Total
36333 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-1647 | 1 Kumaf | 1 Pyhtml2pdf | 2026-06-17 | N/A | 7.5 HIGH |
| Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user. | |||||
| CVE-2024-1645 | 1 Wobbie | 1 Mollie Forms | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Mollie Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportRegistrations function in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with subscriber access or higher, to export payment data collected by this plugin. | |||||
| CVE-2024-1640 | 1 Bitapps | 1 Contact Form Builder | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions. | |||||
| CVE-2024-1638 | 1 Zephyrproject | 1 Zephyr | 2026-06-17 | N/A | 8.2 HIGH |
| The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute read/write permission with LE Secure Connection encryption. If set, requires that LE Secure Connections is used for read/write access, however this is only true when it is combined with other permissions, namely BT_GATT_PERM_READ_ENCRYPT/BT_GATT_PERM_READ_AUTHEN (for read) or BT_GATT_PERM_WRITE_ENCRYPT/BT_GATT_PERM_WRITE_AUTHEN (for write), if these additional permissions are not set (even in secure connections only mode) then the stack does not perform any permission checks on these characteristics and they can be freely written/read. | |||||
| CVE-2024-1632 | 1 Progress | 1 Sitefinity | 2026-06-17 | N/A | 8.8 HIGH |
| Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area. | |||||
| CVE-2024-1619 | 1 Kaspersky | 1 Security | 2026-06-17 | N/A | 6.1 MEDIUM |
| Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. The issue was that an attacker could potentially force an administrator to click on a malicious link to perform unauthorized actions. | |||||
| CVE-2024-1591 | 1 Beyondtrust | 1 Privilege Management For Windows | 2026-06-17 | N/A | 3.3 LOW |
| Prior to version 24.1, a local authenticated attacker can view Sysvol when Privilege Management for Windows is configured to use a GPO policy. This allows them to view the policy and potentially find configuration issues. | |||||
| CVE-2024-1587 | 1 Blazethemes | 1 Newsmatic | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. This makes it possible for unauthenticated attackers to view draft posts and post content. | |||||
| CVE-2024-1578 | 1 Rfideas | 4 Micard Plus Ble, Micard Plus Ble Firmware, Micard Plus Ci and 1 more | 2026-06-17 | N/A | 5.3 MEDIUM |
| The MiCard PLUS Ci and MiCard PLUS BLE reader products developed by rf IDEAS and rebranded by NT-ware have a firmware fault that may result in characters randomly being dropped from some ID card reads, which would result in the wrong ID card number being assigned during ID card self-registration and might result in failed login attempts for end-users. Random characters being dropped from ID card numbers compromises the uniqueness of ID cards that can, therefore, result in a security issue if the users are using the ‘ID card self-registration’ function. | |||||
| CVE-2024-1575 | 1 Zyxel | 40 Nwa110ax, Nwa110ax Firmware, Nwa1123acv3 and 37 more | 2026-06-17 | N/A | 6.5 MEDIUM |
| The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authenticated user to escalate privileges and download the configuration files on a vulnerable device. | |||||
| CVE-2024-1569 | 1 Lollms | 1 Lollms-webui | 2026-06-17 | N/A | 7.5 HIGH |
| parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software. | |||||
| CVE-2024-1564 | 1 Brainstormforce | 1 Schema | 2026-06-17 | N/A | 4.3 MEDIUM |
| The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of post type or status via a shortcode | |||||
| CVE-2024-1549 | 2 Debian, Mozilla | 3 Debian Linux, Firefox, Thunderbird | 2026-06-17 | N/A | 6.1 MEDIUM |
| If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. | |||||
| CVE-2024-1548 | 2 Debian, Mozilla | 3 Debian Linux, Firefox, Thunderbird | 2026-06-17 | N/A | 4.3 MEDIUM |
| A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. | |||||
| CVE-2024-1547 | 2 Debian, Mozilla | 3 Debian Linux, Firefox, Thunderbird | 2026-06-17 | N/A | 6.5 MEDIUM |
| Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8. | |||||
| CVE-2024-1526 | 1 Devpups | 1 Social Pug | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its content in a meta tag. | |||||
| CVE-2024-1505 | 1 Kodezen | 1 Academy Lms | 2026-06-17 | N/A | 8.8 HIGH |
| The Academy LMS – eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator. | |||||
| CVE-2024-1479 | 1 Generatepress | 1 Wp Show Posts | 2026-06-17 | N/A | 5.3 MEDIUM |
| The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the wpsp_display function. This makes it possible for authenticated attackers with contributor access and above to view the contents of draft, trash, future, private and pending posts and pages. | |||||
| CVE-2024-1478 | 1 Helderk | 1 Maintenance Mode | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content via API thus bypassing the content protection provided by the plugin. | |||||
| CVE-2024-1476 | 1 Acurax | 1 Under Construction \/ Maintenance Mode | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6 via the REST API. This makes it possible for unauthenticated attackers to obtain the contents of posts and pages when maintenance mode is active thus bypassing the protection provided by the plugin. | |||||