Export limit exceeded: 25812 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410276 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410276 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110257 | 1 Ow2 | 1 Asm | 2026-10-19 | 5.5 Medium |
| OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB allocation, causing an OutOfMemoryError that crashes the JVM or consuming thread. | ||||
| CVE-2026-110258 | 1 Ow2 | 1 Asm | 2026-10-19 | 5.5 Medium |
| OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted invalid class file with multiple RET instructions for one JSR, triggering a roughly 2 GB allocation that crashes the JVM. | ||||
| CVE-2026-110591 | 1 Ow2 | 1 Asm | 2026-10-19 | 5.5 Medium |
| OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded per-instruction Frame allocation and fix point iterations, causing denial of service. | ||||
| CVE-2026-110592 | 1 Micropyramid | 2 Bottlecrm, Django Crm | 2026-10-19 | 3.5 Low |
| BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, payee and payment instructions in PDFs served via download, public links and emails. | ||||
| CVE-2026-110593 | 1 Micropyramid | 2 Bottlecrm, Django Crm | 2026-10-19 | 5.4 Medium |
| BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members can submit template tags through POST /api/accounts/<id>/create_mail/ to disclose the rendering context and loaded Python modules, or block the shared Celery worker with nested loops. | ||||
| CVE-2026-110596 | 1 Dlbeer | 1 Quirc | 2026-10-19 | 5.5 Medium |
| quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three finder patterns producing a near-degenerate perspective transform, causing billions of region_code() iterations that exhaust CPU in applications decoding attacker-supplied QR images. | ||||
| CVE-2026-110598 | 1 Libyal | 1 Libpff | 2026-10-19 | 6.1 Medium |
| Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft PST, OST or PAB files with decreasing PT_MV_STRING8, PT_MV_UNICODE or PT_MV_BINARY offsets to crash libpff, pypff or pffexport and expose adjacent heap memory. | ||||
| CVE-2026-110599 | 1 L-smash | 1 L-smash | 2026-10-19 | 7.1 High |
| L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes. | ||||
| CVE-2026-110605 | 1 Tomolt | 1 Libschrift | 2026-10-19 | 5.5 Medium |
| libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table. Attackers can provide a crafted TrueType font whose NaN glyph coordinates bypass clip_points(), causing an out-of-bounds raster read in draw_line() during sft_render() and crashing the process. | ||||
| CVE-2026-110633 | 1 Report One | 1 Myreport Updater | 2026-10-19 | 7.8 High |
| MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges. | ||||
| CVE-2026-69994 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-10-19 | 7.5 High |
| Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-110635 | 1 Scionoftech | 1 Webp-converter | 2026-10-19 | 9.8 Critical |
| webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process. | ||||
| CVE-2026-110636 | 1 Revolunet | 1 Pypdftk | 2026-10-19 | 9.8 Critical |
| pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process. | ||||
| CVE-2026-110637 | 1 Wastemobile | 1 Buildebooks | 2026-10-19 | 7.8 High |
| buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks. | ||||
| CVE-2026-110638 | 1 Zepspaiva | 1 Doc-recog | 2026-10-19 | 9.8 Critical |
| doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges. | ||||
| CVE-2026-110640 | 1 Ariym | 1 Whisper-node | 2026-10-19 | 9.8 Critical |
| Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges. | ||||
| CVE-2026-110641 | 1 Runnerty | 1 Executor-decompress | 2026-10-19 | 8.8 High |
| @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges. | ||||
| CVE-2026-110643 | 1 Kky-ykk | 1 Transcribe2texts | 2026-10-19 | 9.8 Critical |
| transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges. | ||||
| CVE-2026-110644 | 1 Chetanxpro | 1 Nodejs-whisper | 2026-10-19 | 9.8 Critical |
| nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges. | ||||
| CVE-2026-110647 | 1 Jinghaihan | 1 Turnpress | 2026-10-19 | 7.8 High |
| Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create. | ||||