# CVEs published 2022-02-26

14 CVEs were published on February 26, 2022: 0 critical, 2 high. Days are UTC.

- [CVE-2021-3967](https://cve.now/CVE-2021-3967.md): Improper Access Control in zulip/zulip (CVSS 4.1, zulip/zulip)
- [CVE-2022-22908](https://cve.now/CVE-2022-22908.md): SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents o (no CVSS)
- [CVE-2022-26146](https://cve.now/CVE-2022-26146.md): Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker. (no CVSS)
- [CVE-2020-27958](https://cve.now/CVE-2020-27958.md): The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to p (no CVSS)
- [CVE-2022-0764](https://cve.now/CVE-2022-0764.md): Arbitrary Command Injection in strapi/strapi (CVSS 6.1, strapi/strapi · strapi)
- [CVE-2022-0723](https://cve.now/CVE-2022-0723.md): Cross-site Scripting (XSS) - Reflected in microweber/microweber (CVSS 8.0, microweber/microweber)
- [CVE-2022-0763](https://cve.now/CVE-2022-0763.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 4.3, microweber/microweber)
- [CVE-2022-0762](https://cve.now/CVE-2022-0762.md): Incorrect Authorization in microweber/microweber (CVSS 5.5, microweber/microweber)
- [CVE-2022-25359](https://cve.now/CVE-2022-25359.md): On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files. (no CVSS)
- [CVE-2022-24986](https://cve.now/CVE-2022-24986.md): KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. (no CVSS)
- [CVE-2020-36516](https://cve.now/CVE-2020-36516.md): An issue was discovered in the Linux kernel through 5.16.11. (no CVSS)
- [CVE-2021-46702](https://cve.now/CVE-2021-46702.md): Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. (no CVSS)
- [CVE-2022-23308](https://cve.now/CVE-2022-23308.md): valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. (CVSS 7.5)
- [CVE-2022-26149](https://cve.now/CVE-2022-26149.md): MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, becau (no CVSS, modx/revolution)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-02-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.