beancount-ce (>=0.1.0, <=1.2.0), ocrmypdf (>=10.3.2, <=11.3.0) +4 more potentially affected by CVE-2025-70559 via pdfminer-six (20200726.0.0)

pdfminer-six PYPI version 20200726.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - beancount-ce =0.1.0, =10.3.2, =0.3.0, =1.0.3, =1.44.0, =0.1.1, =0.1.7 Source cves: CVE-2025-70559 Source advisory:...

magic-pdf (1.3.10) potentially affected by CVE-2025-70559 via pdfminer-six (20250324.0.0)

pdfminer-six PYPI version 20250324.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - magic-pdf 1.3.10 Source cves: CVE-2025-70559 Source advisory: OSV:PYSEC-2026-1761...

deckz (2.6.0), ocrmypdf (>=9.7.2, <=9.8.0) +4 more potentially affected by CVE-2025-70559 via pdfminer-six (20200402.0.0)

pdfminer-six PYPI version 20200402.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - deckz 2.6.0 - ocrmypdf =9.7.2, =0.1.0, =1.0.0, =1.36.10, =1.38.1 Source cves: CVE-2025-70559 Source advisory: OSV:PYSEC-2026-1761...

ocrmypdf (>=9.6.0, <=9.7.1), screenplay-pdf-to-json (>=0.1.0, <=0.3.4) +2 more potentially affected by CVE-2025-70559 via pdfminer-six (20200124.0.0)

pdfminer-six PYPI version 20200124.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - ocrmypdf =9.6.0, =0.1.0, =1.34.27, =1.36.9 Source cves: CVE-2025-70559 Source advisory: OSV:PYSEC-2026-1761...

PYSEC-2026-1760 Byaidu PDFMathTranslate vulnerable to open redirect

An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arbitrary external websites via the file parameter to the /gradioapi endpoint. This vulnerability could be exploited for phishing attacks or ...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2025-62708 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2025-62708 Source advisory: OSV:PYSEC-2026-1831...

pypdf can exhaust RAM via manipulated LZWDecode streams

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWDecode filter. PatchesThis has been fixed in pypdf==6.1.3. WorkaroundsIf you cannot upgrade yet, consider applying the changes from PR...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2025-62708 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2025-62708 Source advisory: OSV:PYSEC-2026-1831...

smart-pdf (2023.9.11.1) potentially affected by CVE-2025-62708 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2025-62708 Source advisory: OSV:PYSEC-2026-1831...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +135 more potentially affected by CVE-2025-62707 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2025-62707 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2025-62707 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2025-62707 Source advisory: OSV:PYSEC-2026-1833...

smart-pdf (2023.9.11.1) potentially affected by CVE-2025-62707 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2025-62707 Source advisory: OSV:PYSEC-2026-1833...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2025-62707 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2025-62707 Source advisory: OSV:PYSEC-2026-1833...

PYSEC-2026-2058 xml2rfc has an arbitrary file read vulnerability

Impact When generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML. Workarounds Test untrusted input with link elements with rel="attachment" before processing. Credits This vulnerability was reporte...

xml2rfc has an arbitrary file read vulnerability

ImpactWhen generating PDF files, this vulnerability allows an attacker to read arbitrary files from the filesystem by injecting malicious link element into the XML. WorkaroundsTest untrusted input with link elements with rel="attachment" before processing. CreditsThis vulnerability was reported b...

PyPDF's Manipulated FlateDecode streams can exhaust RAM

ImpactAn attacker who uses this vulnerability can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. PatchesThis has been...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2025-55197 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

smart-pdf (2023.9.11.1) potentially affected by CVE-2025-55197 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2025-55197 Source advisory: OSV:PYSEC-2026-1830...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2025-55197 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2025-55197 Source advisory: OSV:PYSEC-2026-1830...