Total
9945 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-38699 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in WP Swings Wallet System for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wallet System for WooCommerce: from n/a through 2.5.13. | |||||
| CVE-2024-38695 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6. | |||||
| CVE-2024-38690 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.3. | |||||
| CVE-2024-38506 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 6.3 MEDIUM |
| In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows | |||||
| CVE-2024-38504 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles | |||||
| CVE-2024-38353 | 1 Hackmd | 1 Codimd | 2026-06-17 | N/A | 5.3 MEDIUM |
| CodiMD allows realtime collaborative markdown notes on all platforms. CodiMD before 2.5.4 is missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. CodiMD does not require valid authentication to access uploaded images or to upload new image data. An attacker who can determine an uploaded image's URL can gain unauthorised access to uploaded image data. Due to the insecure random filename generation in the underlying Formidable library, an attacker can determine the filenames for previously uploaded images and the likelihood of this issue being exploited is increased. This vulnerability is fixed in 2.5.4. | |||||
| CVE-2024-38190 | 1 Microsoft | 1 Power Platform | 2026-06-17 | N/A | 8.6 HIGH |
| Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector. | |||||
| CVE-2024-38179 | 1 Microsoft | 1 Azure Stack Hci | 2026-06-17 | N/A | 8.8 HIGH |
| Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability | |||||
| CVE-2024-38002 | 1 Liferay | 2 Digital Experience Platform, Liferay Portal | 2026-06-17 | N/A | 9.0 CRITICAL |
| The workflow component in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92 and 7.3 GA through update 36 does not properly check user permissions before updating a workflow definition, which allows remote authenticated users to modify workflow definitions and execute arbitrary code (RCE) via the headless API. | |||||
| CVE-2024-37935 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in anhvnit Woocommerce OpenPos allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woocommerce OpenPos: from n/a through 6.4.4. | |||||
| CVE-2024-37930 | 1 Theme-sphere | 1 Smartmag | 2026-06-17 | N/A | 5.3 MEDIUM |
| Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMag: from n/a through < 10.1.0. | |||||
| CVE-2024-37929 | 2026-06-17 | N/A | 6.3 MEDIUM | ||
| Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4. | |||||
| CVE-2024-37926 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.9. | |||||
| CVE-2024-37921 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Kiboko Labs Chained Quiz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chained Quiz: from n/a through 1.3.2.8. | |||||
| CVE-2024-37903 | 1 Joinmastodon | 1 Mastodon | 2026-06-17 | N/A | 8.2 HIGH |
| Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue. | |||||
| CVE-2024-37901 | 1 Xwiki | 1 Xwiki | 2026-06-17 | N/A | 9.9 CRITICAL |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with edit right on any page can perform arbitrary remote code execution by adding instances of `XWiki.SearchSuggestConfig` and `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.21, 15.5.5 and 15.10.2. | |||||
| CVE-2024-37898 | 1 Xwiki | 1 Xwiki | 2026-06-17 | N/A | 4.3 MEDIUM |
| XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When a user has view but not edit right on a page in XWiki, that user can delete the page and replace it by a page with new content without having delete right. The previous version of the page is moved into the recycle bin and can be restored from there by an admin. As the user is recorded as deleter, the user would in theory also be able to view the deleted content, but this is not directly possible as rights of the previous version are transferred to the new page and thus the user still doesn't have view right on the page. It therefore doesn't seem to be possible to exploit this to gain any rights. This has been patched in XWiki 14.10.21, 15.5.5 and 15.10.6 by cancelling save operations by users when a new document shall be saved despite the document's existing already. | |||||
| CVE-2024-37544 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Missing Authorization vulnerability in Saleswonder Team: Tobias Get Better Reviews for WooCommerce more-better-reviews-for-woocommerce.This issue affects Get Better Reviews for WooCommerce: from n/a through <= 4.0.6. | |||||
| CVE-2024-37542 | 1 Wpdevart | 1 Gallery | 2026-06-17 | N/A | 5.4 MEDIUM |
| Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3. | |||||
| CVE-2024-37517 | 1 Brainstormforce | 1 Spectra | 2026-06-17 | N/A | 4.3 MEDIUM |
| Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7. | |||||