Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted…Check if you run itEPSS 3.25%Oct 14, 2026
- Critical9.3nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths.Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio().Check if you run itEPSS 2.64%Oct 14, 2026
- High8.5Command InjectionCheck if you run itEPSS 1.15%Oct 14, 2026
- High8.7@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file…Check if you run itEPSS 2.51%Oct 14, 2026
- Critical9.3Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.lan…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag().Check if you run itEPSS 2.73%Oct 14, 2026
- High8.5buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file nam…Check if you run itEPSS 1.15%Oct 14, 2026
- Critical9.3webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.Check if you run itEPSS 2.52%Oct 14, 2026
- Critical9.3git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API.Check if you run itEPSS 2.35%Oct 14, 2026
- High8.5MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker…Check if you run itEPSS 0.14%Oct 14, 2026
- High7.0VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestric…Check if you run itEPSS 0.64%Oct 14, 2026
- High7.1VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire…Check if you run itEPSS 0.57%Oct 14, 2026
- Critical9.2Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.Check if you run itEPSS 0.43%Oct 14, 2026
- Low2.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val param…Check if you run itEPSS 0.36%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.Check if you run itEPSS 0.35%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.Check if you run itEPSS 0.39%Oct 14, 2026
- Low2.3Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying…Check if you run itEPSS 0.33%Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by…Check if you run itEPSS 0.50%Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management a…Check if you run itEPSS 0.50%Oct 14, 2026
- High8.7Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects…Check if you run itEPSS 0.52%Oct 14, 2026
- Medium6.1Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ow…Check if you run itEPSS 0.56%Oct 14, 2026
- Medium6.3frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers…Check if you run itEPSS 0.78%Oct 14, 2026
- High8.6SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs.Check if you run itEPSS 0.39%Oct 14, 2026