32155 matches found
CVE-2026-76206 phpMyFAQ before 4.1.7 Information Disclosure via PDF Export
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...
PT-2026-78392
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient sanitization of HTML in FAQ answers occurs before generating PDFs via TCPDF. An attacker with permissions to create or edit FAQ content can embed an tag with a src attribute referencing...
PT-2026-78777
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the schedule search capability can configure PD...
PT-2026-78755
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Splunk Web fails to sufficiently validate dashboard content...
The vulnerability of the Adobe Acrobat PDF browser extension for Google Chrome allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the Adobe Acrobat PDF browser extension for Google Chrome is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
PT-2026-78388
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...
CVE-2026-76206: Exposure of Sensitive Information to an Unauthorized Actor
phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...
CVE-2026-76350: Improper Privilege Management
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedulesearch capability could configure Portable Document Format PDF attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search...
openSUSE 16 Security Update : python-PyPDF2 (openSUSE-SU-2026:21589-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21589-1 advisory. Changes in python-PyPDF2: - CVE-2026-59937: possible long runtimes for repeated malformed cross-reference entries bsc1271147 - CVE-2026-59936:...
CVE-2026-76328: Improper Neutralization of Special Elements used in a Command
In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store attacker-controlled Search Processing Language SPL in a dashboard. When another authenticated user exports the dashboard as a Portable Document Format PDF file, Splunk...
CVE-2026-60392
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In PDF Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...
CVE-2026-49452
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/init.py when presentationalhints=True. The background attribute is inserted into a background-image:url declaration and parsed b...
SUSE CVE-2026-71852
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/font.py function Font.collectcidcharacterwidths expands unusually large CID font /W width ranges or excessive width entries during text extractio...
GO-2026-6115 WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks
This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input: - Unchecked /Size, /Index,...
CVE-2026-32473
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
EUVD-2026-60815
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery = 1.16.20 versions...
CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
