CVE-2026-73032

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability: an unsanitized LLM response passed to window.eval() in views.ts allows arbitrary JavaScript execution in Zotero's chrome-privileged context. Attackers can exploit prompt injection in PDFs, MITM interception of API requests...

CVE-2026-73032 PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...