2024 CVE Vulnerabilities
39,268 CVEs published in 2024.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2024-3572 | HIGH | 7.5 | 0.8% | Apr 16, 2024 | The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for... |
| CVE-2024-3571 | HIGH | 8.8 | 1.9% | Apr 16, 2024 | langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted director... |
| CVE-2024-3029 | HIGH | 8 | 0.7% | Apr 16, 2024 | In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to ... |
| CVE-2024-3028 | HIGH | 7.2 | 0.8% | Apr 16, 2024 | mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary f... |
| CVE-2024-1961 | HIGH | 8.8 | 1.0% | Apr 16, 2024 | vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its... |
| CVE-2024-1738 | HIGH | 7.5 | 0.5% | Apr 16, 2024 | An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.... |
| CVE-2024-1646 | HIGH | 8.2 | 0.7% | Apr 16, 2024 | parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. Th... |
| CVE-2024-1626 | HIGH | 8.1 | 0.5% | Apr 16, 2024 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, withi... |
| CVE-2024-1594 | HIGH | 7.5 | 0.7% | Apr 16, 2024 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact... |
| CVE-2024-1593 | HIGH | 7.5 | 0.7% | Apr 16, 2024 | A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smu... |
| CVE-2024-1569 | HIGH | 7.5 | 0.8% | Apr 16, 2024 | parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attack... |
| CVE-2024-1561 | HIGH | 7.5 | 9.2% | Apr 16, 2024 | An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of... |
| CVE-2024-1560 | HIGH | 8.1 | 0.9% | Apr 16, 2024 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functio... |
| CVE-2024-1558 | HIGH | 7.5 | 0.9% | Apr 16, 2024 | A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflo... |
| CVE-2024-1483 | HIGH | 7.5 | 2.7% | Apr 16, 2024 | A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on th... |
| CVE-2024-1456 | HIGH | 7.1 | 0.2% | Apr 16, 2024 | An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http... |
| CVE-2024-1135 | HIGH | 7.5 | 3.0% | Apr 16, 2024 | Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. ... |
| CVE-2024-0549 | HIGH | 8.1 | 0.8% | Apr 16, 2024 | mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a def... |
| CVE-2024-3493 | HIGH | 7.5 | 0.6% | Apr 15, 2024 | A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send lar... |
| CVE-2024-30656 | HIGH | 7.5 | 0.4% | Apr 15, 2024 | An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows attackers to cause a Denial of S... |
| CVE-2024-2424 | HIGH | 7.5 | 2.6% | Apr 15, 2024 | An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to r... |
| CVE-2024-28558 | HIGH | 8.8 | 1.2% | Apr 15, 2024 | SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote attackers to execute a... |
| CVE-2024-24485 | HIGH | 7.5 | 0.5% | Apr 15, 2024 | An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information... |
| CVE-2024-2659 | HIGH | 7.2 | 1.1% | Apr 15, 2024 | A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevat... |
| CVE-2024-22014 | HIGH | 8.8 | 0.8% | Apr 15, 2024 | An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated p... |
Check if your code is affected by 2024 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now