2026

Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands b

Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attacke

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute command

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to ex

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to exec

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by s

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supp

buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execut

pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_uti

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libw

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by

MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to m

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote at

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated

VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows a

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attat

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that al

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list oth

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authent

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipula

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows au

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and upda

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers t

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unau

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to acces

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framew

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to v

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privile

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderContro

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticate

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplyi

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal p

LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninit

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame()

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_eleme

L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary()

Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attack