# CVEs published 2022-05-26

157 CVEs were published on May 26, 2022: 6 critical, 17 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2022-30701](https://cve.now/CVE-2022-30701.md): An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a (no CVSS, Trend Micro Apex One)
- [CVE-2022-30700](https://cve.now/CVE-2022-30700.md): An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DL (no CVSS, Trend Micro Apex One)
- [CVE-2022-30687](https://cve.now/CVE-2022-30687.md): Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate (no CVSS, Trend Micro Maximum Security)
- [CVE-2022-28394](https://cve.now/CVE-2022-28394.md): EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated co (no CVSS, Trend Micro Password Manager)
- [CVE-2022-29637](https://cve.now/CVE-2022-29637.md): An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file. (no CVSS, github.com/mindoc-org/mindoc)
- [CVE-2022-29633](https://cve.now/CVE-2022-29633.md): An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie. (no CVSS)
- [CVE-2022-29632](https://cve.now/CVE-2022-29632.md): An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitr (no CVSS)
- [CVE-2021-28509](https://cve.now/CVE-2021-28509.md): TerminAttr streams MACsec sensitive data in clear text to other authorized users in CVP (CVSS 6.1, Arista Networks Arista EOS · Arista Networks Arista TerminA…)
- [CVE-2021-28508](https://cve.now/CVE-2021-28508.md): TerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP (CVSS 6.8, Arista Networks Arista EOS · Arista Networks Arista TerminA…)
- [CVE-2022-26776](https://cve.now/CVE-2022-26776.md): This issue was addressed with improved checks. (CVSS 9.8, Apple macOS)
- [CVE-2022-26775](https://cve.now/CVE-2022-26775.md): An integer overflow was addressed with improved input validation. (CVSS 9.8, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26774](https://cve.now/CVE-2022-26774.md): A logic issue was addressed with improved state management. (CVSS 7.8, Apple iTunes for Windows)
- [CVE-2022-26773](https://cve.now/CVE-2022-26773.md): A logic issue was addressed with improved state management. (CVSS 7.1, Apple iTunes for Windows)
- [CVE-2022-26772](https://cve.now/CVE-2022-26772.md): A memory corruption issue was addressed with improved state management. (CVSS 7.8, Apple macOS)
- [CVE-2022-26771](https://cve.now/CVE-2022-26771.md): A memory corruption issue was addressed with improved state management. (CVSS 7.8, Apple watchOS)
- [CVE-2022-26770](https://cve.now/CVE-2022-26770.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 7.8, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26769](https://cve.now/CVE-2022-26769.md): A memory corruption issue was addressed with improved input validation. (CVSS 7.8, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26768](https://cve.now/CVE-2022-26768.md): A memory corruption issue was addressed with improved state management. (CVSS 7.8, Apple watchOS)
- [CVE-2022-26767](https://cve.now/CVE-2022-26767.md): The issue was addressed with additional permissions checks. (CVSS 5.5, Apple macOS)
- [CVE-2022-26766](https://cve.now/CVE-2022-26766.md): A certificate parsing issue was addressed with improved checks. (CVSS 5.5, Apple watchOS)
- [CVE-2022-26765](https://cve.now/CVE-2022-26765.md): A race condition was addressed with improved state handling. (CVSS 4.7, Apple watchOS)
- [CVE-2022-26764](https://cve.now/CVE-2022-26764.md): A memory corruption issue was addressed with improved validation. (CVSS 4.7, Apple watchOS)
- [CVE-2022-26763](https://cve.now/CVE-2022-26763.md): An out-of-bounds access issue was addressed with improved bounds checking. (CVSS 7.8, Apple watchOS)
- [CVE-2022-30584](https://cve.now/CVE-2022-30584.md): Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potent (CVSS 9.6)
- [CVE-2022-26761](https://cve.now/CVE-2022-26761.md): A memory corruption issue was addressed with improved memory handling. (CVSS 7.8, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-30585](https://cve.now/CVE-2022-30585.md): The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. (CVSS 6.5)
- [CVE-2022-26757](https://cve.now/CVE-2022-26757.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple watchOS)
