December 2024
3,514 CVEs published, −15% on November 2024 and +27% on December 2023. CISA added 16 to KEV.
2024 month by month
- Critical
- 3169% of the 3,397 with a CVSS score
- Added to CISA KEV
- 1611 of this month's CVEs are in KEV, listed a median 28 days after publication
- Vendors
- 1,6244,191 products
- Top weakness
- XSSCWE-79 · 712 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Drupal456323new
- 2LinuxLinux, Linux Kernel35403new
- 3Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»291183new
- 4Ао "нппкт"Осон Основа Оnyx272173new
- 5Ооо «ред Софт»Ред Ос256253new
- 6CanonicalUbuntu, Lxd2062nonenew
- 7Red HatRed Hat Enterprise Linux, Red Hat Build of Keycloak, Red Hat Openshift Container Platform196172new
- 8AdobeAdobe Experience Manager, Experience Manager, Adobe Connect1773nonenew
- 9Novell Inc.Opensuse Leap, Suse Linux Enterprise Server, Suse Linux Enterprise Desktop9561new
- 10MicrosoftWindows Server 2025, Windows Server 2025 (Server Core Installation), Windows Server 2022, 23h2 Edition (Server Core Installation)9131new
- 11GoogleAndroid, Chrome, Google Chrome6441new
- 12ApplemacOS, iOS and iPadOS, iPadOS626nonenew
- 13code-projectsJob Recruitment, Simple Admin Panel, Online Class and Exam Scheduling System560nonenew
- 14IBMCognos Controller, Cognos Analytics, Security Guardium Key Lifecycle Manager561nonenew
- 15HuaweiHarmonyos, Secospace USG6300 Firmware, Secospace USG6500541nonenew
- 16Ооо «открытая Мобильная Платформа»Ос Аврора, Аврора Центр54163new
- 17PhpgurukulLand Record System, Maid Hiring Management System, Online Nurse Hiring System475nonenew
- 18PackagistDrupal/core, Drupal/core-recommended, Drupal/drupal4271new
- 19GoGithub.com/siyuan-note/siyuan/kernel, Github.com/mattermost/mattermost/server/v8, Github.com/cosmwasm/wasmvm395nonenew
- 20MavenOrg.apache.tomcat:tomcat-catalina, Org.keycloak:keycloak-quarkus-server, Org.apache.tomcat.embed:tomcat-embed-core3910nonenew
- 21Ооо «нцпр»Мсвсфера3717nonenew
- 22UnknownWordPress Button Plugin Maxbuttons, Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content, System Dashboard361nonenew
- 23DellRecoverpoint For Virtual Machines, Elastic Cloud Storage, Ecs351nonenew
- 24PyPIMatrix-synapse, Apache-superset, Django325nonenew
- 25GstreamerGstreamer2916nonenew
Severity
How this month's CVEs score on CVSS; 117 have no score yet. Severity is not exploitation.
- Critical316
- High1,123
- Medium1,840
- Low118
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS712
- CWE-862Missing Authorization423
- CWE-89SQL Injection243
- CWE-352CSRF174
- CWE-787Out-of-bounds Write146
- CWE-476NULL Pointer Dereference123
- CWE-94Code Injection117
- CWE-125Out-of-bounds Read111
- CWE-74Injection105
- CWE-416Use After Free102
- CWE-22Path Traversal65
- CWE-200Information Exposure52
- CWE-434Unrestricted File Upload47
- CWE-362Race Condition45
- CWE-284Improper Access Control44
- CWE-120Buffer Overflow42
- CWE-20Improper Input Validation41
- CWE-78OS Command Injection40
- CWE-863Incorrect Authorization36
- CWE-40135
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,06227% of sector-tagged CVEs
- Operating Systems72518% of sector-tagged CVEs
- Enterprise Software43111% of sector-tagged CVEs
- OSS Libraries3208% of sector-tagged CVEs
- Consumer Software2336% of sector-tagged CVEs
- Mobile Apps2025% of sector-tagged CVEs
- 9 smaller sectors686
- Not yet classified290
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 352CSRF | 787Out-of-bounds Write | 476NULL Pointer Dereference | 94Code Injection | 125Out-of-bounds Read | 74Injection | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 9 | 1 | 7 | 1 | 21 | 85 | 2 | 26 | 6 | 58 |
| Linux | 11 | 75 | 11 | 56 | ||||||
| Ооо «русбитех-астра» | 19 | 57 | 23 | 44 | ||||||
| Ао «нппкт» | 1 | 16 | 47 | 21 | 47 | |||||
| Ооо «ред Софт» | 10 | 1 | 19 | 41 | 20 | 32 | ||||
| Canonical Ltd. | 1 | 6 | 43 | 7 | 33 | |||||
| Red Hat Inc. | 1 | 1 | 12 | 33 | 19 | 27 | ||||
| Adobe | 100 | 24 | 7 | 14 | 7 | |||||
| Adobe Systems Inc. | 100 | 24 | 6 | 11 | 7 | |||||
| Novell Inc. | 1 | 5 | 21 | 6 | 7 | |||||
| Microsoft Corp | 2 | 1 | 14 | 16 | ||||||
| Microsoft | 1 | 3 | 13 | 15 |
CVEs published in December 2024
55 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2024-12356Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)KEV9.8
