# CVEs published 2022-03-28

113 CVEs were published on March 28, 2022: 4 critical, 4 high. Days are UTC.

- [CVE-2022-26296](https://cve.now/CVE-2022-26296.md): BOOM: The Berkeley Out-of-Order RISC-V Processor commit d77c2c3 was discovered to allow unauthorized disclosure of information to an attacke (no CVSS)
- [CVE-2022-26641](https://cve.now/CVE-2022-26641.md): TP-LINK TL-WR840N(ES)\_V6.20 was discovered to contain a buffer overflow via the httpRemotePort parameter. (no CVSS)
- [CVE-2022-26642](https://cve.now/CVE-2022-26642.md): TP-LINK TL-WR840N(ES)\_V6.20 was discovered to contain a buffer overflow via the X\_TP\_ClonedMACAddress parameter. (no CVSS)
- [CVE-2022-26639](https://cve.now/CVE-2022-26639.md): TP-LINK TL-WR840N(ES)\_V6.20 was discovered to contain a buffer overflow via the DNSServers parameter. (no CVSS)
- [CVE-2022-26640](https://cve.now/CVE-2022-26640.md): TP-LINK TL-WR840N(ES)\_V6.20 was discovered to contain a buffer overflow via the minAddress parameter. (no CVSS)
- [CVE-2021-43105](https://cve.now/CVE-2021-43105.md): A vulnerability in the bailiwick checking function in Technitium DNS Server \<= v7.0 exists that allows specific malicious users to inject \`N (no CVSS)
- [CVE-2022-26291](https://cve.now/CVE-2022-26291.md): lrzip v0.641 was discovered to contain a multiple concurrency use-after-free between the functions zpaq\_decompress\_buf() and clear\_rulist(). (no CVSS)
- [CVE-2022-24789](https://cve.now/CVE-2022-24789.md): Deserialization of untrusted data in C1 CMS. (CVSS 7.6, Orckestra C1-CMS-Foundation · C1CMS.Assemblies)
- [CVE-2022-26280](https://cve.now/CVE-2022-26280.md): Libarchive v3.6.0 was discovered to contain an out-of-bounds read via the component zipx\_lzma\_alone\_init. (no CVSS)
- [CVE-2021-43103](https://cve.now/CVE-2021-43103.md): A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execut (no CVSS)
- [CVE-2021-43102](https://cve.now/CVE-2021-43102.md): A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute (no CVSS)
- [CVE-2021-43101](https://cve.now/CVE-2021-43101.md): A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious us (no CVSS)
- [CVE-2021-43100](https://cve.now/CVE-2021-43100.md): A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execut (no CVSS)
- [CVE-2021-43099](https://cve.now/CVE-2021-43099.md): An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips t (no CVSS)
- [CVE-2021-43098](https://cve.now/CVE-2021-43098.md): A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function. (no CVSS)
- [CVE-2021-43097](https://cve.now/CVE-2021-43097.md): A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute (no CVSS)
- [CVE-2022-26278](https://cve.now/CVE-2022-26278.md): Tenda AC9 v15.03.2.21\_cn was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function. (no CVSS)
- [CVE-2017-20016](https://cve.now/CVE-2017-20016.md): WEKA INTEREST Security Scanner Portscan memory allocation (CVSS 4.3, WEKA INTEREST Security Scanner)
- [CVE-2017-20015](https://cve.now/CVE-2017-20015.md): WEKA INTEREST Security Scanner LAN Viewer denial of service (CVSS 2.8, WEKA INTEREST Security Scanner)
- [CVE-2017-20014](https://cve.now/CVE-2017-20014.md): WEKA INTEREST Security Scanner Webspider denial of service (CVSS 2.8, WEKA INTEREST Security Scanner)
- [CVE-2017-20013](https://cve.now/CVE-2017-20013.md): WEKA INTEREST Security Scanner Stresstest Configuration denial of service (CVSS 2.8, WEKA INTEREST Security Scanner)