- [CVE-2022-26756](https://cve.now/CVE-2022-26756.md): An out-of-bounds write issue was addressed with improved input validation. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26755](https://cve.now/CVE-2022-26755.md): This issue was addressed with improved environment sanitization. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26754](https://cve.now/CVE-2022-26754.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-26753](https://cve.now/CVE-2022-26753.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-26752](https://cve.now/CVE-2022-26752.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-26751](https://cve.now/CVE-2022-26751.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26750](https://cve.now/CVE-2022-26750.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-26749](https://cve.now/CVE-2022-26749.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-26748](https://cve.now/CVE-2022-26748.md): An out-of-bounds write issue was addressed with improved input validation. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26747](https://cve.now/CVE-2022-26747.md): This issue was addressed with improved checks. (no CVSS, Apple Xcode)
- [CVE-2022-26746](https://cve.now/CVE-2022-26746.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-31648](https://cve.now/CVE-2022-31648.md): Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. (no CVSS)
- [CVE-2022-26745](https://cve.now/CVE-2022-26745.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2022-26743](https://cve.now/CVE-2022-26743.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2022-26742](https://cve.now/CVE-2022-26742.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-26741](https://cve.now/CVE-2022-26741.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2022-26740](https://cve.now/CVE-2022-26740.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple tvOS)
- [CVE-2022-26739](https://cve.now/CVE-2022-26739.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple tvOS)
- [CVE-2022-26738](https://cve.now/CVE-2022-26738.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple tvOS)
- [CVE-2022-26737](https://cve.now/CVE-2022-26737.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple tvOS)
- [CVE-2022-26736](https://cve.now/CVE-2022-26736.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple tvOS)
- [CVE-2022-26731](https://cve.now/CVE-2022-26731.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-26728](https://cve.now/CVE-2022-26728.md): This issue was addressed with improved entitlements. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26727](https://cve.now/CVE-2022-26727.md): This issue was addressed with improved entitlements. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26726](https://cve.now/CVE-2022-26726.md): This issue was addressed with improved checks. (no CVSS, Apple watchOS)
- [CVE-2022-26725](https://cve.now/CVE-2022-26725.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-26724](https://cve.now/CVE-2022-26724.md): An authentication issue was addressed with improved state management. (no CVSS, Apple tvOS)
- [CVE-2022-26723](https://cve.now/CVE-2022-26723.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2022-26722](https://cve.now/CVE-2022-26722.md): A memory initialization issue was addressed. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26721](https://cve.now/CVE-2022-26721.md): A memory initialization issue was addressed. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26720](https://cve.now/CVE-2022-26720.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26718](https://cve.now/CVE-2022-26718.md): An out-of-bounds read issue was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2022-26715](https://cve.now/CVE-2022-26715.md): An out-of-bounds write issue was addressed with improved bounds checking. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26714](https://cve.now/CVE-2022-26714.md): A memory corruption issue was addressed with improved validation. (no CVSS, Apple watchOS)
- [CVE-2022-26712](https://cve.now/CVE-2022-26712.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple macOS)
- [CVE-2022-26711](https://cve.now/CVE-2022-26711.md): An integer overflow issue was addressed with improved input validation. (no CVSS, Apple watchOS)
- [CVE-2022-26708](https://cve.now/CVE-2022-26708.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-26706](https://cve.now/CVE-2022-26706.md): An access issue was addressed with additional sandbox restrictions on third-party applications. (no CVSS, Apple watchOS)
