THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,900 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates
- NVDUp to date · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUp to date · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-110650 — The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
CVE-2026-110650Read original ↗ (opens in a new tab) - NVD
CVE-2026-110649 — Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supp…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
CVE-2026-110649Read original ↗ (opens in a new tab) - NVD
CVE-2026-110648 — @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell…
High · CVSS 4.0 8.5 · Assessor: [email protected]
@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through child_process.execSync, so shell metacharacters in file names execute commands with the Node.js process privileges.
CVE-2026-110648Read original ↗ (opens in a new tab) - NVD
CVE-2026-110647 — Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by su…
High · CVSS 4.0 8.5 · Assessor: [email protected]
Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names. The convertDocxToHtml function in src/converter.ts invokes pandoc through execa with shell:true, so shell metacharacters in the --docx path run with the victim's privileges during convert or create.
CVE-2026-110647Read original ↗ (opens in a new tab) - NVD
CVE-2026-110646 — Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers t…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL. Attackers can supply cmd.exe metacharacters such as & in the setUrl() value, which executeOnWindows() passes unescaped to PHP exec(), executing commands as the PHP process.
CVE-2026-110646Read original ↗ (opens in a new tab) - NVD
CVE-2026-110645 — Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted into shell-executed ffmpeg command lines. Attackers who influence file names passed to concat(), cut(), or merge() can inject shell metacharacters to run commands with the Node.js process privileges.
CVE-2026-110645Read original ↗ (opens in a new tab) - NVD
CVE-2026-110644 — nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to e…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in convertToWavType() that allows attackers to execute commands by supplying crafted audio file paths. Attackers can provide file names containing $() command substitution or closing quotes, which are interpolated into an ffmpeg command run via shelljs exec(), executing OS commands with Node.js process privileges.
CVE-2026-110644Read original ↗ (opens in a new tab) - NVD
CVE-2026-110643 — transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by s…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
CVE-2026-110643Read original ↗ (opens in a new tab) - NVD
CVE-2026-110642 — xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execut…
High · CVSS 4.0 8.5 · Assessor: [email protected]
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
CVE-2026-110642Read original ↗ (opens in a new tab) - NVD
CVE-2026-110641 — @runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute…
High · CVSS 4.0 8.7 · Assessor: [email protected]
@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compress_file. Attackers who can name a file dropped into a watched directory can inject $() substitutions or unquoted shell metacharacters into shelljs exec() calls, running commands with Runnerty process privileges.
CVE-2026-110641Read original ↗ (opens in a new tab) - NVD
CVE-2026-110640 — Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by suppl…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
CVE-2026-110640Read original ↗ (opens in a new tab) - NVD
CVE-2026-110639 — @mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by sup…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.
CVE-2026-110639Read original ↗ (opens in a new tab) - NVD
CVE-2026-110638 — doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplyin…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
CVE-2026-110638Read original ↗ (opens in a new tab) - NVD
CVE-2026-110637 — buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute co…
High · CVSS 4.0 8.5 · Assessor: [email protected]
buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute commands by supplying a crafted EPUB file name passed to kindlegen via child_process.exec. Attackers can craft a book project with a malicious front-matter filename or project folder name and kindle: true to execute OS commands as the user running buildebooks.
CVE-2026-110637Read original ↗ (opens in a new tab) - NVD
CVE-2026-110636 — pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util()…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
CVE-2026-110636Read original ↗ (opens in a new tab) - NVD
CVE-2026-110635 — webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
CVE-2026-110635Read original ↗ (opens in a new tab) - NVD
CVE-2026-110634 — git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supp…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
git-diff before 2.0.7 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted strings to the gitDiff API. Attackers who control a diffed document string can embed $(cmd) or backtick substitutions that shelljs.exec evaluates, running commands with Node.js process privileges.
CVE-2026-110634Read original ↗ (opens in a new tab) - NVD
CVE-2026-110633 — MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make…
High · CVSS 4.0 8.5 · Assessor: [email protected]
MyReport Updater through 2.1.1 contains a local privilege escalation vulnerability that allows low-privileged users to make the SYSTEM updater service install attacker-supplied archives into arbitrary directories. Attackers can use UpdaterManager.exe over gRPC to set a malicious reference server and installLocation, planting a DLL like HID.dll loaded by osk.exe to gain SYSTEM privileges.
CVE-2026-110633Read original ↗ (opens in a new tab) - NVD
CVE-2026-110632 — Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attack…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module archives with matching MD5 digests to write files and execute code as SYSTEM.
CVE-2026-110632Read original ↗ (opens in a new tab) - NVD
CVE-2026-110631 — Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated atta…
Critical · CVSS 4.0 9.3 · Assessor: [email protected]
Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because empty core_public_keys and passkeys lists fail open by default. Attackers reaching port 8120 can present any generated keypair to issue Periphery API requests, including terminal sessions and container operations, executing commands on managed hosts typically as root.
CVE-2026-110631Read original ↗ (opens in a new tab) - NVD
CVE-2026-110630 — VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authe…
High · CVSS 4.0 7.0 · Assessor: [email protected]
VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestricted roles via Role::find. Attackers with user-management access can assign the Owner role or other teams' roles and delete cross-team users through the unscoped UserIndex delete() method.
CVE-2026-110630Read original ↗ (opens in a new tab) - NVD
CVE-2026-110629 — VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypa…
High · CVSS 4.0 7.1 · Assessor: [email protected]
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or use unguarded Activities and Products routes, to modify deals, quotes, orders and invoices.
CVE-2026-110629Read original ↗ (opens in a new tab) - NVD
CVE-2026-110628 — Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchme…
Critical · CVSS 4.0 9.2 · Assessor: [email protected]
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.
CVE-2026-110628Read original ↗ (opens in a new tab) - NVD
CVE-2026-110627 — ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows…
Low · CVSS 4.0 2.1 · Assessor: [email protected]
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin.
CVE-2026-110627Read original ↗ (opens in a new tab) - NVD
CVE-2026-110626 — ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php…
Medium · CVSS 4.0 5.1 · Assessor: [email protected]
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission a crafted link whose payload is echoed into a hidden input, executing script in the admin panel origin.
CVE-2026-110626Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.