Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2022

123 records · 16 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2021-4039
    60This week

    A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS com

    CriticalCVSS 9.8Proof of conceptEPSS 71%

    zyxel · nwa1100-nh firmwareMar 1, 2022

  • CVE-2021-46387
    30Monitor

    ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS).

    MediumCVSS 6.1Proof of conceptEPSS 20%

    zyxel · zywall 2 plus internet security appliance firmwareMar 1, 2022

  • CVE-2021-41282
    61This week

    diag_routes.php in pfSense 2.5.2 allows sed data injection.

    HighCVSS 8.8WeaponizedEPSS 87%

    pfsense · pfsenseMar 1, 2022

  • CVE-2022-0824
    64This week

    Improper Access Control to Remote Code Execution in webmin/webmin

    HighCVSS 8.8WeaponizedEPSS 96%

    webmin · webminMar 2, 2022

  • CVE-2022-23779
    25Monitor

    Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone.

    MediumCVSS 5.3Proof of conceptEPSS 13%

    zohocorp · manageengine desktop centralMar 2, 2022

  • CVE-2022-0819
    47Plan

    Code Injection in dolibarr/dolibarr

    HighCVSS 8.8No exploitEPSS 41%

    dolibarr · dolibarr erp\/crmMar 2, 2022

  • CVE-2022-0711
    35Monitor

    A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header.

    HighCVSS 7.5No exploitEPSS 16%

    haproxy · haproxyMar 2, 2022

  • CVE-2021-3654
    32Monitor

    A vulnerability was found in openstack-nova's console proxy, noVNC.

    MediumCVSS 6.1Proof of conceptEPSS 26%

    openstack · novaMar 2, 2022

  • CVE-2022-22909
    49Plan

    HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a craft

    HighCVSS 8.8Proof of conceptEPSS 45%

    digitaldruid · hoteldruidMar 2, 2022

  • CVE-2022-25089
    45Plan

    Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks

    CriticalCVSS 9.8Proof of conceptEPSS 18%

    kofax · printixMar 2, 2022

  • CVE-2022-23648
    38Monitor

    Insecure handling of image volumes in containerd CRI plugin

    HighCVSS 7.5Proof of conceptEPSS 27%

    linuxfoundation · containerdMar 3, 2022

  • CVE-2022-22706
    61This week

    Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    arm · bifrost gpu kernel driverMar 3, 2022

  • CVE-2022-0492
    63This week

    A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.

    HighCVSS 7.8KEVWeaponizedEPSS 5%

    linux · linux kernelMar 3, 2022

  • CVE-2022-22947
    99Now

    In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuat

    CriticalCVSS 10.0KEVWeaponizedEPSS 98%

    vmware · spring cloud gatewayMar 3, 2022

  • CVE-2022-0848
    50Plan

    OS Command Injection in part-db/part-db

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    part-db project · part-dbMar 4, 2022

  • CVE-2021-46393
    44Plan

    There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN.

    CriticalCVSS 9.8No exploitEPSS 15%

    tenda · ax3 firmwareMar 4, 2022

  • CVE-2022-0832
    41Plan

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    MediumCVSS 5.4No exploitEPSS 66%

    pimcore · pimcoreMar 4, 2022

  • CVE-2021-46378
    40Plan

    DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration downlo

    HighCVSS 7.5Proof of conceptEPSS 31%

    dlink · dir-850l firmwareMar 4, 2022

  • CVE-2021-46379
    29Monitor

    DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site.

    MediumCVSS 6.1Proof of conceptEPSS 15%

    dlink · dir-850l firmwareMar 4, 2022

  • CVE-2021-46381
    48Plan

    Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].

    HighCVSS 7.5Proof of conceptEPSS 58%

    dlink · dap-1620 firmwareMar 4, 2022

  • CVE-2022-26318
    92Now

    On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786.

    CriticalCVSS 9.8KEVWeaponizedEPSS 78%

    watchguard · firewareMar 4, 2022

  • CVE-2021-44827
    51Plan

    There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_Ext

    HighCVSS 8.8Proof of conceptEPSS 53%

    tp-link · archer c20i firmwareMar 4, 2022

  • CVE-2021-3737
    34Monitor

    A flaw was found in python.

