| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-25946 | Gitea OpenID discovery server-side request forgery | Gitea | Gitea | - | - | 2026-10-14 14:28:16 | Deep Dive |
| CVE-2026-110650 | Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths | anshulkharb | thumbnail | Critical | 9.8 | 2026-10-14 14:17:18 | Deep Dive |
| CVE-2026-110649 | Stills before 25.24.2 OS Command Injection via Media File Names | shahkashani | stills | Critical | 9.8 | 2026-10-14 14:17:17 | Deep Dive |
| CVE-2026-110647 | Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names | jinghaihan | turnpress | High | 7.8 | 2026-10-14 14:17:16 | Deep Dive |
| CVE-2026-110648 | @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names | adamarcanov | compress-fonts | High | 7.8 | 2026-10-14 14:17:16 | Deep Dive |
| CVE-2026-110646 | Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl() | beganovich | snappdf | High | 8.1 | 2026-10-14 14:17:15 | Deep Dive |
| CVE-2026-110645 | Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut() | ArsalanDotMe | video-stitch | Critical | 9.8 | 2026-10-14 14:17:14 | Deep Dive |
| CVE-2026-110644 | nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType | ChetanXpro | nodejs-whisper | Critical | 9.8 | 2026-10-14 14:17:14 | Deep Dive |
| CVE-2026-110642 | xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name | xhtml2pdf | xhtml2pdf | High | 7.8 | 2026-10-14 14:17:13 | Deep Dive |
| CVE-2026-110643 | transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath | kky-ykk | transcribe2texts | Critical | 9.8 | 2026-10-14 14:17:13 | Deep Dive |
| CVE-2026-110641 | @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name | runnerty | @runnerty/executor-decompress | High | 8.8 | 2026-10-14 14:17:12 | Deep Dive |
| CVE-2026-110639 | @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir | mborne | @mborne/extract | Critical | 9.8 | 2026-10-14 14:17:11 | Deep Dive |
| CVE-2026-110640 | Whisper-node through 1.1.1 OS Command Injection via filePath and language | ariym | whisper-node | Critical | 9.8 | 2026-10-14 14:17:11 | Deep Dive |
| CVE-2026-110638 | doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path | zepspaiva | doc-recog | Critical | 9.8 | 2026-10-14 14:17:10 | Deep Dive |
| CVE-2026-110637 | buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name | wastemobile | buildebooks | High | 7.8 | 2026-10-14 14:17:09 | Deep Dive |
| CVE-2026-110635 | webp-converter before 3.0.0 OS Command Injection via File Names and Options | scionoftech | webp-converter | Critical | 9.8 | 2026-10-14 14:17:08 | Deep Dive |
| CVE-2026-110636 | pypdftk through 0.5 OS Command Injection via PDF and Output Paths | revolunet | pypdftk | Critical | 9.8 | 2026-10-14 14:17:08 | Deep Dive |
| CVE-2026-110634 | git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings | danday74 | git-diff | Critical | 9.8 | 2026-10-14 14:17:07 | Deep Dive |
| CVE-2026-110632 | Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE | Report One | MyReport Updater | High | 8.1 | 2026-10-14 14:17:06 | Deep Dive |
| CVE-2026-110633 | MyReport Updater through 2.1.1 Local Privilege Escalation via Updater Service | Report One | MyReport Updater | High | 7.8 | 2026-10-14 14:17:06 | Deep Dive |