CVE-2024-26843

CVE-2024-26843: In the Linux kernel, the EFI runtime subsystem had a fix for a potential overflow in the soft-reserved region size. Specifically, md_size could be narrowed when there are >= 4 GiB worth of pages in a soft-reserved region. The vulnerability is reported as a local vulnerability w...

CVE-2024-26843 efi: runtime: Fix potential overflow of soft-reserved region size

In the Linux kernel, the following vulnerability has been resolved: efi: runtime: Fix potential overflow of soft-reserved region size mdsize will have been narrowed if we have = 4GB worth of pages in a soft-reserved region...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an overflow problem in the size of the soft-reserved region...

CVE-2024-25911

CVE-2024-25911: WordPress MoveTo plugin

CVE-2023-40000

LiteSpeed Cache (WordPress plugin)

CVE-2023-52144

CVE-2023-52144 is a Path Traversal in the RexTheme Product Feed Manager (WordPress plugin). Connected Red Hat/ENISA/NVD entries confirm this as an Improper Limitation of a Pathname to a Restricted Directory affecting RexTheme Product Feed Manager up to version 7.3.15. The Red Hat entry notes the ...

CVE-2024-2858

CVE-2024-2858 : The WordPress plugin Simple Buttons Creator (versions

CVE-2024-2739

The CVE-2024-2739 entry concerns the WordPress plugin Advanced Search (older than or equal to 1.1.6), which lacks CSRF protections in certain areas. This absence could allow an attacker to coerce logged-in users into performing unintended actions via CSRF. The available connected documents reiter...

CVE-2024-1849

The CVE-2024-1849 entry concerns WP Customer Reviews for WordPress: versions prior to 3.7.1 expose an unvalidated parameter that allows contributors+ to redirect pages to a malicious URL. This is an Unvalidated Redirects and Forwards issue with a reported CVSS v3.1 base score of 5.4 (Medium). The...

CVE-2024-1310

CVE-2024-1310 affects WooCommerce for WordPress up to version 8.5.x (fixed in 8.6). The issue is aBroken Access Control: users with at least the contributor role could leak private, draft, or trashed products they should not access. Publicly documented by multiple sources (e.g., Patchstack, Red H...

CVE-2024-1307

CVE-2024-1307 refers to the Smart Forms WordPress plugin vulnerability. The issue is an authorization weakness in certain actions, allowing users with a low role (subscriber) to call those actions and perform unauthorized operations. Public sources in connected documents confirm the affected vers...

CVE-2024-1204

The CVE-2024-1204 issue affects the Meta Box WordPress Custom Fields Framework (versions prior to 5.9.4). It allows users with at least the Contributor role to access arbitrary custom fields assigned to other users’ posts, indicating a broken access control vulnerability. Remediation, per multipl...

CVE-2024-0902

CVE-2024-0902 affects the Fancy Product Designer WordPress plugin prior to 6.1.81. Root cause: the plugin does not sanitize and escape certain settings, allowing high-privilege users (e.g., admins) to perform Stored Cross-Site Scripting even when unfiltered_html is disallowed (e.g., multisite). I...

CVE-2023-7201

CVE-2023-7201 affects the Everest Backup WordPress plugin (versions prior to 2.2.5). The flaw allows high-privilege users (e.g., admin) to upload arbitrary files due to improper validation, including in multisite setups. Red Hat and CVE sources corroborate the same description. Remediation: upgra...

CVE-2024-2583

The CVE-2024-2583 entry concerns the WordPress plugin Shortcodes Ultimate (versions before 7.0.5). The vulnerability is a Stored XSS flaw caused by insufficient escaping of certain shortcode attributes before echoing back to users. Impactful for users with the Contributor role; requires user inte...

CVE-2023-52211

The CVE-2023-52211 entry concerns the WordPress WP Job Manager plugin (

CVE-2023-51409

Summary of CVE-2023-51409 : The WordPress plugin “AI Engine: ChatGPT Chatbot” (ai-engine) is affected by an Unrestricted Upload of File with Dangerous Type vulnerability. From the connected documents, vulnerable versions are up to 1.9.98, with unauthenticated attackers able to upload arbitrary fi...

CVE-2022-40211

CVE-2022-40211 affects the WordPress GiveWP plugin

CVE-2023-29483

CVE-2023-29483 affects dnspython (used with eventlet) and enables a remote attacker to interfere with DNS name resolution by sending an invalid UDP packet before a valid one (a TuDoor attack). Affected combo: eventlet before 0.35.2 used in dnspython before 2.6.0. The note indicates 2.6.0 is unusa...

CVE-2023-2794

ofono on Linux is affected by a stack-based buffer overflow in decode_deliver() during SMS decoding, due to a missing bound check that exists in decode_submit(). This can enable remote code execution when an attacker sends crafted SMS or via a compromised modem/malicious base station. Connected a...