| CVE-2024-21287 Known exploited | High 7.5 | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). Assigned by oracle | Nov 18, 2024 |
| CVE-2024-9474 Known exploited | Medium 6.9 | PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface Assigned by palo_alto | Nov 18, 2024 |
| CVE-2024-0012 Known exploited | Critical 9.3 | PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) Assigned by palo_alto | Nov 18, 2024 |
| CVE-2024-11182 Known exploited | Medium 5.3 | Stored XSS vulnerability in MDaemon Email Server Assigned by ESET | Nov 15, 2024 |
| CVE-2024-11120 Known exploited | Critical 9.8 | GeoVision EOL devices - OS Command Injection Assigned by twcert | Nov 15, 2024 |
| CVE-2024-43093 Known exploited | High 7.3 | In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. Assigned by google_android | Nov 13, 2024 |
| CVE-2024-8069 Known exploited | Medium 5.1 | Limited remote code execution with privilege of a NetworkService Account access Assigned by Citrix | Nov 12, 2024 |
| CVE-2024-49039 Known exploited | High 8.8 | Windows Task Scheduler Elevation of Privilege Vulnerability Assigned by microsoft | Nov 12, 2024 |
| CVE-2024-43451 Known exploited | Medium 6.5 | NTLM Hash Disclosure Spoofing Vulnerability Assigned by microsoft | Nov 12, 2024 |
| CVE-2024-8068 Known exploited | Medium 5.1 | Privilege escalation to NetworkService Account access Assigned by Citrix | Nov 12, 2024 |
| CVE-2024-51567 Known exploited | Critical 10.0 | upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstat… Assigned by mitre | Oct 29, 2024 |
| CVE-2024-51378 Known exploited | Critical 10.0 | getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus… Assigned by mitre | Oct 29, 2024 |
| CVE-2024-50623 Known exploited | Critical 9.8 | In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution. Assigned by mitre | Oct 27, 2024 |
| CVE-2024-20481 Known exploited | Medium 5.8 | A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote a… Assigned by cisco | Oct 23, 2024 |
| CVE-2024-47575 Known exploited | Critical 9.8 | A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through… Assigned by fortinet | Oct 23, 2024 |
| CVE-2024-41713 Known exploited | Critical 9.1 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to i… Assigned by mitre | Oct 21, 2024 |
| CVE-2024-9537 Known exploited | Critical 9.8 | ScienceLogic SL1 unspecified vulnerability Assigned by cisa-cg | Oct 18, 2024 |
| CVE-2024-9465 Known exploited | Critical 9.2 | Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure Assigned by palo_alto | Oct 9, 2024 |
| CVE-2024-9463 Known exploited | Critical 9.9 | Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure Assigned by palo_alto | Oct 9, 2024 |
| CVE-2024-9680 Known exploited | Critical 9.8 | An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. Assigned by mozilla | Oct 9, 2024 |
| CVE-2024-43572 Known exploited | High 7.8 | Microsoft Management Console Remote Code Execution Vulnerability Assigned by microsoft | Oct 8, 2024 |
| CVE-2024-43468 Known exploited | Critical 9.8 | Microsoft Configuration Manager Remote Code Execution Vulnerability Assigned by microsoft | Oct 8, 2024 |
| CVE-2024-43573 Known exploited | Medium 6.5 | Windows MSHTML Platform Spoofing Vulnerability Assigned by microsoft | Oct 8, 2024 |
| CVE-2024-9380 Known exploited | High 7.2 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution. Assigned by ivanti | Oct 8, 2024 |
| CVE-2024-9379 Known exploited | Medium 6.5 | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements. Assigned by ivanti | Oct 8, 2024 |
| CVE-2024-43047 Known exploited | High 7.8 | Use After Free in DSP Service Assigned by qualcomm | Oct 7, 2024 |
| CVE-2024-45519 Known exploited | Critical 10.0 | The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute comma… Assigned by mitre | Oct 2, 2024 |
| CVE-2024-8963 Known exploited | Critical 9.4 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. Assigned by ivanti | Sep 19, 2024 |
| CVE-2024-8957 Known exploited | High 7.2 | PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration Assigned by VulnCheck | Sep 17, 2024 |
| CVE-2024-8956 Known exploited | Critical 9.1 | PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication Assigned by VulnCheck | Sep 17, 2024 |
| CVE-2024-38813 Known exploited | High 7.5 | Privilege escalation vulnerability Assigned by vmware | Sep 17, 2024 |
| CVE-2024-38812 Known exploited | Critical 9.8 | Heap-overflow vulnerability Assigned by vmware | Sep 17, 2024 |
| CVE-2024-8190 Known exploited | High 7.2 | An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. Assigned by ivanti | Sep 10, 2024 |
| CVE-2024-43461 Known exploited | High 8.8 | Windows MSHTML Platform Spoofing Vulnerability Assigned by microsoft | Sep 10, 2024 |
| CVE-2024-38226 Known exploited | High 7.3 | Microsoft Publisher Security Feature Bypass Vulnerability Assigned by microsoft | Sep 10, 2024 |
| CVE-2024-38217 Known exploited | Medium 5.4 | Windows Mark of the Web Security Feature Bypass Vulnerability Assigned by microsoft | Sep 10, 2024 |
| CVE-2024-38014 Known exploited | High 7.8 | Windows Installer Elevation of Privilege Vulnerability Assigned by microsoft | Sep 10, 2024 |
| CVE-2024-40711 Known exploited | Critical 9.8 | A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). Assigned by hackerone | Sep 7, 2024 |
| CVE-2024-20439 Known exploited | Critical 9.8 | A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static administrative credential. Assigned by cisco | Sep 4, 2024 |
| CVE-2024-45195 Known exploited | Critical 9.8 | Apache OFBiz: Confused controller-view authorization logic (forced browsing) Assigned by apache | Sep 4, 2024 |
| CVE-2024-6670 Known exploited | Critical 9.8 | WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability Assigned by ProgressSoftware | Aug 29, 2024 |
| CVE-2024-40766 Known exploited | Critical 9.3 | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the fi… Assigned by sonicwall | Aug 23, 2024 |
| CVE-2024-39717 Known exploited | Medium 6.6 | The Versa Director GUI provides an option to customize the look and feel of the user interface. Assigned by hackerone | Aug 22, 2024 |
| CVE-2024-28987 Known exploited | Critical 9.1 | SolarWinds Web Help Desk Hardcoded Credential Vulnerability Assigned by SolarWinds | Aug 21, 2024 |
| CVE-2024-7971 Known exploited | High 8.8 | Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. Assigned by Chrome | Aug 21, 2024 |
| CVE-2024-7965 Known exploited | High 8.8 | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Assigned by Chrome | Aug 21, 2024 |
| CVE-2024-7262 Known exploited | Critical 9.3 | Arbitrary Code Execution in WPS Office Assigned by ESET | Aug 15, 2024 |
| CVE-2024-28986 Known exploited | Critical 9.8 | SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability Assigned by SolarWinds | Aug 13, 2024 |
| CVE-2024-7593 Known exploited | Critical 9.8 | Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. Assigned by ivanti | Aug 13, 2024 |
| CVE-2024-38189 Known exploited | High 8.8 | Microsoft Project Remote Code Execution Vulnerability Assigned by microsoft | Aug 13, 2024 |