    HighCVSS 7.5No exploitEPSS 13%

    python · pythonMar 4, 2022

  • CVE-2021-46704
    46Plan

    In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/u

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    genieacs · genieacsMar 6, 2022

  • CVE-2022-0349
    49Plan

    NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    wpdeveloper · notificationxMar 7, 2022

  • CVE-2022-0434
    43Plan

    Page Views Count < 2.4.15 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    a3rev · page view countMar 7, 2022

  • CVE-2022-0441
    65This week

    MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

    CriticalCVSS 9.8WeaponizedEPSS 85%

    stylemixthemes · masterstudy lmsMar 7, 2022

  • CVE-2022-24713
    34Monitor

    Regular expression denial of service in Rust's regex crate

    HighCVSS 7.5Proof of conceptEPSS 14%

    rust-lang · regexMar 8, 2022

  • CVE-2022-24715
    39Monitor

    Arbitrary code execution for authenticated users in Icinga Web 2

    HighCVSS 8.8Proof of conceptEPSS 14%

    icinga · icinga web 2Mar 8, 2022

  • CVE-2022-24716
    60This week

    Path traversal in Icinga Web 2

    HighCVSS 7.5WeaponizedEPSS 89%

    icinga · icinga web 2Mar 8, 2022

  • CVE-2022-0482
    49Plan

    Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

    CriticalCVSS 9.1Proof of conceptEPSS 43%

    easyappointments · easyappointmentsMar 9, 2022

  • CVE-2022-21990
    41Plan

    Remote Desktop Client Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 18%

    microsoft · windows 10Mar 9, 2022

  • CVE-2022-23253
    43Plan

    Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 56%

    microsoft · windows 10Mar 9, 2022

  • CVE-2022-23277
    47Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.8WeaponizedEPSS 41%

    microsoft · exchange serverMar 9, 2022

  • CVE-2022-23285
    43Plan

    Remote Desktop Client Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 25%

    microsoft · windows 10Mar 9, 2022

  • CVE-2022-24463
    36Monitor

    Microsoft Exchange Server Spoofing Vulnerability

    MediumCVSS 6.5No exploitEPSS 31%

    microsoft · exchange serverMar 9, 2022

  • CVE-2022-24502
    27Monitor

    Windows HTML Platforms Security Feature Bypass Vulnerability

    MediumCVSS 4.3No exploitEPSS 33%

    microsoft · windows 10Mar 9, 2022

  • CVE-2022-22805
    43Plan

    A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code executio

    CriticalCVSS 9.8No exploitEPSS 11%

    schneider-electric · smt series 1015 ups firmwareMar 9, 2022

  • CVE-2022-22806
    43Plan

    A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a mal

    CriticalCVSS 9.8No exploitEPSS 12%

    schneider-electric · smt series 1015 ups firmwareMar 9, 2022

  • CVE-2022-24734
    51Plan

    Remote code execution in mybb

    HighCVSS 7.2WeaponizedEPSS 77%

    mybb · mybbMar 9, 2022

  • CVE-2021-4045
    61This week

    TP-LINK Tapo C200 remote code execution vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    tp-link · tapo c200 firmwareMar 10, 2022

  • CVE-2022-0847
    89Now

    A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe

    HighCVSS 7.8KEVWeaponizedEPSS 92%

    linux · linux kernelMar 10, 2022

  • CVE-2022-22835
    30Monitor

    An issue was discovered in OverIT Geocall before version 8.0.

    MediumCVSS 6.5No exploitEPSS 14%

    overit · geocallMar 10, 2022

  • CVE-2022-23940
    51Plan

    SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.

    HighCVSS 8.8Proof of conceptEPSS 53%

    salesagility · suitecrmMar 10, 2022

  • CVE-2022-24995
    43Plan

    Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime.

    CriticalCVSS 9.8No exploitEPSS 13%

    tenda · ax3 firmwareMar 10, 2022

  • CVE-2022-25090
    35Monitor

    Printix Secure Cloud Print Management through 1.3.1106.0 creates a temporary temp.ini file in a directory with insecure permissions, leading

    HighCVSS 8.1Proof of conceptEPSS 11%

    kofax · printixMar 10, 2022

  • CVE-2022-25546
    34Monitor

    Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow in the function formSetSysToolDDNS.

    HighCVSS 7.5No exploitEPSS 12%

    tenda · ax1806 firmwareMar 10, 2022

  • CVE-2022-26143
    95Now

    The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to

    CriticalCVSS 9.8KEVWeaponizedEPSS 87%

    mitel · micollabMar 10, 2022

  • CVE-2018-25031
    30Monitor

    Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks.

