SUSE-SU-2026:3268-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues: - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes being called without decompressionbombcheck bsc1270409. -...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

!IMPORTANT This repository is intended for learning about...

Denial Of Service (DoS)

dompdf/dompdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper resource consumption controls during the PDF rendering phase after image dimension validation, which allows an unauthenticated attacker to submit a specially crafted HTML document containing a large...

Denial Of Service (DoS)

pypdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of unterminated inline images using the ASCII85 or ASCIIHex filters during PDF parsing, which allows an attacker to craft a malicious PDF that triggers an infinite loop and causes a denial of service...

Denial Of Service (DoS)

pypdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper detection of inline image end markers in PDF page content streams, which allows an attacker to craft a malicious PDF that triggers an infinite loop during parsing and causes a denial of service...

EUVD-2026-48767

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection RCE via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the pagesize, orientation or margins...

CVE-2026-16766 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection RCE via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the pagesize, orientation or margins...

Linux Distros Unpatched Vulnerability : CVE-2026-16377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

Uncontrolled Resource Consumption

dompdf/dompdf is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the library trusting attacker-controlled BMP header dimensions without validating the image size before conversion, which allows an attacker to embed a crafted BMP image e.g., via a data:image/bmp;base64...

OESA-2026-3139 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0,...

CVE-2026-6454

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

EUVD-2026-48462

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

PT-2026-64230

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-16377

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the PDF Viewer component...

EUVD-2026-42343

pypdf: Possible large memory usage for wrong image dimensions...

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...

PYSEC-2026-3495 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...

EUVD-2026-48129

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

CVE-2026-65528

The CVE-2026-65528 entry concerns the WordPress BSK PDF Manager plugin (versions up to 3.8) with a Cross Site Scripting (XSS) vulnerability. The root cause is XSS in this plugin version, affecting the product where user input is not properly sanitized. The documents do not provide details on the ...