EUVD-2026-48462

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

PT-2026-64230

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-16377

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the PDF Viewer component...

EUVD-2026-42343

pypdf: Possible large memory usage for wrong image dimensions...

WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Nabil Irawan in WordPress Plugin 3D Flipbook PDF Viewer & Embedder versions = 1.4.2...

PYSEC-2026-3495 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...

EUVD-2026-48129

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

CVE-2026-65528

The CVE-2026-65528 entry concerns the WordPress BSK PDF Manager plugin (versions up to 3.8) with a Cross Site Scripting (XSS) vulnerability. The root cause is XSS in this plugin version, affecting the product where user input is not properly sanitized. The documents do not provide details on the ...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, using free in Google Chrome’s views allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Using “after free” in PDFs in Google Chrome before version 148.0.7778.216 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFs in Google Chrome before version 149.0.7827.53 allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 150.0.7871.47 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: High...

Debian dsa-6398 : gir1.2-javascriptcoregtk-4.1 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6398 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6398-1 [email protected] https://www.debian.org/securit...