Total
395535 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-48080 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An issue in aedes v0.51.2 allows attackers to cause a Denial of Service(DoS) via a crafted request. NOTE: the Supplier indicates that exploitation cannot occur because of the protection mechanism in the validateTopic function in lib/utils.js. | |||||
| CVE-2024-48077 | 1 Emqx | 1 Nanomq | 2026-06-17 | N/A | 7.5 HIGH |
| NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rapid exhaustion of system file descriptors (FDs). This exhaustion triggers a process crash, rendering the broker unable to provide services. | |||||
| CVE-2024-48075 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| A Heap buffer overflow in the server-site handshake implementation in Real Time Logic SharkSSL from 09/09/24 and earlier allows a remote attacker to trigger a Denial-of-Service via a malformed TLS Client Key Exchange message. | |||||
| CVE-2024-48074 | 1 Draytek | 2 Vigor2960, Vigor2960 Firmware | 2026-06-17 | N/A | 8.0 HIGH |
| An authorized RCE vulnerability exists in the DrayTek Vigor2960 router version 1.4.4, where an attacker can place a malicious command into the table parameter of the doPPPoE function in the cgi-bin/mainfunction.cgi route, and finally the command is executed by the system function. | |||||
| CVE-2024-48073 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, which could allow an attacker to pass commands to this program via command line arguments to gain elevated root privileges. | |||||
| CVE-2024-48072 | 1 Weaver | 1 E-cology | 2026-06-17 | N/A | 9.8 CRITICAL |
| Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.formmodel.mobile.mec.servlet.MECAction&action=getFieldTriggerValue&searchField=*&fromTable=HrmResourceManager&whereClause=1%3d1&triggerCondition=1&expression=%3d&fieldValue=1. | |||||
| CVE-2024-48071 | 1 Weaver | 1 E-cology | 2026-06-17 | N/A | 6.5 MEDIUM |
| E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the server to permanently deny service. | |||||
| CVE-2024-48070 | 1 Weaver | 1 E-cology | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution, and control server privileges | |||||
| CVE-2024-48069 | 1 Weaver | 1 E-cology | 2026-06-17 | N/A | 9.8 CRITICAL |
| A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges | |||||
| CVE-2024-48068 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |||||
| CVE-2024-48063 | 1 Linuxfoundation | 1 Pytorch | 2026-06-17 | N/A | 9.8 CRITICAL |
| In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing. | |||||
| CVE-2024-48061 | 1 Langflow | 1 Langflow | 2026-06-17 | N/A | 9.8 CRITICAL |
| langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox. | |||||
| CVE-2024-48059 | 1 Gaizhenbiao | 1 Chuanhuchatgpt | 2026-06-17 | N/A | 6.1 MEDIUM |
| gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission. An attacker can inject malicious content into a WebSocket message. When a victim accesses this session, the malicious JavaScript is executed in the victim's browser. | |||||
| CVE-2024-48057 | 1 Mudler | 1 Localai | 2026-06-17 | N/A | 6.1 MEDIUM |
| localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage. | |||||
| CVE-2024-48052 | 1 Gradio Project | 1 Gradio | 2026-06-17 | N/A | 6.5 MEDIUM |
| In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information. | |||||
| CVE-2024-48050 | 1 Modelscope | 1 Agentscope | 2026-06-17 | N/A | 9.8 CRITICAL |
| In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can directly execute user-provided commands. | |||||
| CVE-2024-48049 | 1 Mightyplugins | 1 Mighty Builder | 2026-06-17 | N/A | 6.5 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mighty Plugins Mighty Builder mighty-builder allows Stored XSS.This issue affects Mighty Builder: from n/a through <= 1.0.2. | |||||
| CVE-2024-48048 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Cross-Site Request Forgery (CSRF) vulnerability in GabbyKhrmon Wsify Widget wsify-widget allows Stored XSS.This issue affects Wsify Widget: from n/a through <= 1.0. | |||||
| CVE-2024-48047 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Razon Komar Pal Linked Variation for WooCommerce linked-variation-for-woocommerce allows Cross Site Request Forgery.This issue affects Linked Variation for WooCommerce: from n/a through <= 1.0.5. | |||||
| CVE-2024-48046 | 2026-06-17 | N/A | 5.9 MEDIUM | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Stored XSS.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28. | |||||