EUVD-2026-60320

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

CVE-2026-33437

In Stirling-PDF before 2.0.0, the Get Info workflow inserts untrusted PDF Title/Author metadata into the DOM via innerHTML in get-info-on-pdf.html, enabling stored XSS when a user clicks Get Info; the flaw is fixed in version 2.0.0. No exploitation evidence is provided in the documents.

CVE-2026-33437 Stirling PDF: Stored XSS in Info Summary

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

CVE-2026-33437

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

CVE-2026-33437 Stirling PDF: Stored XSS in Info Summary

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

ROOT-APP-PYPI-CVE-2026-59937 CVE-2026-59937 in pypdf - Patched by Root

Root has patched CVE-2026-59937 in the pypdf package for Root:PyPI. Multiple fixed versions available...

CVE-2026-33437: Improper Neutralization of Input During Web Page Generation

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

CVE-2026-57485: Exposure of Sensitive Information to an Unauthorized Actor

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-75529: Improper Neutralization of Input During Web Page Generation

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/ /.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

PT-2026-76739

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 2.0.0 Description The Get Info workflow in the file app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element using innerHTM...

PT-2026-76760

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 2.9.0 Description The application injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests via the '/api/v1/pipeline/handleData' endpoint. This allows an authenticated user with ROLE USER...

PT-2026-76811

Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description A stored cross-site scripting issue exists in the PDF download functionality. The endpoint '/task-download//.../pdf' uses content-based detection to verify files as PDFs but fails to explicit...

Unity Linux 20.1070a Security Update: poppler (UTSA-2026-099553)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099553 advisory. A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an...

cairo:font_fuzzer: Heap-buffer-overflow in _cairo_type1_subset_init

Detailed Report: https://oss-fuzz.com/testcase?key=5193220372627456 Project: cairo Fuzzing Engine: afl Fuzz Target: fontfuzzer Job Type: aflasancairo Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7506d87e0834 Crash State: cairotype1subsetinit...

EUVD-2026-59793

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-19717: Exposure of Sensitive Information to an Unauthorized Actor

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders whi...

CVE-2026-73041

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-73041

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...