# CVEs published 2020-04-26

3 CVEs were published on April 26, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-12265](https://cve.now/CVE-2020-12265.md): The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, (no CVSS, decompress)
- [CVE-2019-20789](https://cve.now/CVE-2019-20789.md): Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies. (no CVSS, croogo/croogo)
- [CVE-2020-12254](https://cve.now/CVE-2020-12254.md): Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-04-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.