32205 matches found
CVE-2026-18597: Server-Side Request Forgery (SSRF)
The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure...
CVE-2026-8325: Out-of-bounds Write
A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process...
PT-2026-68822
Name of the Vulnerable Software and Affected Versions Autodesk Revit affected versions not specified Description An Out-of-Bounds Write occurs when a program writes data past the end of a defined memory buffer. In Autodesk Revit, this issue is triggered when the software parses a maliciously...
EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-2902)
According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow...
PT-2026-68641
Name of the Vulnerable Software and Affected Versions Autodesk Revit affected versions not specified Description A Use-After-Free issue occurs when Autodesk Revit parses a maliciously crafted PDF file. This condition allows an attacker to cause a system crash, disclose sensitive information, or...
CVE-2026-1289: Use After Free
A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, disclose sensitive data, or execute arbitrary code in the context of the current process...
PT-2026-68637
Name of the Vulnerable Software and Affected Versions Autodesk Revit affected versions not specified Description An Out-of-Bounds Read occurs when the software reads data outside the intended boundary of a buffer. This issue is triggered when Autodesk Revit parses a maliciously crafted PDF file,...
TencentOS Server 4: firefox (TSSA-2026:0788)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0788 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
EulerOS 2.0 SP13 : python-pillow (EulerOS-SA-2026-3042)
According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the...
AlmaLinux 10 : firefox (ALSA-2026:47101)
The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:47101 advisory. firefox: thunderbird: Site isolation issue in the DOM: Navigation component CVE-2026-15719 firefox: thunderbird: Invalid pointer in the JavaScript:...
CVE-2026-71270
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
CVE-2026-71270 Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
CVE-2026-71270 Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
CVE-2026-71270
Stirling-PDF CVE-2026-71270 affects the POST /api/v1/convert/url/pdf endpoint. Unlike its siblings (html/pdf, file/pdf, markdown/pdf), this endpoint was not updated with CustomHtmlSanitizer/SsrfProtectionService SSRF protections. It only validates that the initial URL resolves to a public IP, the...
CVE-2026-71270
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
CVE-2026-71270: Server-Side Request Forgery (SSRF)
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
The vulnerability of the PDFium component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created PDF file...
MAL-2026-11856 Malicious code in @servicetitan/dte-pdf-editor (npm)
npm/@servicetitan/dte-pdf-editor is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...