Total
398467 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-23737 | 1 Savignano | 1 S-notify | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email. | |||||
| CVE-2024-23736 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email. | |||||
| CVE-2024-23735 | 1 Savignano | 1 S-notify | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify before 4.0.0 for Confluence allows attackers to manipulate user data via specially crafted certificate. | |||||
| CVE-2024-23734 | 1 Savignano | 1 S-notify | 2026-06-17 | N/A | 5.2 MEDIUM |
| Cross Site Request Forgery vulnerability in in the upload functionality of the User Profile pages in savignano S/Notify before 2.0.1 for Bitbucket allow attackers to replace S/MIME certificate or PGP keys for arbitrary users via crafted link. | |||||
| CVE-2024-23733 | 2026-06-17 | N/A | 7.5 HIGH | ||
| The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI. | |||||
| CVE-2024-23732 | 1 Embedchain | 1 Embedchain | 2026-06-17 | N/A | 7.5 HIGH |
| The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py. | |||||
| CVE-2024-23731 | 1 Embedchain | 1 Embedchain | 2026-06-17 | N/A | 9.8 CRITICAL |
| The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument. | |||||
| CVE-2024-23730 | 1 Llamahub | 1 Llamahub | 2026-06-17 | N/A | 9.8 CRITICAL |
| The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML. | |||||
| CVE-2024-23729 | 1 Heytap | 1 Internet Browser | 2026-06-17 | N/A | 6.1 MEDIUM |
| The ColorOS Internet Browser com.heytap.browser application 45.10.3.4.1 for Android allows a remote attacker to execute arbitrary JavaScript code via the com.android.browser.RealBrowserActivity component. | |||||
| CVE-2024-23727 | 2026-06-17 | N/A | 8.4 HIGH | ||
| The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component. | |||||
| CVE-2024-23726 | 1 Ubeeinteractive | 2 Ddw365, Ddw365 Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote attacker (in proximity to a Wi-Fi network) can derive the default WPA2-PSK value by observing a beacon frame. A PSK is generated by using the first six characters of the SSID and the last six of the BSSID, decrementing the last digit. | |||||
| CVE-2024-23725 | 1 Ghost | 1 Ghost | 2026-06-17 | N/A | 6.1 MEDIUM |
| Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries. | |||||
| CVE-2024-23724 | 1 Ghost | 1 Ghost | 2026-06-17 | N/A | 9.0 CRITICAL |
| Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector." | |||||
| CVE-2024-23722 | 1 Treasuredata | 1 Fluent Bit | 2026-06-17 | N/A | 7.5 HIGH |
| In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-urlencoded. It crashes and does not restart. This could result in logs not being delivered properly. | |||||
| CVE-2024-23721 | 1 Draytek | 2 Vigor3910, Vigor3910 Firmware | 2026-06-17 | N/A | 7.5 HIGH |
| A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices. When sending a certain POST request, it calls the function and exports information. | |||||
| CVE-2024-23717 | 1 Google | 1 Android | 2026-06-17 | N/A | 8.8 HIGH |
| In access_secure_service_from_temp_bond of btm_sec.cc, there is a possible way to achieve keystroke injection due to improper input validation. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2024-23716 | 1 Google | 1 Android | 2026-06-17 | N/A | 7.0 HIGH |
| In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2024-23715 | 1 Google | 1 Android | 2026-06-17 | N/A | 7.8 HIGH |
| In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2024-23713 | 1 Google | 1 Android | 2026-06-17 | N/A | 7.8 HIGH |
| In migrateNotificationFilter of NotificationManagerService.java, there is a possible failure to persist notifications settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2024-23712 | 1 Google | 1 Android | 2026-06-17 | N/A | 5.5 MEDIUM |
| In multiple functions of AppOpsService.java, there is a possible way to saturate the content of /data/system/appops_accesses.xml due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||