CVE-2024-32xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

768 records · Page 2 of 8

• CVE-2024-32894: In bc_get_converted_received_bearer of bc_utilities.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with n 7.5 High

  In bc_get_converted_received_bearer of bc_utilities.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

  Updated 2025-03-27
• CVE-2024-32893: In _s5e9865_mif_set_rate of exynos_dvfs.c, there is a possible out of bounds read due to improper casting. This could lead to local information disclosure with no additional execut 8.1 High

  In _s5e9865_mif_set_rate of exynos_dvfs.c, there is a possible out of bounds read due to improper casting. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

  Updated 2024-08-02
• CVE-2024-32892: In handle_init of goodix/main/main.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution pri 7.8 High

  In handle_init of goodix/main/main.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  Updated 2025-03-13
• CVE-2024-32891: In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution priv 7.0 High

  In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  Updated 2024-08-02
• CVE-2024-32890: Stored Cross-site Scripting in results JSON API in librespeed/speedtest 6.1 Medium

  librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The `processedString` field in the `ispinfo` parameter is missing neutralization. It is stored when a user submits a speedtest result to the telemetry API (`results/telemetry.php`) an

  Updated 2024-08-21
• CVE-2024-32888: Amazon JDBC Driver for Redshift SQL Injection via line comment generation 10.0 Critical

  The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application program interfaces (APIs) available in the Java Platform, Enterprise Editions. Prior to version 2.1.0.28, SQL injection is possible when using the non-default connection property `preferQueryMode=simple` in combination with application code which has a vulnerable SQ

  Updated 2025-06-12
• CVE-2024-32887: Reflected XSS in sidekiq 5.5 Medium

  Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascript code into the response of the application. An attacker could exploit it to target users of the Sidekiq Web UI. Moreover, if other applications are deployed on the same domain

  Updated 2024-08-02
• CVE-2024-32886: Vitess vulnerable to infinite memory consumption and vtgate crash 4.9 Medium

  Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into an endless loop that also keeps consuming memory and eventually will run out of memory. This vulnerability is fixed in 19.0.4, 18.0.5, and 17.0.7.

  Updated 2024-08-02
• CVE-2024-32884: gix-transport indirect code execution via malicious username 6.4 Medium

  gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpret as an option. A specially crafted clone URL can smuggle options to SSH. The possibilities are syntactically limited, but if a malicious clone URL is used by an application whose current working directory contains a malicious file, arbitra

  Updated 2024-08-02
• CVE-2024-32883: MCUboot Injection attack of unprotected TLV values 7.7 High

  MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV (tag-length-value) structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part of the image signature to avoid tampering. However, the code does not distinguish which TLV entries

  Updated 2024-08-02
• CVE-2024-32882: Permission check bypass when editing a model with per-field restrictions in wagtail 2.7 Low

  Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can c

  Updated 2024-08-02
• CVE-2024-32881: Unauthorized access to GET/SET of Slack Bot Tokens in Danswer 9.8 Critical

  Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal Slack access. This issue was patched in version 3.63.

  Updated 2024-08-02
• CVE-2024-32880: pyLoad allows upload to arbitrary folder lead to RCE 9.1 Critical

  pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.

  Updated 2024-08-02
• CVE-2024-32879: social-auth-app-django Improper Handling of Case Sensitivity vulnerability 4.9 Medium

  Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected

  Updated 2024-08-02
• CVE-2024-32878: Use of Uninitialized Variable Vulnerability in llama.cpp 7.1 High

  Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. C

  Updated 2024-08-02
• CVE-2024-32877: Reflected Cross-site Scripting in yiisoft/yii2 Debug mode 4.2 Medium

  Yii 2 is a PHP application framework. During internal penetration testing of a product based on Yii2, users discovered a Cross-site Scripting (XSS) vulnerability within the framework itself. This issue is relevant for the latest version of Yii2 (2.0.49.3). This issue lies in the mechanism for displaying function argument values in the stack trace. The vulnerability manifests when an argument's val

  Updated 2024-08-02
• CVE-2024-32876: NewPipe has potential security vulnerability when importing settings 8.5 High

  NewPipe is an Android app for video streaming written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions 0.13.4 through 0.26.1, importing a backup file from an untrusted source could have resulted in Arbitrary Code Execution. This is because backups are serialized/deserialized using Java's Object Serializat

  Updated 2024-08-02
• CVE-2024-32875: Hugo doesn't escape markdown title in internal render hooks 6.1 Medium

  Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in internal render hooks. Hugo users who are impacted are those who have these hooks enabled and do not trust their Markdown content files. The issue is patched in v0.125.3. As a workaround, replace the templates with user defined templates or disa

  Updated 2024-08-02
• CVE-2024-32874: In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service 6.8 Medium

  Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Below 0.13.2 Release, when uploading a file or retrieving the filename, a user may intentionally use a large Unicode filename which would lead to a application-level denial of service. This is due to no limitation set on the length of the filename and the costy use of the Unicode normalization with the f

  Updated 2024-08-02
• CVE-2024-32873: evmos allows transferring unvested tokens after delegations 3.5 Low

  Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. The spendable balance is not updated properly when delegating vested tokens. The issue allows a clawback vesting account to anticipate the release of unvested tokens. This vulnerability is fixed in 18.0.0.

