Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.5Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names.Check if you run itEPSS 1.04%Oct 14, 2026
- Critical9.3Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted…Check if you run itEPSS 3.25%Oct 14, 2026
- Critical9.3nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths.Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio().Check if you run itEPSS 2.64%Oct 14, 2026
- High8.5Command InjectionCheck if you run itEPSS 1.15%Oct 14, 2026
- High8.7@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file…Check if you run itEPSS 2.51%Oct 14, 2026
- Critical9.3Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.lan…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag().Check if you run itEPSS 2.73%Oct 14, 2026
- High8.5buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file nam…Check if you run itEPSS 1.15%Oct 14, 2026
- Critical9.3webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.Check if you run itEPSS 2.52%Oct 14, 2026
- Critical9.3git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API.Check if you run itEPSS 2.35%Oct 14, 2026
- High8.5MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker…Check if you run itEPSS 0.14%Oct 14, 2026
- Critical9.2Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invok…Check if you run itEPSS 0.65%Oct 14, 2026
- High7.0VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestric…Check if you run itEPSS 0.64%Oct 14, 2026
- High7.1VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire…Check if you run itEPSS 0.57%Oct 14, 2026
- Critical9.2Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.Check if you run itEPSS 0.43%Oct 14, 2026
- Low2.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val param…Check if you run itEPSS 0.36%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.Check if you run itEPSS 0.35%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.Check if you run itEPSS 0.39%Oct 14, 2026
- Low2.3Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying…Check if you run itEPSS 0.33%Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by…Check if you run itEPSS 0.50%Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management a…Check if you run itEPSS 0.50%Oct 14, 2026
- High8.7Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects…Check if you run itEPSS 0.52%Oct 14, 2026
- Medium6.1Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ow…Check if you run itEPSS 0.56%Oct 14, 2026