2024 CWE Top 25

2024 CWE Top 25: Critical Software Weaknesses Revealed

Do Son November 20, 2024

Discover the 2024 CWE Top 25 list, highlighting the most critical software weaknesses that attackers exploit. Stay informed and protect your software systems.

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-125350
Use after free in XML. Reported by anonymous on 2026-11-06. Google is aware that an exploit for CVE-2026-125350...
Admin intel📅 Updated: Nov 10, 2026
CVE-2026-123751CVSS 9.8
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not...
Watchtower Verified📅 Updated: Nov 9, 2026
CVE-2026-111793CVSS 4.3
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted....
Admin intel📅 Updated: Nov 9, 2026
CVE-2026-114713CVSS 8.6
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing...
Admin intel📅 Updated: Nov 9, 2026
CVE-2026-116779CVSS 9.8
Summary `sofia_presence_handle_sip_i_message()` splits the To user of an inbound SIP MESSAGE on `+` and treats the left half...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-102895CVSS 9.8
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0,...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-123158CVSS 8.1
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-19868CVSS 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate...
CISA KEV📅 Added to KEV: Nov 6, 2026

CVE-2026-115934CVSS 9.3
An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search,...
📅 Updated: Nov 9, 2026
CVE-2026-119756CVSS 9.3
Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated...
📅 Updated: Nov 9, 2026
CVE-2026-123488CVSS 9.3
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element...
📅 Updated: Nov 9, 2026
CVE-2026-102530CVSS 9.4
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the...
📅 Updated: Nov 9, 2026
CVE-2026-123960CVSS 9.4
A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi....
📅 Updated: Nov 9, 2026
CVE-2026-123966CVSS 10.0
A vulnerability was determined in Tenda AC19 16.03.10.07. Affected by this issue is the function saveParentControlInfo of the...
📅 Updated: Nov 9, 2026
CVE-2026-124059CVSS 9.4
A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this vulnerability is the function setWiFiWdsAddConfig...
📅 Updated: Nov 9, 2026
CVE-2026-100358CVSS 9.4
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio...
📅 Updated: Nov 9, 2026