CVE-2026-15758: Exposure of Sensitive Information to an Unauthorized Actor

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-92178: Improper Restriction of Operations within the Bounds of a Memory Buffer

pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target mu...

PT-2026-92060

Name of the Vulnerable Software and Affected Versions Crawl4AI versions prior to 0.9.3 Description An uncontrolled resource consumption issue exists in the PDFContentScrapingStrategy that allows untrusted clients to cause a denial of service. Attackers can trigger this by selecting the PDF scrapi...

ROS-20260915-73-0092

The vulnerability of PDF components in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...

CVE-2026-92177: Out-of-bounds Write

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

CVE-2026-91737: Use After Free

Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

ROS-20260915-73-0116

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created PDF file...

ROS-20260915-73-0115

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created PDF file...

ROS-20260915-73-0113

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created PDF file...

PT-2026-92111

Name of the Vulnerable Software and Affected Versions Design Scuole Italia affected versions not specified Description Authorization bypass issues exist within the dsi pdf generator and dsi csv generator functions. These flaws allow an unauthenticated attacker to access restricted "Circolare"...

PT-2026-93155

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A use after free issue exists in the PDF component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML...

Exploit for CVE-2026-61797

CVE-2026-61797 — GLPI PDF Plugin Time-Based Blind SQL Injectio...

UBUNTU-CVE-2026-55073

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

CVE-2026-55073

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

CVE-2026-55073

WeasyPrint prior to 70.0 contains a url_fetcher bypass in two write_pdf() code paths. The xmp_metadata parameter in weasyprint/pdf/__init__.py calls select_source() without passing the document's fetcher, enabling arbitrary local file read with contents embedded verbatim in the output PDF. The st...

EUVD-2026-77638

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...

Astra Linux – Vulnerability in Chromium

Uninitialized data in PDFium in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file...

Astra Linux – Vulnerability in Poppler

A flaw was discovered in Poppler’s Splash backend. A remote attacker could exploit this vulnerability by creating a malicious PDF file. When the PDF is rendered, it triggers an integer overflow in the tilingPatternFill function. This overflow leads to an under-sized heap memory allocation, allowi...

Astra Linux – Vulnerability in qpdf

QPDF versions 9.x through 9.1.1, and 10.x through 10.0.4 have a heap-based buffer overflow in the PlASCII85Decoder::write function invoked from PlAESPDF::flush and PlAESPDF::finish when a certain downstream write operation fails...

Astra Linux – Vulnerability in Poppler

A flaw was discovered in Poppler regarding the way certain PDF files are converted into HTML format. A remote attacker could exploit this flaw by providing a malicious PDF file. When such a file is processed by the ‘pdftohtml’ program, it could cause the application to crash, resulting in a denia...