PT-2026-97052

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.17 through 3.22 Description A server-side request forgery SSRF issue exists in the notebook viewer. While the system validates the scheme and host of a user-supplied URL, it fails to validate the port. This...

CVE-2026-77987: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-75608: Incorrect Authorization

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users...

CVE-2026-46650 Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, isAcceptedUrl in packages/renderer/htmlUtils.ts uses an unanchored regular expression for internal resource URLs, allowing a javascript: URL containing a matching 32-character...

CVE-2026-55105 Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain...

CVE-2026-84138

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Denial-of-service in the PDF Viewer component...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in form-data (CVE-2026-12143)

Summary An HTTP header injection vulnerability in the form-data multipart stream creation library CVE-2026-12143 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.0.6. Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a libra...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in Next.js (CVE-2026-44572, CVE-2026-44573)

Summary Multiple vulnerabilities including SSRF and header manipulation in Next.js CVE-2026-44572, CVE-2026-44573 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 15.5.21. Vulnerability Details CVEID:CVE-2026-44572 DESCRIPTION: Next.js is a Rea...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Starlette (CVE-2026-54283)

Summary A resource exhaustion Denial of Service vulnerability in the Starlette ASGI framework library CVE-2026-54283 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.3.1. Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-6322)

Summary An IPv6 parsing validation bypass vulnerability in the fast-uri library CVE-2026-6322 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encod...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-59869)

Summary A Prototype Pollution vulnerability in the js-yaml document parsing library CVE-2026-59869 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-59869 DESCRIPTION: js-yaml is a JavaScript YAML parse...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in axios (CVE-2026-44486, CVE-2026-44487)

Summary Multiple proxy credential leakage vulnerabilities in the axios HTTP client library CVE-2026-44486, CVE-2026-44487 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 1.18.0. Vulnerability Details CVEID:CVE-2026-44486 DESCRIPTION: Axios is ...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in brace-expansion (CVE-2026-13149)

Summary A Denial of Service vulnerability in the brace-expansion string parsing library CVE-2026-13149 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 5.0.9. Vulnerability Details CVEID:CVE-2026-13149 DESCRIPTION: brace-expansion through 5.0.6 ...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561, CVE-2026-53540)

Summary Multiple vulnerabilities in the python-multipart streaming parser library CVE-2026-24486, CVE-2026-40347, CVE-2026-42561, CVE-2026-53540 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32. Vulnerability Details CVEID:CVE-2026-40347...

TCPViewer v1.18.0

TCP Viewer A simple, native packet viewer for Mac. Website · Download · Docs · Releases TCP Viewer captures and reads network packets on macOS. It uses system libpcap for capture and Wireshark libraries for deep packet details. Features Native macOS app, built with AppKit Built on top of Wireshar...

PDF_XSS

Payloads All The PDFs A list of crafted malicious PDF files...

CVE-2026-91127

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escapin...

NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer vulnerability discovered by ? in WordPress Npm msdoc-viewer versions = 0.2.1...

@anchrd/intel (>=0.59.0, <=0.124.0), @anchrd/intel-ui (>=0.41.0, <=0.57.0) +12 more potentially affected by CVE-2026-91127 via @file-viewer/doc (>=2.1.23, <=2.3.0)

@file-viewer/doc NPM version =2.1.23, =0.59.0, =0.41.0, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =2.1.23, =0.1.0, =0.1.1 Source cves: CVE-2026-91127 Source advisory: OSV:GHSA-3753-M2X2-Q623...

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

Summary Before 2.3.1, the legacy .doc renderer emitted document hyperlink targets after HTML escaping but without a URL-scheme allowlist. A crafted .doc could therefore render a live javascript:, vbscript:, data:, or similarly unsafe link. Script could execute in the embedding origin if a viewer...