    MediumCVSS 4.3Proof of conceptEPSS 42%

    smartbear · swagger uiMar 11, 2022

  • CVE-2022-25216
    34Monitor

    An absolute path traversal vulnerability allows a remote attacker to download any file on the Windows file system for which the user account

    HighCVSS 7.5Proof of conceptEPSS 13%

    dvdfab · 12 playerMar 11, 2022

  • CVE-2022-24760
    55Plan

    Command Injection in Parse server

    CriticalCVSS 10.0Proof of conceptEPSS 49%

    parseplatform · parse-serverMar 11, 2022

  • CVE-2022-22719
    51Plan

    mod_lua Use of uninitialized value of in r:parsebody

    HighCVSS 7.5No exploitEPSS 69%

    apache · http serverMar 14, 2022

  • CVE-2022-22720
    47Plan

    HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    apache · http serverMar 14, 2022

  • CVE-2022-22721
    49Plan

    core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

    CriticalCVSS 9.1No exploitEPSS 41%

    apache · http serverMar 14, 2022

  • CVE-2022-23943
    54Plan

    mod_sed: Read/write beyond bounds

    CriticalCVSS 9.8No exploitEPSS 50%

    apache · http serverMar 14, 2022

  • CVE-2021-25003
    56Plan

    WPCargo < 6.9.0 - Unauthenticated RCE

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    wptaskforce · wpcargo track \& traceMar 14, 2022

  • CVE-2022-0169
    61This week

    Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection

    CriticalCVSS 9.8WeaponizedEPSS 74%

    10web · photo galleryMar 14, 2022

  • CVE-2021-45010
    56Plan

    A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attac

    HighCVSS 8.8Proof of conceptEPSS 70%

    prasathmani · tiny file managerMar 15, 2022

  • CVE-2022-25487
    55Plan

    Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.

    CriticalCVSS 9.8Proof of conceptEPSS 53%

    thedigitalcraft · atomcmsMar 15, 2022

  • CVE-2022-0778
    52Plan

    Infinite loop in BN_mod_sqrt() reachable when parsing certificates

    HighCVSS 7.5Proof of conceptEPSS 73%

    openssl · opensslMar 15, 2022

  • CVE-2022-26213
    47Plan

    Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via t

    CriticalCVSS 9.8No exploitEPSS 25%

    totolink · x5000r firmwareMar 15, 2022

  • CVE-2021-39793
    61This week

    In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code.

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    google · androidMar 16, 2022

  • CVE-2021-41987
    37Monitor

    In the SCEP Server of RouterOS in certain Mikrotik products, an attacker can trigger a heap-based buffer overflow that leads to remote code

    HighCVSS 8.1No exploitEPSS 16%

    mikrotik · routerosMar 16, 2022

  • CVE-2022-0811
    41Plan

    A flaw was found in CRI-O in the way it set kernel options for a pod.

    HighCVSS 8.8Proof of conceptEPSS 19%

    kubernetes · cri-oMar 16, 2022

  • CVE-2021-44261
    27Monitor

    A vulnerability is in the 'BRS_top.html' page of the Netgear W104, version WAC104-V1.0.4.13, which can allow a remote attacker to access thi

    MediumCVSS 5.3No exploitEPSS 20%

    netgear · wac104 firmwareMar 17, 2022

  • CVE-2022-26500
    67This week

    Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to inte

    HighCVSS 8.8KEVWeaponizedEPSS 5%

    veeam · veeam backup \& replicationMar 17, 2022

  • CVE-2022-26501
    70This week

    Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).

    CriticalCVSS 9.8KEVWeaponizedEPSS 4%

    veeam · veeam backup \& replicationMar 17, 2022

  • CVE-2021-45967
    45Plan

    An issue was discovered in Pascom Cloud Phone System before 7.20.x.

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    pascom · cloud phone systemMar 18, 2022

  • CVE-2021-45968
    33Monitor

    An issue was discovered in xmppserver jar in the XMPP Server component of the JIve platform, as used in Pascom Cloud Phone System before 7.2

    HighCVSS 7.5Proof of conceptEPSS 10%

    pascom · cloud phone systemMar 18, 2022

  • CVE-2022-26965
    39Monitor

    In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

    HighCVSS 7.2Proof of conceptEPSS 36%

    pluck-cms · pluckMar 18, 2022

  • CVE-2022-24637
    69This week

    Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to g

    CriticalCVSS 9.8WeaponizedEPSS 99%

    openwebanalytics · open web analyticsMar 18, 2022

  • CVE-2020-25176
    41Plan

    Rockwell Automation ISaGRAF5 Runtime Relative Path Traversal

    CriticalCVSS 9.8No exploitEPSS 6%

    schneider-electric · easergy t300 firmwareMar 18, 2022

  • CVE-2022-22587
    72This week

    A memory corruption issue was addressed with improved input validation.

    CriticalCVSS 9.8KEVWeaponizedEPSS 11%

    apple · ipadosMar 18, 2022

  • CVE-2022-22620
    70This week

    A use after free issue was addressed with improved memory management.

