# CVEs published 2022-03-26 11 CVEs were published on March 26, 2022: 0 critical, 1 high. Days are UTC. - [CVE-2022-26198](https://cve.now/CVE-2022-26198.md): Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text (no CVSS) - [CVE-2022-27946](https://cve.now/CVE-2022-27946.md): NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in (no CVSS) - [CVE-2022-27947](https://cve.now/CVE-2022-27947.md): NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in (no CVSS) - [CVE-2022-27945](https://cve.now/CVE-2022-27945.md): NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in (no CVSS) - [CVE-2022-27938](https://cve.now/CVE-2022-27938.md): stb\_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi\_\_create\_png\_image\_raw (no CVSS) - [CVE-2022-1071](https://cve.now/CVE-2022-1071.md): User after free in mrb\_vm\_exec in mruby/mruby (CVSS 7.7, mruby/mruby) - [CVE-2022-27939](https://cve.now/CVE-2022-27939.md): tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get\_layer4\_v6 in common/get.c. (no CVSS) - [CVE-2022-27940](https://cve.now/CVE-2022-27940.md): tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get\_ipv6\_next in common/get.c. (no CVSS) - [CVE-2022-27941](https://cve.now/CVE-2022-27941.md): tcprewrite in Tcpreplay 4.4.1 has a heap-based buffer over-read in get\_l2len\_protocol in common/get.c. (no CVSS) - [CVE-2022-27942](https://cve.now/CVE-2022-27942.md): tcpprep in Tcpreplay 4.4.1 has a heap-based buffer over-read in parse\_mpls in common/get.c. (no CVSS) - [CVE-2022-27943](https://cve.now/CVE-2022-27943.md): libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle\_const, as demonstrated by nm-new. (CVSS 5.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-03-26 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.