[ Vendor · 15 CVEs ]
qax-os
CVEs affecting qax-os published in the last 30 days, plus any qax-os CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-107224 | 7 Oct 2026 | CVSS 6.5 | Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReaderExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with the high… | Fix |
| CVE-2026-107225 | 7 Oct 2026 | CVSS 6.5 | Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xmlExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and font… | Fix |
| CVE-2026-107218 | 7 Oct 2026 | CVSS 5.3 | Excelize: RIGHT() on supplementary-plane text slices with a negative index and panicsExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.10.1 to 2.11.0, RIGHT validates the requested length… | Fix |
| CVE-2026-107219 | 7 Oct 2026 | CVSS 7.5 | Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFileExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an… | Fix |
| CVE-2026-107220 | 7 Oct 2026 | CVSS 6.5 | Excelize: Panic in cellInRange on a worksheet with an empty mergeCell refExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the cached… | Fix |
| CVE-2026-107221 | 7 Oct 2026 | CVSS 6.5 | Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read APIExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice… | Fix |
| CVE-2026-107222 | 7 Oct 2026 | CVSS 6.5 | Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil checkExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction indexes… | Fix |
| CVE-2026-107223 | 7 Oct 2026 | CVSS 7.5 | Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the processExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded column… | Fix |
| CVE-2026-107217 | 7 Oct 2026 | CVSS 7.5 | Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rowsExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from… | Fix |
| CVE-2026-107214 | 7 Oct 2026 | CVSS 7.5 | Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs… | Fix |
| CVE-2026-107215 | 7 Oct 2026 | CVSS 7.5 | Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice… | Fix |
| CVE-2026-107216 | 7 Oct 2026 | CVSS 7.5 | Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the… | Fix |
| CVE-2026-107211 | 7 Oct 2026 | CVSS 5.5 | Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panicExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field… | Fix |
| CVE-2026-107212 | 7 Oct 2026 | CVSS 7.5 | Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row… | Fix |
| CVE-2026-107213 | 7 Oct 2026 | CVSS 5.5 | Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementExcelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.9.0 to 2.11.0, GetSlicers checks for ExtLst but… | Fix |