# CVEs published 2022-03-12

10 CVEs were published on March 12, 2022: 0 critical, 3 high. Days are UTC.

- [CVE-2022-23960](https://cve.now/CVE-2022-23960.md): Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. (no CVSS, :linux\_kernel:)
- [CVE-2021-36368](https://cve.now/CVE-2021-36368.md): An issue was discovered in OpenSSH before 8.9. (CVSS 3.7)
- [CVE-2022-26966](https://cve.now/CVE-2022-26966.md): An issue was discovered in the Linux kernel before 5.16.12. (no CVSS)
- [CVE-2022-0930](https://cve.now/CVE-2022-0930.md): File upload filter bypass leading to stored XSS in microweber/microweber (CVSS 8.0, microweber/microweber)
- [CVE-2022-0929](https://cve.now/CVE-2022-0929.md): XSS on dynamic\_text module in microweber/microweber (CVSS 6.8, microweber/microweber)
- [CVE-2022-0926](https://cve.now/CVE-2022-0926.md): File upload filter bypass leading to stored XSS in microweber/microweber (CVSS 7.1, microweber/microweber)
- [CVE-2022-0880](https://cve.now/CVE-2022-0880.md): Cross-site Scripting (XSS) - Stored in star7th/showdoc (CVSS 7.6, star7th/showdoc · showdoc/showdoc)
- [CVE-2022-26533](https://cve.now/CVE-2022-26533.md): Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. (no CVSS, github.com/Xhofe/alist)
- [CVE-2022-26276](https://cve.now/CVE-2022-26276.md): An issue in index.php of OneNav v0.9.14 allows attackers to perform directory traversal. (no CVSS)
- [CVE-2022-26967](https://cve.now/CVE-2022-26967.md): GPAC 2.0 allows a heap-based buffer overflow in gf\_base64\_encode. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.