CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...

DEBIAN-CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

Summary The AttributesExtension documents a security guarantee: Note: Attributes starting with on e.g. onclick or onerror are capable of executing JavaScript code and are therefore never allowed by default. You must explicitly add them to the allow list if you want to use them. —...

GHSA-F8FG-PG57-V4J8 league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

Summary The AttributesExtension documents a security guarantee: Note: Attributes starting with on e.g. onclick or onerror are capable of executing JavaScript code and are therefore never allowed by default. You must explicitly add them to the allow list if you want to use them. —...

Allocation of Resources Without Limits or Throttling

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via parsemultipartformdata in tornado/httputil.py, where the maxparts limit...

CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...

CVE-2026-84311 pypdf: Possible long runtimes/large memory usage when extracting XForm objects

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...

EUVD-2026-69607

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...

CVE-2026-84311

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...

EUVD-2026-56887

Django REST framework: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Contact Form 'redirecturl' Shortcode Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.5...

CVE-2022-43671

creationtimestamp| type| source ---|---|--- 2026-09-01 17:00:24+00:00| seen| https://t.me/cissp/6361 2026-09-02 01:04:07+00:00| seen| https://t.me/cissp/6361 2026-09-10 06:00:06+00:00| published-proof-of-concept| https://t.me/cissp/6361 2026-09-11 00:00:51+00:00| published-proof-of-concept|...

CVE-2026-84110

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be...

EUVD-2026-69214

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be...

CVE-2026-84110 Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be...

CVE-2026-84110 Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-side security

A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Validation. The manipulation results in client-side enforcement of server-side security. The attack may be launched remotely. The exploit is now public and may be...

CVE-2026-84110

Releasit COD Form & Upsells v1 contains a vulnerability in its OTP Validation component where server-side security is enforced only on the client side, allowing remote attackers to bypass one-time password validation without authentication or user interaction. The vulnerability results in a low i...

SUSE CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2026-27475 CVSS-B 9.2 CRITICAL Authenticated Insecur...

CVE-2026-78363

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation require...