Total
7148 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-39714 | 2026-06-17 | N/A | 9.9 CRITICAL | ||
| A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server. | |||||
| CVE-2024-39700 | 1 Jupyter | 1 Jupyterlab | 2026-06-17 | N/A | 9.9 CRITICAL |
| JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to the latest version. Users who made changes to `update-integration-tests.yml`, accept overwriting of this file and re-apply your changes later. Users may wish to temporarily disable GitHub Actions while working on the upgrade. We recommend rebasing all open pull requests from untrusted users as actions may run using the version from the `main` branch at the time when the pull request was created. Users who are upgrading from template version prior to 4.3.0 may wish to leave out proposed changes to the release workflow for now as it requires additional configuration. | |||||
| CVE-2024-39669 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. A malicious agent could possibly execute arbitrary code in the Sync Server and compromise security. | |||||
| CVE-2024-39331 | 1 Gnu | 1 Emacs | 2026-06-17 | N/A | 9.8 CRITICAL |
| In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5. | |||||
| CVE-2024-39289 | 1 Openrobotics | 1 Robot Operating System | 2026-06-17 | N/A | 7.8 HIGH |
| A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code. | |||||
| CVE-2024-39236 | 1 Gradio Project | 1 Gradio | 2026-06-17 | N/A | 9.8 CRITICAL |
| Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself. | |||||
| CVE-2024-39209 | 2026-06-17 | N/A | 6.3 MEDIUM | ||
| luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter. | |||||
| CVE-2024-39165 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload in the data parameter in conjunction with a .php file name in the filename parameter. This occurs because an unnecessary QR/demoapp folder.is shipped with the product. | |||||
| CVE-2024-39148 | 1 Kerlink | 1 Keros | 2026-06-17 | N/A | 8.1 HIGH |
| The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall. | |||||
| CVE-2024-39071 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php. | |||||
| CVE-2024-39017 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | |||||
| CVE-2024-39015 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | |||||
| CVE-2024-39002 | 1 Richardrodger | 1 Jsonic | 2026-06-17 | N/A | 6.3 MEDIUM |
| rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function util.clone. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | |||||
| CVE-2024-38993 | 1 Richardrodger | 1 Jsonic | 2026-06-17 | N/A | 9.8 CRITICAL |
| rjrodger jsonic-next v2.12.1 was discovered to contain a prototype pollution via the function empty. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | |||||
| CVE-2024-38990 | 2026-06-17 | N/A | 6.3 MEDIUM | ||
| Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | |||||
| CVE-2024-38944 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component. | |||||
| CVE-2024-38651 | 2026-06-17 | N/A | 8.5 HIGH | ||
| A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server. | |||||
| CVE-2024-38458 | 1 Xenforo | 1 Xenforo | 2026-06-17 | N/A | 8.8 HIGH |
| Xenforo before 2.2.16 allows code injection. | |||||
| CVE-2024-38448 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used. | |||||
| CVE-2024-38396 | 1 Iterm2 | 1 Iterm2 | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal, a different vulnerability than CVE-2024-38395. | |||||