Stirling-Tools has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 7.2 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.2
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-85714Critical· 9.1Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files62CVE-2026-113605High· 7.2Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database52CVE-2026-113606High· 7.1Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders39
Stirling-Tools vulnerabilities
CVEs affecting Stirling-Tools, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-113606High· 7.1Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a f…
CVE-2026-113605High· 7.2PoCStirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can up…
CVE-2026-85714Critical· 9.1PoCStirling-PDF is a locally hosted web application that facilitates various operations on PDF files
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api…