NVD Vulnerability Information Top

Show Search Menu

Vendor Name
プロダクト・サービス名
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
In descending order of publication date
In descending order of update date
Number of items displayed

NVD Vulnerability Information Top

You can search the list of vulnerabilities managed by the NVD (National Vulnerability Database).
Since vulnerability information is often updated before JVN (Japan Vulnerability Note), vulnerabilities that are not listed in JVN may be updated.

If there is a vulnerability related to JVN (Japan Vulnerability Note), the information will be displayed on the detail page.

To search by CWE, please refer to the CWE Overview and check the CWE number.

CRITICAL
HIGH
MEDIUM
LOW

Update Date:June 10, 2026, 5 a.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Show Affected	Exploit PoC Search
319001	4.3	MEDIUM Network	-	-	IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.	-	CVE-2024-8059	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319002	6.8	MEDIUM Physics	-	-	A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges by accessing an embedded UEFI shell.	-	CVE-2024-7756	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319003	6.7	MEDIUM Local	-	-	A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacker with elevated privileges to execute arbitrary code.	-	CVE-2024-4550	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319004	6.7	MEDIUM Local	-	-	An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execu…	-	CVE-2024-45105	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319005	6.8	MEDIUM Network	-	-	A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince …	-	CVE-2024-45101	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319006	-	-	-	-	A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code.	-	CVE-2024-3100	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319007	-	-	-	-	The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, there's an observed anomaly in the H2-DM1E PLC's protocol execu…	CWE-384 Session Fixation	CVE-2024-45368	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319008	-	-	-	-	The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to ma…	-	CVE-2024-43099	2024-09-14 20:47	2024-09-14	Show	GitHub Exploit DB Packet Storm

319009	7.5	HIGH Network	fastadmin	fastadmin	A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipula…	CWE-22 Path Traversal	CVE-2024-7928	2024-09-14 06:33	2024-08-20	Show	GitHub Exploit DB Packet Storm

319010	9.8	CRITICAL Network	eyecix	jobsearch_wp_job_board	Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.	CWE-502 Deserialization of Untrusted Data	CVE-2024-43931	2024-09-14 06:22	2024-08-30	Show	GitHub Exploit DB Packet Storm

319011	5.4	MEDIUM Network	qnap	notes_station_3	A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We hav…	CWE-79 Cross-site Scripting	CVE-2024-27122	2024-09-14 06:16	2024-09-7	Show	GitHub Exploit DB Packet Storm

319012	5.3	MEDIUM Network	-	-	Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.	-	CVE-2024-40430	2024-09-14 06:15	2024-07-22	Show	GitHub Exploit DB Packet Storm

319013	8.8	HIGH Network	qnap	qts quts_hero	An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. QuTSclou…	CWE-78 OS Command	CVE-2023-34974	2024-09-14 06:14	2024-09-7	Show	GitHub Exploit DB Packet Storm

319014	6.2	MEDIUM Local	huawei	emui harmonyos	Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may affect service confidentiality.	NVD-CWE-noinfo	CVE-2024-42037	2024-09-14 06:13	2024-08-8	Show	GitHub Exploit DB Packet Storm

319015	6.1	MEDIUM Network	qnap	qulog_center	A cross-site scripting (XSS) vulnerability has been reported to affect QuLog Center. If exploited, the vulnerability could allow users to inject malicious code via a network. We have already fixed t…	CWE-79 Cross-site Scripting	CVE-2024-32762	2024-09-14 06:10	2024-09-7	Show	GitHub Exploit DB Packet Storm

319016	7.5	HIGH Network	huawei	harmonyos emui	Access permission verification vulnerability in the Notepad module Impact: Successful exploitation of this vulnerability may affect service confidentiality.	NVD-CWE-noinfo	CVE-2024-42036	2024-09-14 06:09	2024-08-8	Show	GitHub Exploit DB Packet Storm

319017	9.8	CRITICAL Network	wpwebelite	docket	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPWeb Elite Docket (WooCommerce Collections / Wishlist / Watchlist) allows SQL Injection.This iss…	CWE-89 SQL Injection	CVE-2024-43132	2024-09-14 06:07	2024-08-30	Show	GitHub Exploit DB Packet Storm

319018	4.8	MEDIUM Network	qnap	helpdesk	A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated administrators to inject malicious code via a network. We h…	CWE-79 Cross-site Scripting	CVE-2024-27125	2024-09-14 06:06	2024-09-7	Show	GitHub Exploit DB Packet Storm

319019	7.2	HIGH Network	salonbookingsystem	salon_booking_system	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Salon Booking System Salon booking system allows SQL Injection.This issue affects Salon booking s…	CWE-89 SQL Injection	CVE-2024-39658	2024-09-14 06:04	2024-08-30	Show	GitHub Exploit DB Packet Storm

