CVEs published April 26, 2020
3 CVEs were published on April 26, 2020: 0 critical, 0 high.
- Published
- 3
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- croogo/croogo
- 1
- decompress
- 1
Medium, low and unrated 3
- CVE-2020-12265The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, decompress
- CVE-2019-20789Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.croogo/croogo
- CVE-2020-12254Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink.