CVE-2026-86950-POC

CVE-2026-86950-POC Proof of Concept for CVE-2026-86950 Verification: EXPLOIT DETECTED exp.pdf - glyph 'space' outline extends 240x the em square 239978 font units -- impossible for a legitimate glyph - 4096 x device coordinate reaches 2.95e+09 at text size 3000, overflowing int32 2147483647 -- th...

CVE-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

cve-2026-24688

CVE-2026-24688 - pypdf - Circular Reference DoS Vulnerability This repo includes proof of concept code for triggering CVE-2026-24688. Summary Critical Denial of Service vulnerability in pypdf's outline bookmark parsing logic. When processing a PDF with circular outline references, the parser ente...

CVE-2026-120489 Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then...

CVE-2026-120489

Versions of Outline prior to 1.12.0 are affected by an incorrect authorization vulnerability in the authorizeDocumentPublish() function. This flaw allows authenticated members to publish documents into private collections despite lacking the necessary write access. An attacker can exploit this by...

CVE-2026-120489 Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then...

CVE-2026-120489 Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then...

EUVD-2026-115209

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...

CVE-2026-120449 Outline before 1.12.0 Improper Access Control via Public Document Shares

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...

CVE-2026-120449 Outline before 1.12.0 Improper Access Control via Public Document Shares

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...

CVE-2026-120449

The Outline software (versions before 1.12.0 ) is susceptible to an improper access control vulnerability. The share loader component fails to check the unpublished status of documents, allowing unauthenticated users with an existing share link to access withdrawn content. Specifically, attackers...

CVE-2026-120449 Outline before 1.12.0 Improper Access Control via Public Document Shares

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...

CVE-2026-120449: Outline: Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read…

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...

PT-2026-135480

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then...

CVE-2026-120489: Outline: Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows…

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retaining parentDocumentId, then...

PT-2026-135465

Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, documents.info, or the /s/ share routes to...

CVE-2026-107035

Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload...

CVE-2026-107035

Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload...

CVE-2026-107035

MBasov OMN Outline notes Markdown (version 3400) is vulnerable to unauthorized data modification due to insecure permissions within the object/Page.java component. An attacker can exploit this flaw by sending a crafted payload to arbitrarily write content into another user's private storage . Whi...

CVE-2026-107035: n/a: Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows…

Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private storage via a crafted payload...