319020	9.8	CRITICAL Network	e4jconnect	vikrentcar	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E4J s.R.L. VikRentCar allows SQL Injection.This issue affects VikRentCar: from n/a through 1.4.0.	CWE-89 SQL Injection	CVE-2024-39653	2024-09-14 06:03	2024-08-30	Show	GitHub Exploit DB Packet Storm

319021	8.8	HIGH Network	roundupwp	registrations_for_the_events_calendar	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roundup WP Registrations for the Events Calendar allows SQL Injection.This issue affects Registra…	CWE-89 SQL Injection	CVE-2024-39638	2024-09-14 06:00	2024-08-30	Show	GitHub Exploit DB Packet Storm

319022	8.8	HIGH Network	pricelisto	great_restaurant_menu_wp	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PriceListo Best Restaurant Menu by PriceListo allows SQL Injection.This issue affects Best Restau…	CWE-89 SQL Injection	CVE-2024-38793	2024-09-14 05:57	2024-08-30	Show	GitHub Exploit DB Packet Storm

319023	6.1	MEDIUM Network	wpengine	advanced_custom_fields	Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the 'capability' setting …	CWE-79 Cross-site Scripting	CVE-2024-45429	2024-09-14 05:48	2024-09-5	Show	GitHub Exploit DB Packet Storm

319024	8.8	HIGH Network	dell	smartfabric_os10	Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A…	CWE-77 Command Injection	CVE-2024-38486	2024-09-14 05:36	2024-09-6	Show	GitHub Exploit DB Packet Storm

319025	7.2	HIGH Network	wedevs	wp_user_frontend	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP User Frontend allows SQL Injection.This issue affects WP User Frontend: from n/a throug…	CWE-89 SQL Injection	CVE-2024-38693	2024-09-14 05:35	2024-08-29	Show	GitHub Exploit DB Packet Storm

319026	5.4	MEDIUM Network	qnap	notes_station_3	A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We hav…	CWE-79 Cross-site Scripting	CVE-2024-27126	2024-09-14 05:31	2024-09-7	Show	GitHub Exploit DB Packet Storm

319027	7.5	HIGH Network	accordors	accord_ors	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data.This issue affects Accord ORS: before 7.3.2.1.	NVD-CWE-noinfo	CVE-2024-1744	2024-09-14 05:30	2024-09-6	Show	GitHub Exploit DB Packet Storm

319028	6.1	MEDIUM Network	br-automation	industrial_automation_aprol	Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript code in the context of the user's brows…	CWE-79 Cross-site Scripting	CVE-2024-5624	2024-09-14 05:23	2024-08-29	Show	GitHub Exploit DB Packet Storm

319029	7.8	HIGH Local	br-automation	industrial_automation_aprol	An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated …	CWE-426 Untrusted Search Path	CVE-2024-5622	2024-09-14 05:21	2024-08-29	Show	GitHub Exploit DB Packet Storm

319030	7.8	HIGH Local	br-automation	industrial_automation_aprol	An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.	CWE-426 Untrusted Search Path	CVE-2024-5623	2024-09-14 05:19	2024-08-29	Show	GitHub Exploit DB Packet Storm

319031	8.8	HIGH Network	portabilis	i-educar	i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 b…	CWE-89 SQL Injection	CVE-2024-45059	2024-09-14 05:09	2024-08-29	Show	GitHub Exploit DB Packet Storm

319032	8.1	HIGH Network	portabilis	i-educar	i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. Prior to the 2.9 branch, an attacker with only minimal vie…	CWE-862 Missing Authorization	CVE-2024-45058	2024-09-14 05:06	2024-08-29	Show	GitHub Exploit DB Packet Storm

319033	6.1	MEDIUM Network	portabilis	i-educar	i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting (XSS) vulnerability was i…	CWE-79 Cross-site Scripting	CVE-2024-45057	2024-09-14 05:03	2024-08-29	Show	GitHub Exploit DB Packet Storm

319034	7.5	HIGH Network	huawei	harmonyos emui	Vulnerability of permission verification for APIs in the DownloadProviderMain module Impact: Successful exploitation of this vulnerability will affect availability.	NVD-CWE-noinfo	CVE-2024-45442	2024-09-14 05:00	2024-09-4	Show	GitHub Exploit DB Packet Storm

319035	5.4	MEDIUM Network	squaredup	squaredup_ds_for_scom	SquaredUp DS for SCOM 6.2.1.11104 allows XSS.	CWE-79 Cross-site Scripting	CVE-2024-45180	2024-09-14 04:55	2024-09-4	Show	GitHub Exploit DB Packet Storm

