EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26476.json"