CVE-2024-38487

HighCVSS 7.0/10Last modified Oct 2, 2026

Description

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Weakness enumeration

CWE-269

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 16, 2026
Last modified: Oct 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2024

CVE-2024-384889.8Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability whe CVE-2024-384894.4Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. A privileged local attacker could execute arb CVE-2024-38498.8The Click to Chat – HoliThemes plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.35. This m CVE-2024-384904.4Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute a CVE-2024-384918.4The vulnerability allows an unauthenticated attacker to read arbitrary information from the database.CVE-2024-384929.4This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a speciall CVE-2024-384936.1A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to cl CVE-2024-384948.6This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending CVE-2024-384955.3A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database.CVE-2024-384965.1The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.CVE-2024-384998.8CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admi CVE-2024-38505.4Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on