319036	8.1	HIGH Network	idec	windo\/i-nv4 windldr	Cleartext storage of sensitive information vulnerability exists in WindLDR and WindO/I-NV4. If this vulnerability is exploited, an attacker who obtained the product's project file may obtain user cre…	CWE-312 Cleartext Storage of Sensitive Information	CVE-2024-41716	2024-09-14 04:53	2024-09-4	Show	GitHub Exploit DB Packet Storm

319037	4.3	MEDIUM Network	audiobookshelf	audiobookshelf	audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or access only the ones they have permission to). However, the `LibraryController` i…	CWE-22 Path Traversal	CVE-2024-43797	2024-09-14 04:49	2024-09-3	Show	GitHub Exploit DB Packet Storm

319038	9.8	CRITICAL Network	zyxel	nwa110ax_firmware nwa1123-ac_pro_firmware nwa1123acv3_firmware nwa130be_firmware nwa210ax_firmware nwa220ax-6e_firmware nwa50ax_firmware nwa50ax_pro_firmware nwa55axe_firmware…	The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC500 firmware version 6.70(ABVS.4) and e…	CWE-78 OS Command	CVE-2024-7261	2024-09-14 04:39	2024-09-3	Show	GitHub Exploit DB Packet Storm

319039	9.8	CRITICAL Network	cisco	smart_license_utility	A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential. This vulnerability is …	CWE-798 Use of Hard-coded Credentials	CVE-2024-20439	2024-09-14 04:35	2024-09-5	Show	GitHub Exploit DB Packet Storm

319040	5.3	MEDIUM Network	funnelforms	funnelforms_free	The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability…	CWE-862 Missing Authorization	CVE-2024-7447	2024-09-14 04:33	2024-08-28	Show	GitHub Exploit DB Packet Storm

319041	5.3	MEDIUM Network	permalink_manager_lite_project	permalink_manager_lite	The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'debug_data', 'debug_query', and 'debug_redirect' functions in al…	CWE-862 Missing Authorization	CVE-2024-8195	2024-09-14 04:28	2024-08-28	Show	GitHub Exploit DB Packet Storm

319042	5.5	MEDIUM Local	cisco	duo_authentication_for_epic	A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system. This vulnerability is due to imprope…	CWE-311 Missing Encryption of Sensitive Data	CVE-2024-20503	2024-09-14 04:24	2024-09-5	Show	GitHub Exploit DB Packet Storm

319043	9.8	CRITICAL Network	fabianros	hospital_management_system	A vulnerability was found in code-projects Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component L…	CWE-89 SQL Injection	CVE-2024-8368	2024-09-14 04:23	2024-09-1	Show	GitHub Exploit DB Packet Storm

319044	3.9	LOW Physics	redhat opensc_project	enterprise_linux opensc	A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially craft…	CWE-908 Use of Uninitialized Resource	CVE-2024-45617	2024-09-14 04:21	2024-09-4	Show	GitHub Exploit DB Packet Storm

319045	3.9	LOW Physics	redhat opensc_project	enterprise_linux opensc	A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially craft…	CWE-908 Use of Uninitialized Resource	CVE-2024-45616	2024-09-14 04:21	2024-09-4	Show	GitHub Exploit DB Packet Storm

319046	3.9	LOW Physics	redhat opensc_project	enterprise_linux opensc	A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be initialized (as arguments to other function…	CWE-908 Use of Uninitialized Resource	CVE-2024-45615	2024-09-14 04:21	2024-09-4	Show	GitHub Exploit DB Packet Storm

319047	5.4	MEDIUM Network	wpzoom	wpzoom_portfolio	The WPZOOM Portfolio Lite – Filterable Portfolio Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within the 'wp:wpzoom-blocks' Gutenberg block in al…	CWE-79 Cross-site Scripting	CVE-2024-8276	2024-09-14 04:19	2024-08-31	Show	GitHub Exploit DB Packet Storm

319048	6.5	MEDIUM Network	microfocus	netiq_advanced_authentication	A vulnerability identified in storing and reusing information in Advance Authentication. This issue can lead to leakage of sensitive data to unauthorized user. The issue affects NetIQ Advance Authent…	CWE-312 Cleartext Storage of Sensitive Information	CVE-2021-22509	2024-09-14 03:05	2024-08-28	Show	GitHub Exploit DB Packet Storm

319049	8.8	HIGH Adjacent	microfocus	netiq_advanced_authentication	Insufficient or weak TLS protocol version identified in Advance authentication client server communication when specific service is accessed between devices. This issue affects NetIQ Advance Authent…	CWE-326 Inadequate Encryption Strength	CVE-2021-38121	2024-09-14 03:04	2024-08-28	Show	GitHub Exploit DB Packet Storm

319050	7.2	HIGH Network	microfocus	netiq_advanced_authentication	A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. T…	CWE-77 Command Injection	CVE-2021-38120	2024-09-14 03:04	2024-08-28	Show	GitHub Exploit DB Packet Storm