- [CVE-2017-20012](https://cve.now/CVE-2017-20012.md): WEKA INTEREST Security Scanner Stresstest Scheme denial of service (CVSS 2.8, WEKA INTEREST Security Scanner)
- [CVE-2017-20011](https://cve.now/CVE-2017-20011.md): WEKA INTEREST Security Scanner HTTP denial of service (CVSS 2.8, WEKA INTEREST Security Scanner)
- [CVE-2010-10001](https://cve.now/CVE-2010-10001.md): Shemes GrabIt NZB Date Parser denial of service (CVSS 5.3, Shemes GrabIt)
- [CVE-2008-10001](https://cve.now/CVE-2008-10001.md): Pro2col Stingray FTS cross site scriting (CVSS 5.5, Pro2col Stingray FTS)
- [CVE-2005-10001](https://cve.now/CVE-2005-10001.md): Netegrity SiteMinder Login smpwservicescgi.exe redirect (CVSS 5.4, Netegrity SiteMinder)
- [CVE-2003-5003](https://cve.now/CVE-2003-5003.md): ISS BlackICE PC Protection Update cross site scriting (CVSS 5.0, ISS BlackICE PC Protection)
- [CVE-2003-5002](https://cve.now/CVE-2003-5002.md): ISS BlackICE PC Protection Update cleartext transmission (CVSS 3.7, ISS BlackICE PC Protection)
- [CVE-2003-5001](https://cve.now/CVE-2003-5001.md): ISS BlackICE PC Protection Cross Site Scripting Detection privileges management (CVSS 5.3, ISS BlackICE PC Protection)
- [CVE-2021-4191](https://cve.now/CVE-2021-4191.md): An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. (CVSS 5.3, GitLab)
- [CVE-2022-0283](https://cve.now/CVE-2022-0283.md): An issue has been discovered affecting GitLab versions prior to 13.5. (CVSS 4.7, GitLab)
- [CVE-2022-0136](https://cve.now/CVE-2022-0136.md): A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. (CVSS 5.4, GitLab)
- [CVE-2021-39876](https://cve.now/CVE-2021-39876.md): In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of private groups. (CVSS 4.3, GitLab)
- [CVE-2022-0488](https://cve.now/CVE-2022-0488.md): An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. (CVSS 3.5, GitLab)
- [CVE-2022-0249](https://cve.now/CVE-2022-0249.md): A vulnerability was discovered in GitLab starting with version 12. (CVSS 3.1, GitLab)
- [CVE-2022-0344](https://cve.now/CVE-2022-0344.md): An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6. (CVSS 3.1, GitLab)
- [CVE-2022-0123](https://cve.now/CVE-2022-0123.md): An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. (CVSS 5.9, GitLab)
- [CVE-2022-0427](https://cve.now/CVE-2022-0427.md): Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perfor (CVSS 7.7, GitLab)
- [CVE-2022-0738](https://cve.now/CVE-2022-0738.md): An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7. (CVSS 4.2, GitLab)
- [CVE-2022-0751](https://cve.now/CVE-2022-0751.md): Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with (CVSS 6.5, GitLab)
- [CVE-2022-0371](https://cve.now/CVE-2022-0371.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before (CVSS 4.3, GitLab)
- [CVE-2022-0549](https://cve.now/CVE-2022-0549.md): An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versio (CVSS 6.5, GitLab)
- [CVE-2022-0735](https://cve.now/CVE-2022-0735.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 befor (CVSS 10.0, GitLab)
- [CVE-2022-27658](https://cve.now/CVE-2022-27658.md): Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information (no CVSS, SAP SE SAP Innovation management)
- [CVE-2018-25030](https://cve.now/CVE-2018-25030.md): Mirmay Secure Private Browser / File Manager Auto Lock improper authentication (CVSS 3.3, Mirmay Secure Private Browser · Mirmay File Manager)
- [CVE-2022-26980](https://cve.now/CVE-2022-26980.md): Teampass 2.1.26 allows reflected XSS via the index.php PATH\_INFO. (no CVSS, nilsteampassnet/teampass)