  Updated 2024-08-02
• CVE-2024-32872: Umbraco Workflow's Backoffice users can execute arbitrary SQL 5.5 Medium

  Umbraco workflow provides workflows for the Umbraco content management system. Prior to versions 10.3.9, 12.2.6, and 13.0.6, an Umbraco Backoffice user can modify requests to a particular API endpoint to include SQL, which will be executed by the server. Umbraco Workflow versions 10.3.9, 12.2.6, 13.0.6, as well as Umbraco Plumber version 10.1.2, contain a patch for this issue.

  Updated 2024-08-02
• CVE-2024-32871: Pimcore Vulnerable to Flooding Server with Thumbnail files 7.5 High

  Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4.

  Updated 2024-08-02
• CVE-2024-32870: iTop hub connector Information disclosure 5.8 Medium

  Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info (name, version and parameters) can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

  Updated 2024-11-05
• CVE-2024-32869: Hono vulnerable to Restricted Directory Traversal in serveStatic with deno 5.3 Medium

  Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.

  Updated 2024-08-02
• CVE-2024-32868: ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass 6.5 Medium

  ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password check attempts, there was no such mechanism for (T)OTP checks. This issue has been patched in version 2.50.0.

  Updated 2024-08-05
• CVE-2024-32867: Suricata's defrag contains various issues leading to policy bypass 5.3 Medium

  Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, various problems in handling of fragmentation anomalies can lead to mis-detection of rules and policy. This vulnerability is fixed in 7.0.5 or 6.0.19.

  Updated 2024-08-02
• CVE-2024-32866: Conform contains Prototype Pollution Vulnerability in `parseWith...` function 8.6 High

  Conform, a type-safe form validation library, allows the parsing of nested objects in the form of `object.property`. Due to an improper implementation of this feature in versions prior to 1.1.1, an attacker can exploit the feature to trigger prototype pollution by passing a crafted input to `parseWith...` functions. Applications that use conform for server-side validation of form data or URL param

  Updated 2024-08-02
• CVE-2024-32865: exacqVison - TLS certificate validation 6.4 Medium

  Under certain circumstances the exacqVision Server will not properly validate TLS certificates provided by connected devices.

  Updated 2024-08-02
• CVE-2024-32864: exacqVison - HTTPS Session Establishment 6.4 Medium

  Under certain circumstances exacqVision Web Services will not enforce secure web communications (HTTPS)

  Updated 2024-08-05
• CVE-2024-32863: exacqVison - CSRF issues with Web Service 6.8 Medium

  Under certain circumstances the exacqVision Web Services may be susceptible to Cross-Site Request Forgery (CSRF)

  Updated 2024-08-02
• CVE-2024-32862: exacqVision CORS 6.8 Medium

  Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains.

  Updated 2024-08-02
• CVE-2024-32861: Software House C•CURE - CouchDB executable protection 7.8 High

  Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions.

  Updated 2025-07-21
• CVE-2024-32860: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially e 7.5 High

  Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

  Updated 2024-08-02
• CVE-2024-32859: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially e 7.5 High

  Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

  Updated 2024-08-02
• CVE-2024-32858: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially e 7.5 High

  Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

  Updated 2024-08-02
• CVE-2024-32857: Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through prelo 7.3 High

  Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege

  Updated 2024-08-01
• CVE-2024-32856: Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially e 5.1 Medium

  Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

  Updated 2024-08-02
• CVE-2024-32855: Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit 3.8 Low

  Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

  Updated 2024-08-02
• CVE-2024-32854: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attacker could potentially exploit this vulner 6.7 Medium

  Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to privilege escalation.

  Updated 2024-08-02
• CVE-2024-32853: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit thi 4.4 Medium

  Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.

  Updated 2024-08-02
• CVE-2024-32852: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could pote 5.9 Medium

  Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could potentially exploit this vulnerability, leading to data leaks.

  Updated 2024-08-02
• CVE-2024-32850: Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 9.8 Critical

  Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 firmware Ver. 1.5.5 and earlier. If the remote monitoring and control function is enabled on the product, an attacker with access to the product may execute an arbitrary command or login to the product with the administr

  Updated 2024-08-02
• CVE-2024-32849: Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files 7.8 High

  Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentionally delete privileged Trend Micro files including its own.

