CVE-2024-26920

CVE-2024-26920: In the Linux kernel, the tracing/trigger path (register_snapshot_trigger) could allocate a snapshot and erroneously report success (0) when allocation failed. The fix returns an error code on allocation failure, preventing registration of a snapshot trigger without error. This is ...

CVE-2024-26917

CVE-2024-26917 affects the Linux kernel SCSI/FCoE path. The vulnerability stems from reverting a commit that changed spin lock usage for FCoE devices (from bh to irqsave), which caused interrupts to be lost for FCoE devices. The problem was introduced in the patch set around scsi: fcoe: Fix poten...

CVE-2024-26915

CVE-2024-26915 concerns the Linux kernel DRM AMDGPU driver. The root cause is the Reset IH OVERFLOW_CLEAR bit, which allows detection of subsequent IH ring buffer overflows. Affected component: drm/amdgpu in the Linux kernel. Impact as stated: potential availability impact with local, low-privile...

CVE-2024-26914

CVE-2024-26914 concerns the Linux kernel DRM/AMD display path. The root cause is an incorrect mpc_combine array size:MAX_SURFACES was used instead of MAX_PLANES, causing an overflow when more than 3 planes are present. The patch uses MAX_PLANES as the array size, addressing the issue. The vulnera...

CVE-2024-26913

Mode C: The CVE-2024-26913 issue concerns the Linux kernel DRM/AMD display driver (dcn35 8k30) where odm calculation was missing for pipe-split policy, causing Underflow/Corruption. The fix adds the missing odm calculation. Public references in connected docs point to kernel commits addressing th...

CVE-2024-26910

CVE-2024-26910 – Linux kernel netfilter ipset swap operation is fixed by patch 28628fa9, which resolves a race between swap/destroy and kernel side add/del/test. The issue arose because a synchronize_rcu() added to the swap path slowed it down; the patch moves the synchronization to destroy and u...

CVE-2024-30253

The CVE concerns @solana/web3.js (Solana JavaScript SDK). Certain inputs can trigger memory exhaustion (OOM), causing an application or service to crash and potentially lose availability. Affected releases are numerous; remediation is to upgrade to the fixed versions listed in the advisory (examp...

CVE-2024-29035

CVE-2024-29035 affects Umbraco CMS (ASP.NET). The issue is information disclosure through failing webhook logs that expose sensitive data when the solution is not in debug mode. The vulnerability is mitigated by upgrading to Umbraco 13.1.1 (or applying the fix described in the associated advisori...

CVE-2024-3910

CVE-2024-3910 affects Tenda AC500 2.0.1.9(1307). The flaw is in the fromDhcpListClient function (file /goform/DhcpListClient) where manipulating the page parameter causes a stack-based buffer overflow. Impact is described as remote code execution with high severity/impact across confidentiality, ...

CVE-2024-3333

CVE-2024-3333 affects Essential Addons for Elementor (WordPress). It is a Stored XSS via widget URL attributes in versions up to 5.9.14, exploitable by authenticated attackers with contributor-level access or higher; scripts run when users visit injected pages. CVSS v3.1 base score 6.4 (AV:N/AC:L...

CVE-2024-3909

CVE-2024-3909 affects Tenda AC500 firmware version 2.0.1.9(1307). The vulnerability lies in the formexeCommand function of /goform/execCommand, where improper handling of the cmdinput parameter causes a stack-based buffer overflow. This can be triggered remotely, and public exploit details exist ...

CVE-2024-3908

CVE-2024-3908 affects Tenda AC500 firmware 2.0.1.9(1307). The flaw is a command-injection in the formWriteFacMac function of /goform/WriteFacMac triggered by manipulating the mac argument. Impact is remote code execution with high confidentiality/integrity/availability risk as per CVSS data; expl...

CVE-2024-3907

CVE-2024-3907 affects Tenda AC500 2.0.1.9(1307). The vulnerability is in the formSetCfm function of /goform/setcfm, where manipulating the funcpara1 argument triggers a stack-based buffer overflow. It is a network‑bound issue with remote potential; the exploit has been disclosed publicly. Public ...

CVE-2023-51418

CVE-2023-51418 affects the JVM Gutenberg Rich Text Icons WordPress plugin. Public docs show a Missing Authorization vulnerability that enables authenticated users to perform unauthorized actions, including directory traversal leading to Arbitrary File Deletion or similar file operations, impactin...

CVE-2023-51500

CVE-2023-51500 affects Undsgn Uncode Core (

CVE-2024-3906

CVE-2024-3906 affects Tenda AC500 (version 2.0.1.9(1307)) via the formQuickIndex function in /goform/QuickIndex. The root cause is a stack-based buffer overflow triggered when the PPPOEPassword parameter is manipulated, enabling remote exploitation. Publicized exploit details indicate in-the-wild...

CVE-2024-26908

CVE-2024-26908 is a Linux kernel issue where the advisory notes adding null pointer checks in kernel/x86/smp.c (x86/xen path). Connected advisories (RHSA-2024:6992, RHSA-2024:5992/5928 equivalents, ELSA-2024-5928) indicate affected kernel builds in Red Hat, Oracle Linux, and related distributions...

CVE-2024-26905

CVE-2024-26905 is rejected by the CNA and not a valid vulnerability entry.

CVE-2024-26903

CVE-2024-26903 (Linux kernel) : Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security. Root cause: after RFCOMM/L2CAP disconnect, the code could dereference a released l2cap_conn, leading to a null pointer access when calling hci_conn_security. Impact per CVSS: Medium (5.5) with high ava...

CVE-2024-26898

Summary: CVE-2024-26898 relates to the AoE driver in the Linux kernel where aoecmd_cfg_pkts() incorrectly handled the refcnt of net_device, enabling a potential use-after-free via racing with tx paths. The issue has been resolved by patch f98364e92662, which stops calling dev_put(ifp) in the succ...