- [CVE-2015-10002](https://cve.now/CVE-2015-10002.md): Kiddoware Kids Place Home Button Protection denial of service (CVSS 5.3, Kiddoware Kids Place)
- [CVE-2022-0846](https://cve.now/CVE-2022-0846.md): SpeakOut! Email Petitions \< 2.14.15.1 - Unauthenticated SQLi (no CVSS, SpeakOut! Email Petitions)
- [CVE-2022-0833](https://cve.now/CVE-2022-0833.md): Church Admin \< 3.4.135 - Unauthenticated Plugin's Backup Disclosure (no CVSS, Church Admin)
- [CVE-2022-0818](https://cve.now/CVE-2022-0818.md): Coupon Affiliates \< 4.16.4.5 - Unauthenticated Stored XSS (no CVSS, WooCommerce Affiliate Plugin – Coupon Affiliates)
- [CVE-2022-0787](https://cve.now/CVE-2022-0787.md): Limit Login Attempts (Spam Protection) \< 5.1 - Unauthenticated SQLi (no CVSS, Limit Login Attempts)
- [CVE-2022-0784](https://cve.now/CVE-2022-0784.md): Title Experiments Free \< 9.0.1 - Unauthenticated SQLi (no CVSS, Title Experiments Free)
- [CVE-2022-0770](https://cve.now/CVE-2022-0770.md): Translate WordPress with GTranslate \< 2.9.9 - CSRF to Account Takeover (no CVSS, Translate WordPress with GTranslate)
- [CVE-2022-0720](https://cve.now/CVE-2022-0720.md): Amelia \< 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure (no CVSS, Amelia – Events & Appointments Booking Calendar)
- [CVE-2022-0680](https://cve.now/CVE-2022-0680.md): Plezi \< 1.0.3 - Unauthenticated Stored XSS (no CVSS, Plezi)
- [CVE-2022-0679](https://cve.now/CVE-2022-0679.md): Narnoo Distributor \<= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE (no CVSS, Narnoo Distributor)
- [CVE-2022-0647](https://cve.now/CVE-2022-0647.md): Bulk Creator \<= 1.0.1 - Reflected Cross-Site Scripting (no CVSS, Bulk Creator)
- [CVE-2022-0643](https://cve.now/CVE-2022-0643.md): Bank Mellat \<= 1.3.7 - Reflected Cross-Site Scripting (no CVSS, Bank Mellat)
- [CVE-2022-0641](https://cve.now/CVE-2022-0641.md): Popup Like box \< 3.6.1 - Reflected Cross-Site Scripting (no CVSS, Popup Like box – Page Plugin)
- [CVE-2022-0621](https://cve.now/CVE-2022-0621.md): dTabs \<= 1.4 - Reflected Cross-Site Scripting (no CVSS, dTabs)
- [CVE-2022-0620](https://cve.now/CVE-2022-0620.md): Delete Old Orders \<= 0.2 - Reflected Cross-Site Scripting (no CVSS, Delete Old Orders)
- [CVE-2022-0619](https://cve.now/CVE-2022-0619.md): Database Peek \<= 1.2 - Reflected Cross-Site Scripting (no CVSS, Database Peek)
- [CVE-2022-0600](https://cve.now/CVE-2022-0600.md): Conference Scheduler \< 2.4.3 - Reflected Cross-Site Scripting (no CVSS, Conference Scheduler)
- [CVE-2022-0599](https://cve.now/CVE-2022-0599.md): Mapping Multiple URLs Redirect Same Page \<= 5.8 - Reflected Cross-Site Scripting (no CVSS, Mapping multiple URLs redirect same page)
- [CVE-2022-0595](https://cve.now/CVE-2022-0595.md): Drag and Drop Multiple File Upload - Contact Form 7 \< 1.3.6.3 - Unauthenticated Stored XSS (no CVSS, Drag and Drop Multiple File Upload – Contact Form)
- [CVE-2022-0499](https://cve.now/CVE-2022-0499.md): Sermon Browser \<= 0.45.22 - Arbitrary File Upload via CSRF (no CVSS, Sermon Browser)
- [CVE-2022-0493](https://cve.now/CVE-2022-0493.md): String Locator \< 2.5.0 - Admin+ Arbitrary File Read (no CVSS, String locator)
- [CVE-2022-0479](https://cve.now/CVE-2022-0479.md): Popup Builder \< 4.1.1 - SQL Injection to Reflected Cross-Site Scripting (no CVSS, Popup Builder – Create highly converting, mobile friendly m…)