    HighCVSS 8.8KEVWeaponizedEPSS 16%

    apple · safariMar 18, 2022

  • CVE-2022-25450
    42Plan

    Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function.

    CriticalCVSS 9.8No exploitEPSS 11%

    tenda · ac6 firmwareMar 18, 2022

  • CVE-2022-26265
    48Plan

    Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    contao · contaoMar 18, 2022

  • CVE-2022-27226
    45Plan

    A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administ

    HighCVSS 8.8Proof of conceptEPSS 33%

    irz · ru21 firmwareMar 19, 2022

  • CVE-2022-0415
    55Plan

    Remote Command Execution in uploading repository file in gogs/gogs

    HighCVSS 8.8Proof of conceptEPSS 65%

    gogs · gogsMar 21, 2022

  • CVE-2022-26960
    51Plan

    connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal.

    CriticalCVSS 9.1Proof of conceptEPSS 50%

    std42 · elfinderMar 21, 2022

  • CVE-2022-24237
    43Plan

    The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability.

    HighCVSS 8.8No exploitEPSS 25%

    snapt · ariaMar 21, 2022

  • CVE-2022-25766
    45Plan

    Remote Code Execution (RCE)

    HighCVSS 8.8No exploitEPSS 34%

    ungit project · ungitMar 21, 2022

  • CVE-2022-0364
    42Plan

    Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting

    MediumCVSS 5.4No exploitEPSS 69%

    webnus · modern events calendar liteMar 21, 2022

  • CVE-2022-0591
    42Plan

    Formcraft3 < 3.8.28 - Unauthenticated SSRF

    CriticalCVSS 9.1Proof of conceptEPSS 20%

    subtlewebinc · formcraft3Mar 21, 2022

  • CVE-2022-0739
    60This week

    BookingPress < 1.0.11 - Unauthenticated SQL Injection

    CriticalCVSS 9.8WeaponizedEPSS 37%

    reputeinfosystems · bookingpressMar 21, 2022

  • CVE-2022-0747
    43Plan

    Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    quantumcloud · infographic makerMar 21, 2022

  • CVE-2022-0760
    42Plan

    Simple Link Directory < 7.7.2 - Unauthenticated SQL injection

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    quantumcloud · simple link directoryMar 21, 2022

  • CVE-2022-23347
    34Monitor

    BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.

    HighCVSS 7.5Proof of conceptEPSS 13%

    bigantsoft · bigant serverMar 21, 2022

  • CVE-2022-26148
    55Plan

    An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix.

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    grafana · grafanaMar 21, 2022

  • CVE-2022-27228
    45Plan

    In the vote (aka "Polls, Votes") module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    bitrix24 · bitrix24Mar 22, 2022

  • CVE-2022-26187
    45Plan

    TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.

    CriticalCVSS 9.8No exploitEPSS 19%

    totolink · n600r firmwareMar 22, 2022

  • CVE-2022-0888
    51Plan

    Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload

    CriticalCVSS 9.8No exploitEPSS 39%

    ninjaforms · ninja forms file uploadsMar 23, 2022

  • CVE-2022-22951
    42Plan

    VMware Carbon Black App Control (8.5.x prior to 8.5.14, 8.6.x prior to 8.6.6, 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS

    CriticalCVSS 9.1No exploitEPSS 20%

    vmware · carbon black app controlMar 23, 2022

  • CVE-2022-23881
    56Plan

    ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    zzzcms · zzzphpMar 23, 2022

  • CVE-2022-24934
    45Plan

    wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    wps · wps officeMar 23, 2022

  • CVE-2022-1058
    40Plan

    Open Redirect on login in go-gitea/gitea

    MediumCVSS 6.1Proof of conceptEPSS 53%

    gitea · giteaMar 24, 2022

  • CVE-2022-21820
    30Monitor

    NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may

    MediumCVSS 6.3No exploitEPSS 16%

    nvidia · data center gpu managerMar 24, 2022

  • CVE-2022-26272
    46Plan

    A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted string written to th

    CriticalCVSS 9.8No exploitEPSS 22%

    ionizecms · ionizeMar 24, 2022

  • CVE-2022-1040
    99Now

    An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    sophos · sfosMar 25, 2022

  • CVE-2018-25032
    46Plan

    zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

    HighCVSS 7.5Proof of conceptEPSS 51%

    zlib · zlibMar 25, 2022

  • CVE-2022-26263
    37Monitor

    Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/WebHelp.

    MediumCVSS 6.1Proof of conceptEPSS 41%

    yonyou · u8\+Mar 25, 2022