Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.
Matching cohort: 956 published records · 4 KEV · 956 with a forecast · 0 unknown dates
956 matching published records · 0 with an unknown publication date
Every segment and month is a link that preserves the other filters.
Share of cohort: KEV 0.42% · forecast 100% · unscored 100%.
GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF
Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the GPU HW.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-30T02:39:25.336Z. Updated 2024-12-01T23:03:00.888Z.
GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages
Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-30T02:30:25.404Z. Updated 2024-12-01T23:04:15.021Z.
Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its Cookie Consent block options before outputting them back in a page/post where the block is embed, which could allow users with the contrib…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T06:00:07.501Z. Updated 2024-11-29T14:54:11.431Z.
Photo Gallery by 10Web < 1.8.31 - Admin+ Stored XSS
The Photo Gallery by 10Web WordPress plugin before 1.8.31 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T06:00:07.129Z. Updated 2024-11-29T14:51:23.442Z.
CVE-2024-35366
FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-03T14:11:35.604Z.
CVE-2024-35367
FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2025-11-03T20:37:34.361Z.
CVE-2024-35368
FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2025-11-03T20:37:35.749Z.
CVE-2024-35369
In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or cra…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-11-29T17:11:05.845Z.
CVE-2024-35371
Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-02T16:25:17.786Z.
CVE-2024-35451
LinkStack 2.7.9 through 4.7.7 allows resources\views\components\favicon.blade.php link SSRF.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-02T19:35:23.576Z.
CVE-2024-36611
In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of se…
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2025-01-06T17:44:44.438Z.
CVE-2024-36612
Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-02T16:35:49.772Z.
CVE-2024-36615
FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-03T15:24:20.233Z.
CVE-2024-36616
An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-02T17:41:37.389Z.
CVE-2024-36617
FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-02T17:57:09.775Z.
CVE-2024-36618
FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2025-11-03T20:37:49.706Z.
CVE-2024-36619
FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-11-29T18:06:36.151Z.
CVE-2024-36620
moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-04T17:14:27.602Z.
CVE-2024-36621
moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-04T17:13:36.018Z.
CVE-2024-36622
In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.
Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.
Published 2024-11-29T00:00:00.000Z. Updated 2024-12-03T15:26:18.611Z.