- [CVE-2022-0450](https://cve.now/CVE-2022-0450.md): Menu Image, Icons made easy \< 3.0.8 - Subscriber+ Stored Cross-Site Scripting (no CVSS, Menu Image, Icons made easy)
- [CVE-2022-0397](https://cve.now/CVE-2022-0397.md): WPC Smart Wishlist for WooCommerce \< 2.9.4 - Reflected Cross-Site Scripting (no CVSS, WPC Smart Wishlist for WooCommerce)
- [CVE-2022-0388](https://cve.now/CVE-2022-0388.md): Interactive Medical Drawing of Human Body \< 2.6 - Admin+ Stored XSS (no CVSS, Interactive Medical Drawing of Human Body)
- [CVE-2021-25071](https://cve.now/CVE-2021-25071.md): Akismet Privacy Policies \<= 2.0.1 - Reflected Cross-Site Scripting (no CVSS, Akismet Privacy Policies)
- [CVE-2021-25070](https://cve.now/CVE-2021-25070.md): WP Block and Stop Bad Bots \< 6.88 - Unauthenticated SQLi (no CVSS, Block Bad Bots and Stop Bad Bots Crawlers and Spiders and A…)
- [CVE-2021-25068](https://cve.now/CVE-2021-25068.md): Sync WooCommerce Product feed to Google Shopping \<= 1.2.4 - Admin+ SQLi (no CVSS, Sync WooCommerce Product feed to Google Shopping)
- [CVE-2021-25064](https://cve.now/CVE-2021-25064.md): Wow Countdowns \<= 3.1.2 - Admin+ SQLi (no CVSS, Wow Countdowns – easily create any countdowns, counters and…)
- [CVE-2021-25012](https://cve.now/CVE-2021-25012.md): Pz-LinkCard \<= 2.4.4.4 - Reflected Cross-Site Scripting (no CVSS, Pz-LinkCard)
- [CVE-2021-24978](https://cve.now/CVE-2021-24978.md): OSMapper \<= 2.1.5 - Unauthenticated Arbitrary Post Deletion (no CVSS, OSMapper)
- [CVE-2021-24962](https://cve.now/CVE-2021-24962.md): WordPress File Upload \< 4.16.3 - Contributor+ Path Traversal to RCE (no CVSS, WordPress File Upload)
- [CVE-2021-24746](https://cve.now/CVE-2021-24746.md): Sassy Social Share \< 3.3.40 - Reflected Cross-Site Scripting (no CVSS, Social Sharing Plugin – Sassy Social Share)
- [CVE-2022-0221](https://cve.now/CVE-2022-0221.md): A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when openi (CVSS 5.5, Schneider Electric SCADAPack Workbench)
- [CVE-2021-22797](https://cve.now/CVE-2021-22797.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious scri (CVSS 7.8, Schneider Electric EcoStruxure Control Expert · Schneide… +1)
- [CVE-2021-22795](https://cve.now/CVE-2021-22795.md): A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause re (CVSS 9.1, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2021-22794](https://cve.now/CVE-2021-22794.md): A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code ex (CVSS 9.1, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2019-6834](https://cve.now/CVE-2019-6834.md): A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted sy (CVSS 7.3, Schneider Electric Software Update (SESU) – SUT Service com…)
- [CVE-2021-44124](https://cve.now/CVE-2021-44124.md): Hiby Music Hiby OS R3 Pro 1.5 and 1.6 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2021-43721](https://cve.now/CVE-2021-43721.md): Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. (no CVSS)
- [CVE-2021-43725](https://cve.now/CVE-2021-43725.md): There is a Cross Site Scripting (XSS) vulnerability in SpotPage\_login.php of Spotweb 1.5.1 and below, which allows remote attackers to injec (no CVSS)
- [CVE-2022-23884](https://cve.now/CVE-2022-23884.md): Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::\_ (no CVSS)
- [CVE-2022-0342](https://cve.now/CVE-2022-0342.md): An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series fi (CVSS 9.8, Zyxel USG/ZyWALL series firmware · Zyxel USG FLEX series… +3)
