PYSEC-2026-3495 Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Summary PdfParser.PdfStream.decode in Pillow's PdfParser.py calls zlib.decompress with the bufsize parameter set to the value of the PDF stream's Length field, without any upper bound on the actual decompressed output size. Python's zlib.decompress bufsize argument is an initial output buffer hin...

CVE-2026-65528 WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

CVE-2026-65528

The CVE-2026-65528 entry concerns the WordPress BSK PDF Manager plugin (versions up to 3.8) with a Cross Site Scripting (XSS) vulnerability. The root cause is XSS in this plugin version, affecting the product where user input is not properly sanitized. The documents do not provide details on the ...

EUVD-2026-48129

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

CVE-2026-65528 WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

CVE-2026-65528

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 149.0.7827.53 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in PDFium in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted PDF file. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 150.0.7871.47 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Before version 148.0.7778.216, using free in Google Chrome’s views allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Using “after free” in PDFs in Google Chrome before version 148.0.7778.216 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted PDF file. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

The use of “after free” in PDFium in Google Chrome before version 148.0.7778.216 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: High...

WordPress BSK PDF Manager plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin BSK PDF Manager versions = 3.8...

Debian dsa-6398 : gir1.2-javascriptcoregtk-4.1 - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6398 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6398-1 [email protected] https://www.debian.org/securit...

CVE-2026-65528: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

PT-2026-63939

Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...

CVE-2026-13192

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...

CVE-2026-13192 RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...

CVE-2026-13192

Progress Telerik UI for ASP.NET AJAX (prior to v2026.2.708) exposes a RadEditor PDF export SSRF vulnerability. The root cause is insufficient validation of content submitted to the RadEditor PDF export feature, enabling an authenticated attacker to trigger server-side requests to arbitrary hosts,...

Important: Red Hat Security Advisory: evince security update

An update for evince is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...