Stirling-Tools vulnerabilities

CVEs per yearBy the year they were published

1. 20242
2. 20254
3. 202613

Newest CVEs

• CVE-2026-119343

  Stirling-PDF: AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read

  Stirling-Tools · Stirling-PDF

  Medium6.8
• CVE-2026-119342

  Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

  Stirling-Tools · Stirling-PDF

  Medium5.3
• CVE-2026-113606

  Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders

  Stirling-Tools · Stirling-PDF

  High7.1
• CVE-2026-113605

  Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

  Stirling-Tools · Stirling-PDF

  High8.6
• CVE-2026-85714

  Stirling-PDF: Remote Code Execution via H2

  Stirling-Tools · Stirling-PDF

  Critical9.1
• CVE-2026-57485

  Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

  Stirling-Tools · Stirling-PDF

  High8.5
• CVE-2026-33437

  Stirling PDF: Stored XSS in Info Summary

  Stirling-Tools · Stirling-PDF

  High8.1
• CVE-2026-71270

  Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess

  Stirling-Tools · Stirling-PDF

  High8.6
• CVE-2026-41580

  Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)

  Stirling-Tools · Stirling-PDF

  Medium6.1
• CVE-2026-33436

  Stirling-PDF: Reflected XSS through crafted filename in file upload functionality

  Stirling-Tools · Stirling-PDF

  Low3.1