CVE-2026-84138: Uncontrolled Resource Consumption

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

CVE-2026-84309: Loop with Unreachable Exit Condition

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/datastructures.py TreeObject.insertchild to follow /Next links indefinitely when a writing code path inserts a child, producing an infinite loop...

DEBIAN-CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82398 pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

CVE-2026-82864

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

@cesarechazu/directus-extension-generate-pdf (1.0.6), registri-dynamic-pdf (0.1.1) potentially affected by CVE-2026-82868 via @pdfme/schemas (>=4.5.2, <=5.5.8)

@pdfme/schemas NPM version =4.5.2, =5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 - registri-dynamic-pdf 0.1.1 Source cves: CVE-2026-82868 Source advisory:...

@cesarechazu/directus-extension-generate-pdf (1.0.6), registri-dynamic-pdf (0.1.1) potentially affected by CVE-2026-82867 via @pdfme/schemas (>=4.5.2, <=5.5.8)

@pdfme/schemas NPM version =4.5.2, =5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 - registri-dynamic-pdf 0.1.1 Source cves: CVE-2026-82867 Source advisory:...

CVE-2026-82866 @pdfme/common before 5.5.10 SSRF via Unvalidated URL Fetch

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetches arbitrary URLs without validation when basePdf is attacker-controlled. Attackers who control the basePdf template field can force servers or clients to make requests to...

@appsafetyhub/generator (>=1.1.18, <=1.1.19), @aswar-new-pdf-builder/common (>=0.0.1, <=0.1.0) +35 more potentially affected by CVE-2026-82864 via @pdfme/pdf-lib (1.18.4)

@pdfme/pdf-lib NPM version 1.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/pdf-lib and may be impacted: - @appsafetyhub/generator =1.1.18, =0.0.1, =0.0.3, =0.0.2, =1.0.0, =1.3.0, =1.0.1, =0.0.0, =0.0.0, =0.0.0, =3.0.0-beta.1, =1.1.10,...

@cesarechazu/directus-extension-generate-pdf (1.0.6), registri-dynamic-pdf (0.1.1) potentially affected by CVE-2026-82865 via @pdfme/schemas (>=4.5.2, <=5.5.8)

@pdfme/schemas NPM version =4.5.2, =5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 - registri-dynamic-pdf 0.1.1 Source cves: CVE-2026-82865 Source advisory:...

EUVD-2026-68399

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

CVE-2026-82864

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer() method. An attacker can supply a crafted PDF with a FlateDecode stream containing a decompression bomb, causing a small compressed file to decompress to hundreds of megabytes. ...

CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

CVE-2026-82864 pdfme pdf-lib before 5.5.10 Denial of Service via Decompression Bomb

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

PDFium DoS

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through the use of a specially created PDF file...

Amazon Linux 2023 : clamav1.5, clamav1.5-data, clamav1.5-devel (ALAS2023-2026-2116)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2116 advisory. A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory...

CVE-2026-82864: Improper Handling of Highly Compressed Data (Data Amplification)

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer method that allows attackers to cause denial of service by supplying a crafted PDF with a FlateDecode stream containing a decompression bomb. Attackers can upload a small...

Amazon Linux 2 : clamav1.4, --advisory ALAS2-2026-3894 (ALAS-2026-3894)

The version of clamav1.4 installed on the remote host is prior to 1.4.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3894 advisory. A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a Do...