  Updated 2024-08-02
• CVE-2024-32848: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi 9.1 Critical

  An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-09-12
• CVE-2024-32847: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to a 7.2 High

  SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-11-19
• CVE-2024-32846: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi 9.1 Critical

  An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-09-12
• CVE-2024-32845: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi 9.1 Critical

  An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-09-12
• CVE-2024-32844: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to a 7.2 High

  SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-11-19
• CVE-2024-32843: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi 9.1 Critical

  An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-09-12
• CVE-2024-32842: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi 9.1 Critical

  An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-09-12
• CVE-2024-32841: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to a 7.2 High

  SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-11-19
• CVE-2024-32840: An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code executi 9.1 Critical

  An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-09-12
• CVE-2024-32839: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to a 7.2 High

  SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

  Updated 2024-11-19
• CVE-2024-32838: Apache Fineract: SQL injection vulnerabilities in offices API endpoint 9.4 Critical

  SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API endpoints' query parameter.  Users are recommended to upgrade to version 1.10.1, which fixes this issue. A SQL Validator has been implemented which allows us to configu

  Updated 2025-02-12
• CVE-2024-32836: WordPress WP-Lister Lite for eBay plugin <= 3.5.11 - Arbitrary File Upload vulnerability 9.1 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.5.11.

  Updated 2026-04-28
• CVE-2024-32835: WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability 5.4 Medium

  Deserialization of Untrusted Data vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.3.

  Updated 2026-04-28
• CVE-2024-32834: WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce Shipping Label allows Stored XSS.This issue affects WooCommerce Shipping Label: from n/a through 2.3.8.

  Updated 2026-04-28
• CVE-2024-32833: WordPress List Custom Taxonomy Widget plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Halsey List Custom Taxonomy Widget allows Stored XSS.This issue affects List Custom Taxonomy Widget: from n/a through 4.1.

  Updated 2026-04-28
• CVE-2024-32832: WordPress Login with Phone Number plugin <= 1.6.93 - Broken Access Control vulnerability 9.8 Critical

  Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.

  Updated 2026-04-28
• CVE-2024-32831: WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lorna Timbah (webgrrrl) Accessibility Widget allows Stored XSS.This issue affects Accessibility Widget: from n/a through 2.2.

  Updated 2026-04-28
• CVE-2024-32830: WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability 8.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeKraft BuddyForms allows Server Side Request Forgery, Relative Path Traversal.This issue affects BuddyForms: from n/a through 2.8.8.

  Updated 2026-04-28
• CVE-2024-32829: WordPress Data Tables Generator by Supsystic plugin <= 1.10.31 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.

  Updated 2026-04-28
• CVE-2024-32828: WordPress Table Rate Shipping Method for WooCommerce by Flexible Shipping plugin <= 4.24.15 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15.

  Updated 2026-04-28
• CVE-2024-32827: WordPress Giveaways and Contests by RafflePress plugin <= 1.12.7 - IP Restriction Bypass vulnerability 5.3 Medium

  Authentication Bypass by Spoofing vulnerability in RafflePress Giveaways and Contests allows Functionality Bypass.This issue affects Giveaways and Contests: from n/a through 1.12.7.

  Updated 2026-04-28
• CVE-2024-32826: WordPress VK Block Patterns plugin <= 1.31.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0.

  Updated 2026-04-28
• CVE-2024-32825: WordPress Simply Static plugin <= 3.1.3 - Sensitive Data Exposure via Log File vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3.

  Updated 2026-04-28
• CVE-2024-32824: WordPress Evergreen Content Poster plugin <= 1.4.2 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster.This issue affects Evergreen Content Poster: from n/a through <= 1.4.2.

  Updated 2026-04-28
• CVE-2024-32823: WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in FeedbackWP Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.4.

  Updated 2026-04-28
• CVE-2024-32822: WordPress Reviews Plus plugin <= 1.3.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in impleCode Reviews Plus.This issue affects Reviews Plus: from n/a through 1.3.4.

  Updated 2026-04-28
• CVE-2024-32821: WordPress Total Poll Lite plugin <= 4.9.9 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in TotalSuite Total Poll Lite.This issue affects Total Poll Lite: from n/a through 4.9.9.

  Updated 2026-04-28
• CVE-2024-32820: WordPress Social Share Icons & Social Share Buttons plugin <= 3.6.2 - Broken Access Control lead to Notice Dismissal vulnerability 5.3 Medium

  Missing Authorization vulnerability in Social Share Pro Social Share Icons & Social Share Buttons.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.6.2.

  Updated 2026-04-28
• CVE-2024-32819: WordPress Culqi plugin <= 3.0.14 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Culqi.This issue affects Culqi: from n/a through 3.0.14.

  Updated 2026-04-28
• CVE-2024-32818: WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.