- CVE-2024-55956In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by le...KEV9.8
- CVE-2024-56145RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmsKEV9.8
- CVE-2024-49138Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-53104media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatKEV7.8
- CVE-2024-53197ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesKEV7.8
- CVE-2024-3393PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted PacketKEV7.5
- CVE-2024-12987DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injectionKEV7.3
- CVE-2024-53150ALSA: usb-audio: Fix out of bounds reads when finding clock sourcesKEV7.1
- CVE-2024-12686Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)KEV6.6
- CVE-2024-55550Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could a...KEV2.7
- CVE-2024-21546Versions of the package unisharp/laravel-filemanager before 2.9.1 are vulnerable to Remote Code Execution (RCE) through using a valid mimetype and inserting the . character after the php file exten...9.8
- CVE-2024-47538GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet9.8
- CVE-2024-56058WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability9.8
- CVE-2024-47834GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate9.1
- CVE-2024-54150Algorithm Confusion Vulnerability in cjwt9.1
- CVE-2024-12381Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)8.8
- CVE-2024-12652Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')8.8
- CVE-2024-12828Webmin CGI Command Injection Remote Code Execution Vulnerability8.8
- CVE-2024-53376CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI.8.8
- CVE-2024-53691QTS, QuTS hero8.8
- CVE-2024-11858Radare2: command injection via pebble application files in radare28.6
- CVE-2024-54149Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion8.4
- CVE-2024-10516Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'8.1
- CVE-2024-52269AI Assistant PDF Document Spoofing in DocuSign8.1
- CVE-2024-55953Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability8.1
- CVE-2024-53256Rizin has a command injection via RzBinInfo bclass due legacy code7.8
- CVE-2024-47835GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser7.5
- CVE-2024-51546Credentails Disclosure7.5
- CVE-2024-53991Potential Backup file leaked via Nginx in Discourse7.5
- CVE-2024-12986DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection7.3
- CVE-2024-53106ima: fix buffer overrun in ima_eventdigest_init_common7.3
- CVE-2024-36694OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.7.2
- CVE-2024-21543Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, ...7.1
- CVE-2024-52454WordPress GoQMieruca plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2024-54381WordPress Advance Menu Manager plugin <= 3.1.1 - Settings Change vulnerability7.1
- CVE-2024-54399WordPress CRUDLab Google Plus Button plugin <= 1.0.2 - CSRF to Stored XSS vulnerability7.1
- CVE-2024-54420WordPress Metrika plugin <= 1.2 - CSRF to Stored XSS vulnerability7.1
- CVE-2024-56223WordPress Gulri Slider plugin <= 3.5.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1
- CVE-2024-12342TP-Link VN020 F3v(T) Incomplete SOAP Request WANIPConnection denial of service6.5
- CVE-2024-12539Elasticsearch Incorrect Authorization6.5
- CVE-2024-50924Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending c...6.5
- CVE-2024-47107IBM QRadar SIEM cross-site scripting6.4
- CVE-2024-12891code-projects Online Exam Mastering System account.php sql injection6.3
- CVE-2024-10858Jetpack 13.0-14.0 - Unauthenticated DOM-XSS6.1
- CVE-2024-11436Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting6.1
- CVE-2024-11805Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting6.1
- CVE-2024-51463IBM i server-side request forgery5.4
- CVE-2024-52836Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4
- CVE-2024-52840Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)5.4
- CVE-2024-52861Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)5.4
- CVE-2024-8647Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab5.4
- CVE-2024-54774Dcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create.4.8
- CVE-2024-12980code-projects Job Recruitment _all_edits.php fln_update cross site scripting4.3
- CVE-2024-12369Elytron-oidc-client: oidc authorization code injection4.2