Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination against internal network addresses.Check if you run itEPSS 0.41%Oct 14, 2026
- Critical9.3The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying…Check if you run itEPSS 2.99%Oct 14, 2026
- Critical9.3Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths.Check if you run itEPSS 2.52%Oct 14, 2026
- High8.5@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names.Check if you run itEPSS 1.15%Oct 14, 2026
- High8.5Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names.Check if you run itEPSS 1.04%Oct 14, 2026
- Critical9.3Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted…Check if you run itEPSS 3.25%Oct 14, 2026
- Critical9.3nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths.Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio().Check if you run itEPSS 2.64%Oct 14, 2026
- High8.5Command InjectionCheck if you run itEPSS 1.15%Oct 14, 2026
- High8.7@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file…Check if you run itEPSS 2.51%Oct 14, 2026
- Critical9.3Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.lan…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag().Check if you run itEPSS 2.73%Oct 14, 2026
- High8.5buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file nam…Check if you run itEPSS 1.15%Oct 14, 2026
- Critical9.3webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.Check if you run itEPSS 2.52%Oct 14, 2026
- Critical9.3git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API.Check if you run itEPSS 2.35%Oct 14, 2026
- High8.5MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker…Check if you run itEPSS 0.14%Oct 14, 2026
- High7.0VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestric…Check if you run itEPSS 0.64%Oct 14, 2026
- High7.1VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire…Check if you run itEPSS 0.57%Oct 14, 2026
- Critical9.2Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.Check if you run itEPSS 0.43%Oct 14, 2026
- Low2.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val param…Check if you run itEPSS 0.36%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.Check if you run itEPSS 0.35%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.Check if you run itEPSS 0.39%Oct 14, 2026
- Low2.3Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying…Check if you run itEPSS 0.33%Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by…Check if you run itEPSS 0.50%Oct 14, 2026