# CVEs published 2022-03-27

9 CVEs were published on March 27, 2022: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-26255](https://cve.now/CVE-2022-26255.md): Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column. (no CVSS)
- [CVE-2021-44127](https://cve.now/CVE-2021-44127.md): In DLink DAP-1360 F1 firmware version \<=v6.10 in the "webupg" binary, an attacker can use the "file" parameter to execute arbitrary system c (no CVSS)
- [CVE-2022-26254](https://cve.now/CVE-2022-26254.md): WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated atta (no CVSS)
- [CVE-2022-26252](https://cve.now/CVE-2022-26252.md): aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. (no CVSS)
- [CVE-2022-1106](https://cve.now/CVE-2022-1106.md): use after free in mrb\_vm\_exec in mruby/mruby (CVSS 7.2, mruby/mruby)
- [CVE-2022-26245](https://cve.now/CVE-2022-26245.md): Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go. (no CVSS, github.com/open-falcon/falcon-plus)
- [CVE-2022-27948](https://cve.now/CVE-2022-27948.md): Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of a (CVSS 7.2)
- [CVE-2022-26205](https://cve.now/CVE-2022-26205.md): Marky commit 3686565726c65756e was discovered to contain a remote code execution (RCE) vulnerability via the Display text fields. (no CVSS)
- [CVE-2022-26258](https://cve.now/CVE-2022-26258.md): D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp. (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.