Skip to content
OpenAdvisories

Archive

26 November 2022

Vulnerabilities first published on this day (UTC), newest first.

← October 2022 2022 / November /26 December 2022 →
  1. 1211
  2. 273
  3. 3120
  4. 437
  5. 52
  6. 66
  7. 763
  8. 8120
  9. 9179
  10. 1092
  11. 1191
  12. 1211
  13. 1315
  14. 1497
  15. 15108
  16. 1644
  17. 1788
  18. 18105
  19. 195
  20. 208
  21. 2190
  22. 2284
  23. 2398
  24. 2421
  25. 2559
  26. 264
  27. 278
  28. 2867
  29. 2986
  30. 3057
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2022-24999 Public exploit EPSS 16%

    qs vulnerable to Prototype Pollution

    qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…

    js-jquery nodejs-nodemon qs node-qs Debian Ubuntu Azure Linux npm
  • Critical 9.8
    CVE-2022-45908

    PaddlePaddle vulnerable to code injection via winstr

    In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution.

    paddlepaddle PyPI
  • Critical 9.8
    CVE-2022-45907

    PyTorch vulnerable to arbitrary code execution

    In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.

    pytorch pytorch torch Debian Ubuntu PyPI
  • Critical 9.1
    CVE-2022-45909

    drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.