Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 23:34:50 +0000 CVE-2026-110649 — Stills before 25.24.2 OS Command Injection via Media File Names https://db.gcve.eu/vuln/cve-2026-110649 <p><strong>Affected:</strong> shahkashani stills</p> <p>Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.</p> <p><strong>Affected:</strong> shahkashani stills</p> <p>Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.</p> https://db.gcve.eu/vuln/cve-2026-110649