CVE-2024-29973

CVE-2024-29973 affects Zyxel NAS326 (firmware < V5.21(AAZF.17)C0) and NAS542 (firmware

CVE-2024-29972

CVE-2024-29972 affects Zyxel NAS326 (firmware < V5.21(AAZF.17)C0) and NAS542 (firmware

CVE-2024-29152

The CVE-2024-29152 issue affects Samsung Exynos baseband software in multiple processors (Samsung Mobile Processor, Wearable Processor, Exynos 980–2400; Exynos Modem 5123–5300). The root cause is improper handling of states in the RRC Reconfiguration message, which can lead to disclosure of sensi...

CVE-2023-28492

CVE-2023-28492 affects CodePeople CP Multi View Event Calendar (WordPress plugin)

CVE-2023-27460

CVE-2023-27460 affects WordPress CP Contact Form with Paypal plugin, <=1.3.34, due to Missing Authorization that could enable feedback submission abuse. A fix is available: upgrade to version 1.3.35. Public advisories show differing CVSS assessments (NVD: 8.8 HIGH; Patchstack: 4.3 MEDIUM), but...

CVE-2023-27437

CVE-2023-27437 applies to the WordPress Event Espresso 4 Decaf plugin. It describes a Missing Authorization vulnerability in Decaf, allowing functionality misuse for unauthenticated users on versions up to and including 4.10.44; mitigation is to upgrade to 4.10.45.decaf (patched). The issue is lo...

CVE-2023-26523

CVE-2023-26523 affects the WordPress plugin Calculated Fields Form (versions up to 1.1.120). The root cause is Missing Authorization, enabling functionality misuse through feedback submission. Public reports describe the vulnerability as a Missing Authorization issue in Calculated Fields Form tha...

CVE-2023-26521

CVE-2023-26521 affects the WordPress plugin Search in Place (

CVE-2023-24373

The CVE-2023-24373 entry concerns the WordPress Booking calendar, Appointment Booking System plugin. Affected versions are ≤ 3.2.3, and the root cause is an External Control of Assumed-Immutable Web Parameter that allows bypass by manipulating hidden fields. The vulnerability is categorized as a ...

CVE-2023-23738

CVE-2023-23738 affects the WordPress Spectra integration in the Ultimate Addons for Gutenberg plugin (Spectra blocks) up to version 2.3.0. The issue is an Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) that enables unauthenticated email spoofing/C...

CVE-2023-23735

CVE-2023-23735 affects the WordPress Spectra (WordPress Gutenberg Blocks) plugin. Vulnerable if using Spectra ≤ 2.3.0, where improper neutralization of script-related HTML tags enables unauthenticated email HTML injection (content injection). Root cause: inadequate input/output sanitization in th...

CVE-2023-23730

The CVE-2023-23730 issue affects the WordPress Spectra block (Ultimate Addons for Gutenberg) with Spectra versions

CVE-2024-36782

CVE-2024-36782 involves TOTOLINK CP300 (version 2.0.4-B20201102) with a hardcoded password in /etc/shadow.sample that allows an attacker to log in as root. The linked CVE details state a high-severity impact (CVSS v3.1: 9.8, network access, no user interaction) and parent advisories note root acc...

CVE-2024-36783

The TOTOLINK LR350 router (firmware V9.3.5u.6369_B20220309) contains a command injection vulnerability in NTPSyncWithHost caused by missing input validation on the host_time parameter. This allows a remote attacker to execute arbitrary commands via network access with high impact. Remediation gui...

CVE-2023-52162

Mercusys MW325R EU V3 (Firmware MW325R(EU)_V3_1.11.0 Build 221019) is affected by a stack-based buffer overflow that could allow an attacker to execute arbitrary code. Exploitation requires authentication and the vulnerability is exploitable over the network; no user interaction is required. Impa...

CVE-2024-31682

CVE-2024-31682 concerns Phone Cleaner: Boost & Clean, version 2.2.0, where an incorrect access control in the fingerprint authentication mechanism allows bypass due to a deprecated API. The CVSSv3.1 base score is 9.8 (CRITICAL), with network attack vector, no privileges required, and user interac...

CVE-2024-31684

CVE-2024-31684 concerns Bitdefender Mobile Security (v4.11.3-gms), where the fingerprint authentication mechanism has incorrect access control due to the use of a deprecated API, enabling bypass of biometric checks. The CVSS implies low impact with limited scope (physical attack, no user interact...

CVE-2022-1242

CVE-2022-1242 affects the Ubuntu Apport component. The issue allows a local attacker to trick Apport into connecting to arbitrary sockets as root due to improper handling of Apport sockets (in containers too). Affected advisories include USN-6894-1 and related Red Hat/Nessus/OpenVAS entries; patc...

CVE-2021-3899

CVE-2021-3899 involves a race condition in Apport's replaced-executable detection that, with specific local configuration, could allow a local attacker to run arbitrary code as root. This vulnerability is referenced in multiple advisories (Ubuntu USN-6894-1, RH Red Hat CVE notes, and Nessus/OSV e...

CVE-2022-0555

CVE-2022-0555 concerns Subiquity, the Ubuntu Server installer. Affected: Subiquity's guided storage handling allows a passphrase to be shown in plaintext with read-all permissions. Root cause details are not explicitly provided in the supplied documents, but the consequence is exposure of the sto...