CVE-2026-108457

An out-of-bounds write vulnerability exists in Microsoft Windows PDF that could allow an unauthorized attacker to execute code over a network . The vulnerability is associated with CWE-787 . While specific technical details regarding the underlying function or file are not provided, the impact is...

SUSE CVE-2026-109268

ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free vulnerability in the PDF writer when writing CMYK images with JPEG2000 compression. Attackers can supply a crafted CMYK image that, when written to PDF with JPEG2000 compression, causes freed memory to be reused,...

Microsoft Windows PDF Remote Code Execution Vulnerability

Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network...

CVE-2025-66516-Writeup-POC

CVE-2025-66516: Critical XXE Vulnerability in Apache Tika Executive Summary CVE-2025-66516 is a critical XML External Entity XXE injection vulnerability in Apache Tika with a CVSS score of 10.0 maximum severity. The vulnerability allows remote attackers to read arbitrary files, perform Server-Sid...

DEBIAN-CVE-2026-109742

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109742

An information disclosure vulnerability exists in the PDF Viewer component of Firefox and Thunderbird . The vulnerability allows for the exposure of sensitive information to an unauthorized actor (CWE-200 ). This issue has been remediated in Firefox 158 , Firefox ESR 153.5 , Thunderbird 158 , and...

CVE-2026-109742

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Masaya Morita @mrtmyix in WordPress Plugin BSK PDF Manager versions = 3.8.1...

libreoffice: heap buffer overflow in PDF import stream handling

A flaw was found in LibreOffice. When a user imports a specially crafted PDF document with LibreOffice Draw, a heap-based buffer overflow can occur due to improper validation of the stream length. This issue can cause memory corruption, resulting in an application crash...

Important: Red Hat Security Advisory: libreoffice security update

An update for libreoffice is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

IPA

Interactive PDF Analysis Interactive PDF Analysis also called IPA allows any researcher to explore the inner details of any PDF file. PDF files may be used to carry malicious payloads that exploit vulnerabilities, and issues of PDF viewer, or may be used in phishing campaigns as social engineerin...

PT-2026-113468

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the PDF component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attacker...

PT-2026-113479

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the PDF component. This allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML pag...

KLA91329 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Track can be exploited...

CVE-2026-109742: Exposure of Sensitive Information to an Unauthorized Actor

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-108457: Out-of-bounds Write

Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network...

Important: libreoffice security update

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and...

PT-2026-111463

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description An information disclosure issue exists within the PDF Viewer component. Recommendations Update...

CVE-2025-66516-POC

⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC This repository contains a proof-of-concept POC exploit for CVE-2025-66516 , an XML External Entity XXE injection vulnerability in Apache Tika versions prior to 3.2.2. The vulnerability...

CVE-2026-109603

Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library CVE-2025-26240 for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch intern...