CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-85714

The Stirling-PDF web application is vulnerable to Remote Code Execution (RCE) in versions prior to 2.13.2 . An authenticated administrator using the default H2 database can upload a crafted SQL file via the POST /api/v1/database/import-database endpoint. The DatabaseService.validateSqlContent() m...

CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-110592

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-110592 BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-110592

BottleCRM versions 0.30 through 1.14.5 are vulnerable to an HTML injection flaw within the render_invoice_template() function. This vulnerability allows authenticated organization members to inject malicious HTML and CSS markup into custom-template invoice PDFs by inputting specific strings into ...

EUVD-2026-101220

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in renderinvoicetemplate that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can place HTML and CSS in notes, terms, client name or address fields to overlay totals, pay...

CVE-2026-14851

The Copart online billing service suffers from a vulnerability that leads to the unauthorised disclosure of information within its customer invoicing web application. The root cause is a lack of authorisation checks on the endpoint responsible for serving PDF invoice files , combined with certain...

EUVD-2026-100940

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...

CVE-2026-14851 Unauthorised disclosure of information on Copart’s online billing service

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...

CVE-2026-110147

An use after free flaw was found in the PDF component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/570050928...

CVE-2026-110136

An use after free flaw was found in the PDF component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/568719364...

EUVD-2026-100656

Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-100627

Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Linux Distros Unpatched Vulnerability : CVE-2026-110136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page...

Google Chrome < 155.0.8059.79 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 155.0.8059.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop01668083673 advisory. - Use after free in Media in Google Chrome prior to 155.0.8059.79...

PT-2026-113725

A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information PII and financial data – including customer names, addresses, invoice numbers, payment details and tax information – to unauthorised...

PDF components Google Chrome Microsoft Edge DoS

The vulnerability of PDF components in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created PDF file...

Google Chrome < 155.0.8059.79 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 155.0.8059.79. It is, therefore, affected by multiple vulnerabilities as referenced in the 202610stable-channel-update-for-desktop01668083673 advisory. - Use after free in Media in Google Chrome prior to 155.0.8059.79...

Linux Distros Unpatched Vulnerability : CVE-2026-110147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...