- [CVE-2022-26704](https://cve.now/CVE-2022-26704.md): A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. (no CVSS, Apple macOS)
- [CVE-2022-26703](https://cve.now/CVE-2022-26703.md): An authorization issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-26701](https://cve.now/CVE-2022-26701.md): A race condition was addressed with improved locking. (no CVSS, Apple tvOS)
- [CVE-2022-26698](https://cve.now/CVE-2022-26698.md): An out-of-bounds read issue was addressed with improved bounds checking. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26697](https://cve.now/CVE-2022-26697.md): An out-of-bounds read issue was addressed with improved input validation. (no CVSS, Apple Security Update - Catalina · Apple macOS)
- [CVE-2022-26694](https://cve.now/CVE-2022-26694.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-26693](https://cve.now/CVE-2022-26693.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-26691](https://cve.now/CVE-2022-26691.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-26690](https://cve.now/CVE-2022-26690.md): Description: A race condition was addressed with additional validation. (no CVSS, Apple macOS)
- [CVE-2022-26688](https://cve.now/CVE-2022-26688.md): An issue in the handling of symlinks was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2022-22676](https://cve.now/CVE-2022-22676.md): An event handler validation issue in the XPC Services API was addressed by removing the service. (no CVSS, Apple macOS)
- [CVE-2022-22675](https://cve.now/CVE-2022-22675.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, KEV, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2022-22674](https://cve.now/CVE-2022-22674.md): An out-of-bounds read issue existed that led to the disclosure of kernel memory. (CVSS 5.5, KEV, Apple macOS)
- [CVE-2022-22673](https://cve.now/CVE-2022-22673.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-22672](https://cve.now/CVE-2022-22672.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-22663](https://cve.now/CVE-2022-22663.md): This issue was addressed with improved checks to prevent unauthorized actions. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-22662](https://cve.now/CVE-2022-22662.md): A cookie management issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2022-22616](https://cve.now/CVE-2022-22616.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2022-30508](https://cve.now/CVE-2022-30508.md): DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter. (no CVSS)
- [CVE-2022-31265](https://cve.now/CVE-2022-31265.md): The replay feature in the client in Wargaming World of Warships 0.11.4 allows remote attackers to execute code when a user launches a replay (no CVSS)
- [CVE-2021-4232](https://cve.now/CVE-2021-4232.md): Zoo Management System manage-ticket.php cross site scripting (CVSS 3.5, Zoo Management System)
- [CVE-2022-21827](https://cve.now/CVE-2022-21827.md): An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) \<21.9.1.2 w (no CVSS, Citrix Gateway Windows Plugin)
- [CVE-2022-1261](https://cve.now/CVE-2022-1261.md): Matrikon OPC Server Improper Access Control (CVSS 5.8, Matrikon, a subsidiary of Honeywell Matrikon OPC Server)
- [CVE-2021-33014](https://cve.now/CVE-2021-33014.md): KUKA KR C4 - Use of Hard-Coded Credentials (CVSS 8.8, KUKA KR C4 · KSS)
- [CVE-2022-30495](https://cve.now/CVE-2022-30495.md): In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers (no CVSS)
- [CVE-2021-33016](https://cve.now/CVE-2021-33016.md): KUKA KR C4 - Use of Hard-Coded Credentials (CVSS 9.8, KUKA KR C4 · KSS)
- [CVE-2022-30493](https://cve.now/CVE-2022-30493.md): In oretnom23 Automotive Shop Management System v1.0, the product id parameter suffers from a blind SQL Injection Vulnerability allowing remo (no CVSS)
- [CVE-2022-30494](https://cve.now/CVE-2022-30494.md): In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability al (no CVSS)
- [CVE-2022-1899](https://cve.now/CVE-2022-1899.md): Out-of-bounds Read in radareorg/radare2 (CVSS 7.7, radareorg/radare2)
- [CVE-2022-30516](https://cve.now/CVE-2022-30516.md): In Hospital-Management-System v1.0, the editid parameter in the doctor.php page is vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2022-30500](https://cve.now/CVE-2022-30500.md): Jfinal cms 5.1.0 is vulnerable to SQL Injection. (no CVSS, com.jflyfox:jflyfox\_jfinal)
- [CVE-2022-30477](https://cve.now/CVE-2022-30477.md): Tenda AC Series Router AC18\_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /go (no CVSS)
