Lucene search
+L

28290 matches found

NVD
NVD
added 2026/07/29 4:17 p.m.20 views

CVE-2026-54082

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

6.5CVSS0.0023EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/07/29 3:34 p.m.12 views

CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

5.9CVSS5.9AI score0.00298EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/29 3:34 p.m.45 views

CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

5.9CVSS0.00298EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/29 3:34 p.m.16 views

EUVD-2026-50395

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

5.9CVSS5.9AI score0.00298EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/29 3:34 p.m.67 views

CVE-2026-50558

Penelope Shell Handler vulnerability CVE-2026-50558 affects the Unix download() implementation in penelope.py. Prior to version 0.20.0, tar.extractall(local_download_folder) on tar archives from remote sessions did not validate member paths, allowing a malicious or compromised session to write fi...

5.9CVSS5.9AI score0.00298EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/29 3:34 p.m.13 views

CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...

5.9CVSS5.9AI score
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/07/29 3:14 p.m.18 views

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

Summary veraPDF-validation has an XML External Entity XXE vulnerability in two PDF parsing paths validate and GFPDAcroForm.getdynamicRender. A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values o...

6.5CVSS5.9AI score0.0023EPSS
SaveExploits0References5Affected Software2
OSV
OSV
added 2026/07/29 3:14 p.m.11 views

GHSA-CG9X-G3GM-H5H6 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

Summary veraPDF-validation has an XML External Entity XXE vulnerability in two PDF parsing paths validate and GFPDAcroForm.getdynamicRender. A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values o...

6.5CVSS5.9AI score0.0023EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/29 3:14 p.m.12 views

CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

6.5CVSS5.8AI score
SaveExploits0References6
CVE
CVE
added 2026/07/29 3:14 p.m.76 views

CVE-2026-54082

The CVE-2026-54082 entry affects veraPDF-validation, specifically the PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender() paths. The issue stems from parsing using the default DocumentBuilderFactory, enabling XML External Entity (XXE) processing when handling rich-text annotations, fo...

6.5CVSS5.8AI score0.0023EPSS
SaveExploits0References4
attackerkb
attackerkb
added 2026/07/29 3:11 p.m.20 views

CVE-2026-54078

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References5Affected Software1
CVE
CVE
added 2026/07/29 3:11 p.m.79 views

CVE-2026-54078

The VeraPDF validation project contains an XXE vulnerability in the validation-model module (DictionaryKeysHelper.getRichTextStringOrStreamEntryStringRepresentation). A crafted PDF with malicious rich-text /RC or /RV entries can trigger external entity expansion and reflect local file contents in...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/07/29 3:07 p.m.18 views

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/29 3:07 p.m.11 views

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

8.7CVSS5.8AI score
SaveExploits0References6
attackerkb
attackerkb
added 2026/07/29 3:07 p.m.12 views

CVE-2026-54079

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References5Affected Software1
CVE
CVE
added 2026/07/29 3:07 p.m.88 views

CVE-2026-54079

CVE-2026-54079 affects veraPDF Validation. The XXE flaw resides in veraPDF-validation’s GFPDAcroForm.getdynamicRender() and is triggered by a crafted PDF containing a malicious XFA stream, causing external entity expansion during PDF/UA-1 validation. Consequences include local file disclosure or ...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/29 12:00 a.m.24 views

PT-2026-65822

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/28 10:17 p.m.12 views

CVE-2026-55389

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...

7.5CVSS0.0043EPSS
SaveExploits1References3
OSV
OSV
added 2026/07/28 9:49 p.m.16 views

GHSA-8359-H9FX-J6V9 datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

Summary datamodel-code-generator resolves JSON-Schema $ref targets that point at the local filesystem without restricting them to the input/base directory and without honoring the remote-reference security control. In the default configuration, an attacker who controls an input schema a "paste yo...

7.5CVSS6AI score0.0043EPSS
SaveExploits1References4
Snyk
Snyk
added 2026/07/28 9:49 p.m.17 views

Directory Traversal

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Directory Traversal via the resolution of JSON-Schema $ref references that point to local files using either file:// URIs or ../-escaped relative paths, without restricting access t...

8.7CVSS6.2AI score0.0043EPSS
SaveExploits1References2
Rows per page
Query Builder