# CVEs published 2021-11-26

17 CVEs were published on November 26, 2021: 2 critical, 9 high. Days are UTC.

- [CVE-2021-23654](https://cve.now/CVE-2021-23654.md): Improper Input Validation (CVSS 5.6, html-to-csv)
- [CVE-2021-43785](https://cve.now/CVE-2021-43785.md): Cross Site Scripting Vulnerability in @joeattardi/emoji-button (CVSS 7.6, joeattardi emoji-button · @joeattardi/emoji-button)
- [CVE-2021-43776](https://cve.now/CVE-2021-43776.md): XSS vulnerability in @backstage/plugin-auth-backend (CVSS 7.4, backstage · @backstage/plugin-auth-backend)
- [CVE-2021-41279](https://cve.now/CVE-2021-41279.md): Zip Slip Vulnerability in BaserCMS (CVSS 7.7, baserproject basercms · baserproject/basercms)
- [CVE-2021-41243](https://cve.now/CVE-2021-41243.md): OS Command Injection Vulnerability and Potential Zip Slip Vulnerability (CVSS 9.1, baserproject basercms · baserproject/basercms)
- [CVE-2021-36919](https://cve.now/CVE-2021-36919.md): WordPress Awesome Support plugin \<= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities (CVSS 6.1, Awesome Support)
- [CVE-2021-40833](https://cve.now/CVE-2021-40833.md): Denial-of-Service (DoS) Vulnerability (CVSS 5.5, F-Secure endpoint protection products on Windows and Mac. F…)
- [CVE-2021-35533](https://cve.now/CVE-2021-35533.md): Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 series (CVSS 7.5, Hitachi Energy RTU500 series)
- [CVE-2021-36843](https://cve.now/CVE-2021-36843.md): WordPress Floating Social Media Icon plugin \<= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Acurax Technologies Floating Social Media Icon)
- [CVE-2021-26615](https://cve.now/CVE-2021-26615.md): bandisoft ARK library integer overflow vulnerability (CVSS 7.8, bandisoft ARK)
- [CVE-2021-26611](https://cve.now/CVE-2021-26611.md): HejHome IP Camera use of hard-coded credentials vulnerability (CVSS 8.1, Goqual GKW-IC052)
- [CVE-2020-7881](https://cve.now/CVE-2020-7881.md): AfreecaTV streamer service stack-based buffer overflow (CVSS 7.5, afreecatvstreamer.exe)
- [CVE-2021-25269](https://cve.now/CVE-2021-25269.md): A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in (CVSS 4.4, Sophos Intercept X Advanced · Sophos Exploit Prevention)
- [CVE-2021-36807](https://cve.now/CVE-2021-36807.md): An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8. (CVSS 8.8, Sophos SG UTM)
- [CVE-2021-38686](https://cve.now/CVE-2021-38686.md): Improper Authentication Vulnerability in VioStor (CVSS 8.8, QNAP Systems QVR)
- [CVE-2021-38685](https://cve.now/CVE-2021-38685.md): Command Injection Vulnerability in VioStor (CVSS 9.8, QNAP Systems QVR)
- [CVE-2021-44225](https://cve.now/CVE-2021-44225.md): In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manip (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.