CVE Tools
Track your stack

Gotenberg

13 CVEs tracked since 2026. Since May 2026, none of them reached CISA KEV.

Gotenberg CVEs per month

May 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Gotenberg CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-05130
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-108 or fewer

Products

The products that kept showing up in Gotenberg's monthly top three, with their CVEs summed over those months.

  1. Gotenberg131 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Gotenberg.

  1. CVE-2026-44829Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename8.8
  2. CVE-2026-45742Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')7.5
  3. CVE-2026-45741Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes7.5
  4. CVE-2026-55229Gotenberg: SSRF via LibreOffice document processing7.5
  5. CVE-2026-42590Gotenberg: ExifTool group-prefix syntax bypasses dangerous-tag blocklist8.2
  6. CVE-2026-42597Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme5.9
  7. CVE-2026-42595Gotenberg: Server-Side Request Forgery via Chromium URL Endpoint with Redirect-Based Deny-List Bypass8.6
  8. CVE-2026-42594Gotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutine7.5
  9. CVE-2026-42593Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes5.3
  10. CVE-2026-42592Gotenberg: DNS rebinding bypasses SSRF validation on Chromium URL conversion routes5.3
  11. CVE-2026-42591Gotenberg: Server-Side Request Forgery (SSRF) in github.com/gotenberg/gotenberg/v88.2
  12. CVE-2026-42596Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook9.4
  13. CVE-2026-40893Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move8.2
  14. CVE-2026-42589Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection9.8
  15. CVE-2026-40281Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values10.0

The record

Peak rank
#90 in May 2026
Busiest month shown
May 2026, 13 CVEs
Months with a KEV entry
0 since May 2026
Monthly snapshots
1 since 2026
Gotenberg's full record, month by month