Total
36333 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-24568 | 2 Fedoraproject, Oisf | 2 Fedora, Suricata | 2026-06-17 | N/A | 5.3 MEDIUM |
| Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3. | |||||
| CVE-2024-24549 | 3 Apache, Debian, Fedoraproject | 3 Tomcat, Debian Linux, Fedora | 2026-06-17 | N/A | 7.5 HIGH |
| Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. | |||||
| CVE-2024-24548 | 1 Estore-wss | 1 Payment Ex | 2026-06-17 | N/A | 6.5 MEDIUM |
| Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise using Payment EX. | |||||
| CVE-2024-24539 | 1 Fusionpbx | 1 Fusionpbx | 2026-06-17 | N/A | 5.3 MEDIUM |
| FusionPBX before 5.2.0 does not validate a session. | |||||
| CVE-2024-24409 | 1 Zohocorp | 1 Manageengine Admanager Plus | 2026-06-17 | N/A | 8.8 HIGH |
| Zohocorp ManageEngine ADManager Plus versions 7203 and prior are vulnerable to Privilege Escalation in the Modify Computers option. | |||||
| CVE-2024-24402 | 1 Nagios | 1 Nagios Xi | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. | |||||
| CVE-2024-24304 | 1 Sinch | 1 Mailjet | 2026-06-17 | N/A | 7.5 HIGH |
| In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without restriction. | |||||
| CVE-2024-24215 | 1 Cellinx | 1 Nvt Web Server | 2026-06-17 | N/A | 5.3 MEDIUM |
| An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information via a crafted POST request. | |||||
| CVE-2024-24199 | 1 Pymumu | 1 Smartdns | 2026-06-17 | N/A | 7.5 HIGH |
| smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/dns.c. | |||||
| CVE-2024-24198 | 1 Pymumu | 1 Smartdns | 2026-06-17 | N/A | 7.5 HIGH |
| smartdns commit 54b4dc was discovered to contain a misaligned address at smartdns/src/util.c. | |||||
| CVE-2024-24195 | 1 Robertdavidgraham | 1 Robdns | 2026-06-17 | N/A | 7.5 HIGH |
| robdns commit d76d2e6 was discovered to contain a misaligned address at /src/zonefile-insertion.c. | |||||
| CVE-2024-24122 | 1 Wondershare | 1 Edraw | 2026-06-17 | N/A | 3.3 LOW |
| A remote code execution vulnerability in the project management of Wanxing Technology's Yitu project which allows an attacker to use the exp.adpx file as a zip compressed file to construct a special file name, which can be used to decompress the project file into the system startup folder, restart the system, and automatically execute the constructed attack script. | |||||
| CVE-2024-24116 | 1 Ruijie | 2 Rg-nbs2009g-p, Rg-nbs2009g-p Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. | |||||
| CVE-2024-24051 | 1 Monoprice | 2 Select Mini 3d Printer V2, Select Mini 3d Printer V2 Firmware | 2026-06-17 | N/A | 5.5 MEDIUM |
| Improper input validation of printing files in Monoprice Select Mini V2 V37.115.32 allows attackers to instruct the device's movable parts to destinations that exceed the devices' maximum coordinates via the printing of a malicious .gcode file. | |||||
| CVE-2024-23985 | 1 Ezhometech | 1 Ezserver | 2026-06-17 | N/A | 7.5 HIGH |
| EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command. | |||||
| CVE-2024-23952 | 1 Apache | 1 Superset | 2026-06-17 | N/A | 6.5 MEDIUM |
| This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. | |||||
| CVE-2024-23904 | 1 Jenkins | 1 Log Command | 2026-06-17 | N/A | 7.5 HIGH |
| Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read content from arbitrary files on the Jenkins controller file system. | |||||
| CVE-2024-23901 | 1 Jenkins | 1 Github Branch Source | 2026-06-17 | N/A | 6.5 MEDIUM |
| Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured owner group, allowing attackers to configure and share a project, resulting in a crafted Pipeline being built by Jenkins during the next scan of the group. | |||||
| CVE-2024-23900 | 1 Jenkins | 1 Matrix Project | 2026-06-17 | N/A | 4.3 MEDIUM |
| Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by the attackers. | |||||
| CVE-2024-23899 | 1 Jenkins | 1 Git Server | 2026-06-17 | N/A | 6.5 MEDIUM |
| Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenkins controller file system. | |||||