Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint witho

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable

CVSS 9.8

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauth

Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passke

CVSS 9.3

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell co

git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed doc

CVSS 9.3

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers tha

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names o

CVSS 9.3

pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdf

pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling

CVSS 9.3

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute comman

doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or

CVSS 9.3

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute c

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers c

CVSS 9.3

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute com

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attack

CVSS 9.3

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute

transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject

CVSS 9.3

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows

nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide

CVSS 9.3

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execu

Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg comma

CVSS 9.3

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell co

Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...)

CVSS 9.3

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail(

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file path

CVSS 9.3

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/down

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is un

CVSS 9.2

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent meth

CVSS 9.2