CVE-2026-82472

Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. This allows unauthenticated attackers to upload arbitrary PDF files indefinitely, potentially exhausting storage resources or filling the database with unlinked...

EUVD-2026-68128

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

PT-2026-83451

Name of the Vulnerable Software and Affected Versions Documenso versions prior to 2.13.0 Description The software allows the upload of PDF files without requiring authentication, session tokens, or API credentials. This issue occurs at the '/api/files/upload-pdf' endpoint, enabling unauthenticate...

CVE-2026-82472: Missing Authentication for Critical Function

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

Chromium: CVE-2026-79119 Use after free in PDF

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081

wallabag versions 2 through 2.6.14 are affected by a Server-Side Request Forgery (SSRF) vulnerability caused by a crafted title or content field being mishandled during PDF export . The CVSS 3.1 score is 6.4 (Medium) with a scope change, indicating that exploitation could affect a different secur...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

EUVD-2026-67400

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

CVE-2026-82081: Server-Side Request Forgery (SSRF)

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

PT-2026-82867

wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export...

Exploit for CVE-2026-47851

Spring AI PDF Reader — sibling self-loop PoC incomplete fix o...

CVE-2026-81659

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

Exploit for CVE-2010-1240

Vulnerabilities, Exploits, and Remote Access Payloads — lab wr...

CVE-2026-81659 Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...