- [CVE-2022-30476](https://cve.now/CVE-2022-30476.md): Tenda AC Series Router AC18\_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /go (no CVSS)
- [CVE-2022-30475](https://cve.now/CVE-2022-30475.md): Tenda AC Series Router AC18\_V15.03.05.19(6318) was discovered to contain a stack-based buffer overflow in the httpd module when handling /go (no CVSS)
- [CVE-2022-30474](https://cve.now/CVE-2022-30474.md): Tenda AC Series Router AC18\_V15.03.05.19(6318) was discovered to contain a heap overflow in the httpd module when handling /goform/saveParen (no CVSS)
- [CVE-2022-30472](https://cve.now/CVE-2022-30472.md): Tenda AC Seris Router AC18\_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function fromAddressNat (no CVSS)
- [CVE-2022-29091](https://cve.now/CVE-2022-29091.md): Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisph (CVSS 5.3, Dell Unity)
- [CVE-2022-29082](https://cve.now/CVE-2022-29082.md): Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 (CVSS 3.7, Dell NetWorker)
- [CVE-2022-26865](https://cve.now/CVE-2022-26865.md): Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. (CVSS 6.8, Dell OS Recovery Tool)
- [CVE-2022-26857](https://cve.now/CVE-2022-26857.md): Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. (CVSS 9.0, Dell OpenManage Enterprise)
- [CVE-2022-24422](https://cve.now/CVE-2022-24422.md): Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. (CVSS 9.6, Integrated Dell Remote Access Controller)
- [CVE-2022-24418](https://cve.now/CVE-2022-24418.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-24417](https://cve.now/CVE-2022-24417.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-24414](https://cve.now/CVE-2022-24414.md): Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. (CVSS 7.6, Dell CloudLink)
- [CVE-2022-30473](https://cve.now/CVE-2022-30473.md): Tenda AC Series Router AC18\_V15.03.05.19(6318) has a stack-based buffer overflow vulnerability in function form\_fast\_setting\_wifi\_set (no CVSS)
- [CVE-2022-20821](https://cve.now/CVE-2022-20821.md): Cisco IOS XR Software Health Check Open Port Vulnerability (CVSS 6.5, KEV, Cisco IOS XR Software)
- [CVE-2022-20809](https://cve.now/CVE-2022-20809.md): Cisco Expressway Series and Cisco TelePresence Video Communication Server Vulnerabilities (CVSS 4.3, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2022-29689](https://cve.now/CVE-2022-29689.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin (no CVSS)
- [CVE-2022-29688](https://cve.now/CVE-2022-29688.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin (no CVSS)
- [CVE-2022-29687](https://cve.now/CVE-2022-29687.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level\_d (no CVSS)
- [CVE-2022-29686](https://cve.now/CVE-2022-29686.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin (no CVSS)
- [CVE-2022-29685](https://cve.now/CVE-2022-29685.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level\_s (no CVSS)
- [CVE-2022-29684](https://cve.now/CVE-2022-29684.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js\_del (no CVSS)
- [CVE-2022-29682](https://cve.now/CVE-2022-29682.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/to (no CVSS)
- [CVE-2022-29683](https://cve.now/CVE-2022-29683.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page\_d (no CVSS)
- [CVE-2022-29680](https://cve.now/CVE-2022-29680.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu\_del. (no CVSS)
- [CVE-2022-29681](https://cve.now/CVE-2022-29681.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del. (no CVSS)
- [CVE-2022-29676](https://cve.now/CVE-2022-29676.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zh (no CVSS)
- [CVE-2022-29670](https://cve.now/CVE-2022-29670.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del (no CVSS)
- [CVE-2022-29669](https://cve.now/CVE-2022-29669.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/z (no CVSS)
- [CVE-2022-29667](https://cve.now/CVE-2022-29667.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy. (no CVSS)
- [CVE-2022-29666](https://cve.now/CVE-2022-29666.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zh (no CVSS)
- [CVE-2022-29665](https://cve.now/CVE-2022-29665.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/topic/s (no CVSS)
- [CVE-2022-29664](https://cve.now/CVE-2022-29664.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl\_ (no CVSS)