- [CVE-2022-23882](https://cve.now/CVE-2022-23882.md): TuziCMS 2.0.6 is affected by SQL injection in \\App\\Manage\\Controller\\BannerController.class.php. (no CVSS)
- [CVE-2021-46434](https://cve.now/CVE-2021-46434.md): EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. (no CVSS)
- [CVE-2021-46433](https://cve.now/CVE-2021-46433.md): In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary (no CVSS, fenom/fenom)
- [CVE-2022-25757](https://cve.now/CVE-2022-25757.md): Apache APISIX: the body\_schema check in request-validation plugin can be bypassed (no CVSS, Apache Software Foundation Apache APISIX)
- [CVE-2022-27950](https://cve.now/CVE-2022-27950.md): In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid\_parse error condition. (no CVSS)
- [CVE-2021-45491](https://cve.now/CVE-2021-45491.md): 3CX System through 2022-03-17 stores cleartext passwords in a database. (no CVSS)
- [CVE-2021-45490](https://cve.now/CVE-2021-45490.md): The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate (no CVSS)
- [CVE-2022-26273](https://cve.now/CVE-2022-26273.md): EyouCMS v1.5.4 was discovered to lack parameter filtering in \\user\\controller\\shop.php, leading to payment logic vulnerabilities. (no CVSS)
- [CVE-2021-44617](https://cve.now/CVE-2021-44617.md): A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated. (no CVSS)
- [CVE-2021-44213](https://cve.now/CVE-2021-44213.md): OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message. (no CVSS)
- [CVE-2021-44212](https://cve.now/CVE-2021-44212.md): OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\\t substring. (no CVSS)
- [CVE-2021-44211](https://cve.now/CVE-2021-44211.md): OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature. (no CVSS)
- [CVE-2022-26271](https://cve.now/CVE-2022-26271.md): 74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \\index\\controller\\Download.php. (no CVSS)
- [CVE-2021-44210](https://cve.now/CVE-2021-44210.md): OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data. (no CVSS)
- [CVE-2021-44209](https://cve.now/CVE-2021-44209.md): OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO. (no CVSS)
- [CVE-2021-44208](https://cve.now/CVE-2021-44208.md): OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat. (no CVSS)
- [CVE-2021-26601](https://cve.now/CVE-2021-26601.md): ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image\_temp Directory Traversal. (no CVSS, impresscms/impresscms)
- [CVE-2021-26600](https://cve.now/CVE-2021-26600.md): ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==). (no CVSS, impresscms/impresscms)
- [CVE-2021-26599](https://cve.now/CVE-2021-26599.md): ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection. (no CVSS, impresscms/impresscms)
- [CVE-2022-26268](https://cve.now/CVE-2022-26268.md): Xiaohuanxiong v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /app/controller/Books.php. (no CVSS)
- [CVE-2021-26598](https://cve.now/CVE-2021-26598.md): ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by d (no CVSS, impresscms/impresscms)
- [CVE-2022-26259](https://cve.now/CVE-2022-26259.md): A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04- (no CVSS)
- [CVE-2022-1056](https://cve.now/CVE-2022-1056.md): Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. (CVSS 5.5, libtiff)
- [CVE-2022-24303](https://cve.now/CVE-2022-24303.md): Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. (no CVSS, pillow)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.