  Updated 2026-04-28
• CVE-2024-32817: WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability 4.4 Medium

  Deserialization of Untrusted Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.2.

  Updated 2026-04-28
• CVE-2024-32816: WordPress Combo Blocks plugin <= 2.2.78 - Sensitive Data Exposure via API vulnerability 7.5 High

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid.This issue affects Post Grid: from n/a through 2.2.78.

  Updated 2026-04-28
• CVE-2024-32815: WordPress All-in-one Like Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters All-in-one Like Widget all-in-one-facebook-like-widget.This issue affects All-in-one Like Widget: from n/a through <= 2.2.7.

  Updated 2026-04-28
• CVE-2024-32814: WordPress Advanced Local Pickup for WooCommerce plugin <= 1.6.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.1.

  Updated 2026-04-28
• CVE-2024-32813: WordPress Integrate Google Drive plugin <= 1.3.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.9.

  Updated 2026-04-28
• CVE-2024-32812: WordPress Podlove Podcast Publisher plugin <= 4.0.11 - Server Side Request Forgery (SSRF) vulnerability 5.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.11.

  Updated 2026-04-28
• CVE-2024-32811: WordPress USPS Shipping for WooCommerce – Live Rates plugin <= 1.9.4 - Sensitive Data Exposure via Log File vulnerability 5.3 Medium

  Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4.

  Updated 2026-04-28
• CVE-2024-32810: WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability 7.6 High

  Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2.

  Updated 2026-04-28
• CVE-2024-32809: WordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in JumpDEMAND Inc. ActiveDEMAND allows Using Malicious Files.This issue affects ActiveDEMAND: from n/a through 0.2.41.

  Updated 2026-04-28
• CVE-2024-32808: WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.

  Updated 2026-04-28
• CVE-2024-32807: WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability 8.5 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal, Manipulating Web Input to File System Calls.This issue affects Sendinblue for WooCommerce: from n/a through 4.0.17.

  Updated 2026-04-28
• CVE-2024-32806: WordPress Headline Analyzer plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule Headline Analyzer.This issue affects Headline Analyzer: from n/a through 1.3.3.

  Updated 2026-04-28
• CVE-2024-32805: WordPress Social Snap plugin <= 1.3.5 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Social Snap.This issue affects Social Snap: from n/a through 1.3.5.

  Updated 2026-04-28
• CVE-2024-32804: WordPress WP GoToWebinar plugin <= 14.46 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Martin Gibson WP GoToWebinar.This issue affects WP GoToWebinar: from n/a through 14.46.

  Updated 2026-04-28
• CVE-2024-32803: WordPress SuperFaktura WooCommerce plugin <= 1.40.3 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in 2day.Sk, Webikon SuperFaktura WooCommerce.This issue affects SuperFaktura WooCommerce: from n/a through 1.40.3.

  Updated 2026-04-28
• CVE-2024-32802: WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerability 5.3 Medium

  Missing Authorization vulnerability in WordPlus BP Better Messages allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BP Better Messages: from n/a through 2.4.32.

  Updated 2026-04-28
• CVE-2024-32801: WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShapedPlugin Widget Post Slider allows Stored XSS.This issue affects Widget Post Slider: from n/a through 1.3.5.

  Updated 2026-04-28
• CVE-2024-32800: WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.This issue affects Popup More Popups: from n/a through 2.3.1.

  Updated 2026-04-28
• CVE-2024-32799: WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Merv Barrett Easy Property Listings.This issue affects Easy Property Listings: from n/a through 3.5.3.

  Updated 2026-04-28
• CVE-2024-32798: WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability 7.5 High

  Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0.

  Updated 2026-04-28
• CVE-2024-32797: WordPress WP LinkedIn Auto Publish plugin <= 8.11 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Martin Gibson WP LinkedIn Auto Publish.This issue affects WP LinkedIn Auto Publish: from n/a through 8.11.

  Updated 2026-04-28
• CVE-2024-32796: WordPress WP Fusion Lite plugin <= 3.42.10 - Sensitive Data Exposure vulnerability 4.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue affects WP Fusion Lite: from n/a through <= 3.42.10.

  Updated 2026-04-28
• CVE-2024-32795: WordPress WPCal.io <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Revmakx WPCal.Io – Easy Meeting Scheduler.This issue affects WPCal.Io – Easy Meeting Scheduler: from n/a through 0.9.5.8.

  Updated 2026-04-28
• CVE-2024-32794: WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.

  Updated 2026-04-28
• CVE-2024-32793: WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.

  Updated 2026-04-28
• CVE-2024-32792: WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.7.3.

  Updated 2026-04-28
• CVE-2024-32791: WordPress Premium Addons for Elementor plugin <= 4.10.25 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.25.

  Updated 2026-04-28

Search a CVE ID or check dependency files →