# CVEs published 2022-11-26

4 CVEs were published on November 26, 2022: 3 critical, 1 high. Days are UTC.

- [CVE-2022-24999](https://cve.now/CVE-2022-24999.md): qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express applicat (CVSS 7.5, qs)
- [CVE-2022-45907](https://cve.now/CVE-2022-45907.md): In PyTorch before trunk/89695, torch.jit.annotations.parse\_type\_line can cause arbitrary code execution because eval is used unsafely. (CVSS 9.8, torch)
- [CVE-2022-45908](https://cve.now/CVE-2022-45908.md): In PaddlePaddle before 2.4, paddle.audio.functional.get\_window is vulnerable to code injection because it calls eval on a user-supplied wins (CVSS 9.8, paddlepaddle)
- [CVE-2022-45909](https://cve.now/CVE-2022-45909.md): drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.