. Assigned by Acronis | Jul 24, 2024 |
| CVE-2024-42009 Known exploited | Critical 9.3 | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desani… Assigned by mitre | Aug 5, 2024 |
| CVE-2024-38856 Known exploited | High 8.1 | Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code Assigned by apache | Aug 5, 2024 |
| CVE-2024-7399 Known exploited | High 8.8 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. Assigned by samsung.tv_appliance | Aug 9, 2024 |
| CVE-2024-41710 Known exploited | Medium 6.8 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with admi… Assigned by mitre | Aug 12, 2024 |
| CVE-2024-27443 Known exploited | Medium 6.1 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Assigned by mitre | Aug 12, 2024 |
| CVE-2024-7694 Known exploited | High 7.2 | TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload Assigned by twcert | Aug 12, 2024 |
| CVE-2024-38178 Known exploited | High 7.5 | Scripting Engine Memory Corruption Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38193 Known exploited | High 7.8 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38213 Known exploited | Medium 6.5 | Windows Mark of the Web Security Feature Bypass Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38106 Known exploited | High 7.0 | Windows Kernel Elevation of Privilege Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38107 Known exploited | High 7.8 | Windows Power Dependency Coordinator Elevation of Privilege Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38189 Known exploited | High 8.8 | Microsoft Project Remote Code Execution Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-7593 Known exploited | Critical 9.8 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. Assigned by ivanti | Aug 13, 2024 |
| CVE-2024-28986 Known exploited | Critical 9.8 | SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability Assigned by SolarWinds | Aug 13, 2024 |