- [CVE-2022-29663](https://cve.now/CVE-2022-29663.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/hy. (no CVSS)
- [CVE-2022-29662](https://cve.now/CVE-2022-29662.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/news/sa (no CVSS)
- [CVE-2022-29661](https://cve.now/CVE-2022-29661.md): CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/pic/admin/ty (no CVSS)
- [CVE-2022-29660](https://cve.now/CVE-2022-29660.md): CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del. (no CVSS)
- [CVE-2022-29721](https://cve.now/CVE-2022-29721.md): 74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist. (no CVSS)
- [CVE-2022-29720](https://cve.now/CVE-2022-29720.md): 74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \\index\\controller\\Download.php. (no CVSS)
- [CVE-2021-40317](https://cve.now/CVE-2021-40317.md): Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter. (no CVSS)
- [CVE-2021-42860](https://cve.now/CVE-2021-42860.md): A stack buffer overflow exists in Mini-XML v3.2. (no CVSS)
- [CVE-2021-42859](https://cve.now/CVE-2021-42859.md): A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. (no CVSS)
- [CVE-2021-42692](https://cve.now/CVE-2021-42692.md): There is a stack-overflow vulnerability in tinytoml v0.4 that can cause a crash or DoS. (no CVSS)
- [CVE-2022-1664](https://cve.now/CVE-2022-1664.md): directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar (no CVSS, Debian dpkg)
- [CVE-2021-34360](https://cve.now/CVE-2021-34360.md): CSRF Bypass in Proxy Server (CVSS 5.3, QNAP Systems Proxy Server)
- [CVE-2021-4231](https://cve.now/CVE-2021-4231.md): Angular Comment cross site scripting (CVSS 3.5, Angular · @angular/core)
- [CVE-2022-1882](https://cve.now/CVE-2022-1882.md): A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post\_one\_notifi (no CVSS, kernel)
- [CVE-2022-1886](https://cve.now/CVE-2022-1886.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.1, vim/vim)
- [CVE-2022-21831](https://cve.now/CVE-2022-21831.md): A code injection vulnerability exists in the Active Storage \>= v5.2.0 that could allow an attacker to execute code via image\_processing argu (no CVSS, https://github.com/rails/rails · activestorage)
- [CVE-2022-22576](https://cve.now/CVE-2022-22576.md): An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connecti (CVSS 8.1, https://github.com/curl/curl)
- [CVE-2022-22577](https://cve.now/CVE-2022-22577.md): An XSS Vulnerability in Action Pack \>= 5.2.0 and \< 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2022-26702](https://cve.now/CVE-2022-26702.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple watchOS)
- [CVE-2022-26744](https://cve.now/CVE-2022-26744.md): A memory corruption issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2022-27777](https://cve.now/CVE-2022-27777.md): A XSS Vulnerability in Action View tag helpers \>= 5.2.0 and \< 5.2.0 which would allow an attacker to inject content if able to control input (no CVSS, https://github.com/rails/rails · actionview)
- [CVE-2022-30783](https://cve.now/CVE-2022-30783.md): An invalid return code in fuse\_kern\_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G th (no CVSS)
- [CVE-2022-30784](https://cve.now/CVE-2022-30784.md): A crafted NTFS image can cause heap exhaustion in ntfs\_get\_attribute\_value in NTFS-3G through 2021.8.22. (CVSS 6.7)
- [CVE-2022-30785](https://cve.now/CVE-2022-30785.md): A file handle created in fuse\_lib\_opendir, and later used in fuse\_lib\_readdir, enables arbitrary memory read and write operations in NTFS-3G (no CVSS)
- [CVE-2022-30786](https://cve.now/CVE-2022-30786.md): A crafted NTFS image can cause a heap-based buffer overflow in ntfs\_names\_full\_collate in NTFS-3G through 2021.8.22. (CVSS 6.7)
- [CVE-2022-30787](https://cve.now/CVE-2022-30787.md): An integer underflow in fuse\_lib\_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite. (no CVSS)
- [CVE-2022-30788](https://cve.now/CVE-2022-30788.md): A crafted NTFS image can cause a heap-based buffer overflow in ntfs\_mft\_rec\_alloc in NTFS-3G through 2021.8.22. (CVSS 6.7)
- [CVE-2022-30789](https://cve.now/CVE-2022-30789.md): A crafted NTFS image can cause a heap-based buffer overflow in ntfs\_check\_log\_client\_array in NTFS-3G through 2021.8.22. (CVSS 6.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-05-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.