CVE-2026-31898

A flaw was found in jsPDF, a JavaScript library used for generating PDF documents. This vulnerability allows a remote attacker to inject arbitrary PDF objects, including JavaScript actions, into a generated PDF. This can occur if unsanitized user input is provided to the createAnnotation method's...

Exploit for Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Openssl

🔐 SSH Exploit Tool Educational Use Only 📌 Description Th...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by CVE-2026-82868 via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: CVE-2026-82868 Source advisory: OSV:GHSA-87V3-4CFP-CM76...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: GHSA-87V3-4CFP-CM76...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: GHSA-QQ9G-96V4-M3CJ...

Cross-site Scripting (XSS)

Overview @pdfme/schemas is a TypeScript base PDF generator and React base UI. Open source, developed by the community, and completely free to use under the MIT license! Affected versions of this package are vulnerable to Cross-site Scripting XSS via the selectElement.innerHTML method. An attacker...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-PDFMESCHEMAS-15746948...

Exploit for CVE-2026-26801

pdfmake SSRF Vulnerability PoC Vulnerability Summary | Fi...

CVE-2026-31898

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inje...

CVE-2026-31938

jsPDF prior to 4.2.1 is vulnerable: unsanitized user input passed to the output method’s options can inject HTML/scripts into the browser context when a PDF is opened. The issue is triggered when an attacker provides values via a web interface, which are forwarded to the victim’s browser and proc...

CVE-2026-31898 jsPDF has a PDF Object Injection via FreeText color

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inje...

CVE-2026-31898 jsPDF has a PDF Object Injection via FreeText color

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inje...

CVE-2026-31898

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the "createAnnotation" method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can...

DEBIAN-CVE-2026-27894

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with...

CVE-2026-27894

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with...

CVE-2026-27895

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type including .php files can be uploaded. With...

UBUNTU-CVE-2026-27895

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to version 9.5, the PDF export component does not correctly validate uploaded file extensions. This way any file type including .php files can be uploaded. With...

jsPDF Output Code Execution

The vulnerability of the output function in the jsPDF PDF-generation library relates to the lack of protection for the web page structure during the processing of the options parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code, provided that the user opens ...

CVE-2026-31898: Improper Encoding or Escaping of Output

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the createAnnotation method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inje...

chromium -- security fixes

Chrome Releases reports: This update includes 26 security fixes: 475877320 Critical CVE-2026-4439: Out of bounds memory access in WebGL. Reported by Goodluck on 2026-01-15 485935305 Critical CVE-2026-4440: Out of bounds read and write in WebGL. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on...