EUVD-2026-114124

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write whe...

CVE-2026-119719 Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumbdataverticalflip. Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write whe...

EUVD-2026-114123

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcachedataalloc when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute...

CVE-2026-119718 Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcachedataalloc when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute...

CVE-2026-119718

Blender versions before 4.5.15 and 5.x before 5.2.3 are vulnerable to a heap buffer overflow within the ptcache_data_alloc() function. This flaw is caused by an integer overflow occurring during the processing of point cache files . An attacker can leverage this by providing a crafted point cache...

CVE-2026-119718 Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcachedataalloc when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute...

EUVD-2026-114122

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...

CVE-2026-119717 pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...

CVE-2026-119716 pybars3 through 0.9.7 Code Injection via Bracketed Path Segments

pybars3 through 0.9.7 contains a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string litera...

CVE-2026-119717 pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...

CVE-2026-119716 pybars3 through 0.9.7 Code Injection via Bracketed Path Segments

pybars3 through 0.9.7 contains a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string litera...

CVE-2026-119717 pybars4 through 0.9.13 Code Injection via Bracketed Path Segments

pybars4 through 0.9.13 contains a code injection vulnerability in pybars/compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the...

CVE-2026-119717

Versions pybars4 through 0.9.13 are vulnerable to a code injection flaw located in pybars/_compiler.py. The issue stems from the handling of unescaped bracketed path segments in Handlebars templates. An attacker can provide a template containing a crafted segment within a helper or block argument...

CVE-2026-119716

The pybars3 library (versions through 0.9.7 ) is vulnerable to a code injection flaw located in pybars/_compiler.py. The root cause is the handling of unescaped bracketed path segments , which allows template authors to execute arbitrary Python code . By providing crafted segments within Handleba...

EUVD-2026-114121

pybars3 through 0.9.7 contains a code injection vulnerability in pybars/compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string litera...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

EUVD-2026-114118

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713 Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands

Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through...

CVE-2026-119713

Paperclip versions 2026.403.0 before 2026.416.0 are vulnerable to Remote Code Execution (RCE) due to an OS Command Injection flaw (CWE-78). Agent API key holders can utilize the PATCH /api/execution-workspaces/:id endpoint to set arbitrary cleanupCommand and teardownCommand values. When a workspa...