| CVE-2024-38107 Known exploited | High 7.8 | Windows Power Dependency Coordinator Elevation of Privilege Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38106 Known exploited | High 7.0 | Windows Kernel Elevation of Privilege Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38213 Known exploited | Medium 6.5 | Windows Mark of the Web Security Feature Bypass Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38193 Known exploited | High 7.8 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-38178 Known exploited | High 7.5 | Scripting Engine Memory Corruption Vulnerability Assigned by microsoft | Aug 13, 2024 |
| CVE-2024-7694 Known exploited | High 7.2 | TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload Assigned by twcert | Aug 12, 2024 |
| CVE-2024-41710 Known exploited | Medium 6.8 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with admi… Assigned by mitre | Aug 12, 2024 |
| CVE-2024-27443 Known exploited | Medium 6.1 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. Assigned by mitre | Aug 12, 2024 |
| CVE-2024-7399 Known exploited | High 8.8 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. Assigned by samsung.tv_appliance | Aug 9, 2024 |
| CVE-2024-38856 Known exploited | High 8.1 | Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code Assigned by apache | Aug 5, 2024 |
| CVE-2024-42009 Known exploited | Critical 9.3 | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desani… Assigned by mitre | Aug 5, 2024 |
| CVE-2023-45249 Known exploited | Critical 9.8 | Remote command execution due to use of default passwords. Assigned by Acronis | Jul 24, 2024 |
| CVE-2024-21182 Known exploited | High 7.5 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Assigned by oracle | Jul 16, 2024 |
| CVE-2024-5910 Known exploited | Critical 9.3 | Expedition: Missing Authentication Leads to Admin Account Takeover Assigned by palo_alto | Jul 10, 2024 |
| CVE-2024-5217 Known exploited | Critical 9.8 | Incomplete Input Validation in GlideExpression Script Assigned by SN | Jul 10, 2024 |
| CVE-2024-4879 Known exploited | Critical 9.8 | Jelly Template Injection Vulnerability in ServiceNow UI Macros Assigned by SN | Jul 10, 2024 |
| CVE-2024-38094 Known exploited | High 7.2 | Microsoft SharePoint Remote Code Execution Vulnerability Assigned by microsoft | Jul 9, 2024 |
| CVE-2024-38112 Known exploited | High 7.5 | Windows MSHTML Platform Spoofing Vulnerability Assigned by microsoft | Jul 9, 2024 |
| CVE-2024-38080 Known exploited | High 7.8 | Windows Hyper-V Elevation of Privilege Vulnerability Assigned by microsoft | Jul 9, 2024 |
| CVE-2024-39891 Known exploited | Medium 5.3 | In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in Jun… Assigned by mitre | Jul 2, 2024 |
| CVE-2024-38475 Known exploited | Critical 9.1 | Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. Assigned by apache | Jul 1, 2024 |
| CVE-2024-20399 Known exploited | Medium 6.0 | Cisco NX-OS Software CLI Command Injection Vulnerability Assigned by cisco | Jul 1, 2024 |
| CVE-2024-36401 Known exploited | Critical 9.8 | Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver Assigned by GitHub_M | Jul 1, 2024 |
| CVE-2024-4885 Known exploited | Critical 9.8 | WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability Assigned by ProgressSoftware | Jun 25, 2024 |
| CVE-2024-37085 Known exploited | Medium 6.8 | VMware ESXi contains an authentication bypass vulnerability. Assigned by vmware | Jun 25, 2024 |
| CVE-2024-37079 Known exploited | Critical 9.8 | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. Assigned by vmware | Jun 18, 2024 |
| CVE-2024-6047 Known exploited | Critical 9.8 | GeoVision EOL device - OS Command Injection Assigned by twcert | Jun 17, 2024 |
| CVE-2024-32896 Known exploited | High 8.1 | there is a possible way to bypass due to a logic error in the code. Assigned by Google_Devices | Jun 13, 2024 |
| CVE-2024-34102 Known exploited | Critical 9.8 | XXE can expose crypt key and other secrets granting full admin access Assigned by adobe | Jun 13, 2024 |
| CVE-2024-30088 Known exploited | High 7.0 | Windows Kernel Elevation of Privilege Vulnerability Assigned by microsoft | Jun 11, 2024 |
| CVE-2024-35250 Known exploited | High 7.8 | Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Assigned by microsoft | Jun 11, 2024 |
| CVE-2024-36971 Known exploited | High 7.8 | net: fix __dst_negative_advice() race Assigned by Linux | Jun 10, 2024 |
| CVE-2024-4577 Known exploited | Critical 9.8 | Argument Injection in PHP-CGI Assigned by php | Jun 9, 2024 |
| CVE-2024-4610 Known exploited | High 7.4 | Mali GPU Kernel Driver allows improper GPU memory processing operations Assigned by Arm | Jun 7, 2024 |
| CVE-2024-37383 Known exploited | Medium 6.1 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. Assigned by mitre | Jun 7, 2024 |
| CVE-2024-28995 Known exploited | High 8.6 | SolarWinds Serv-U L Directory Transversal Vulnerability Assigned by SolarWinds | Jun 6, 2024 |
| CVE-2024-29824 Known exploited | Critical 9.6 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. Assigned by hackerone | May 31, 2024 |
| CVE-2024-23692 Known exploited | Critical 9.8 | Rejetto HTTP File Server 2.3m Unauthenticated RCE Assigned by VulnCheck | May 31, 2024 |
| CVE-2024-4358 Known exploited | Critical 9.8 | Registration Authentication Bypass Vulnerability Assigned by ProgressSoftware | May 29, 2024 |
| CVE-2024-24919 Known exploited | High 8.6 | Information disclosure Assigned by checkpoint | May 28, 2024 |
| CVE-2024-5274 Known exploited | High 8.3 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome | May 28, 2024 |
| CVE-2024-4978 Known exploited | High 8.4 | Malicious Code in Justice AV Solutions (JAVS) Viewer Assigned by cisa-cg | May 23, 2024 |
| CVE-2024-4947 Known exploited | Critical 9.6 | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Assigned by Chrome | May 15, 2024 |
| CVE-2024-30051 Known exploited | High 7.8 | Windows DWM Core Library Elevation of Privilege Vulnerability Assigned by microsoft | May 14, 2024 |
| CVE-2024-30040 Known exploited | High 8.8 | Windows MSHTML Platform Security Feature Bypass Vulnerability Assigned by microsoft | May 14, 2024 |
| CVE-2024-4761 Known exploited | High 8.3 | Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Assigned by Chrome | May 14, 2024 |
| CVE-2024-4671 Known exploited | Critical 9.6 | Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Assigned by Chrome | May 9, 2024 |
| CVE-2024-32113 Known exploited | Critical 9.1 | Apache OFBiz: Path traversal leading to RCE Assigned by apache | May 8, 2024 |
| CVE-2023-50224 Known exploited | Medium 6.5 | TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability Assigned by zdi | May 3, 2024 |
| CVE-2024-20359 Known exploited | Medium 6.0 | A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower… Assigned by cisco | Apr 24, 2024 |
