CVE-2026-63501: Agamnentzar ag-psd: ag-psd is a JavaScript library for reading and writing Photoshop Document files

ag-psd is a JavaScript library for reading and writing Photoshop Document files. Prior to 31.0.3, readPsd accepts a totalMemoryLimit for parsing untrusted PSD files, but decodeLayerImageData expects a differently named memoryLimit property and therefore passes an undefined limit to...

CVE-2026-101130

The Affinity by Canva application before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, coul...

CVE-2026-101130

The Affinity by Canva application (versions prior to 3.3.1 , October 2026 release) is vulnerable to a heap buffer over-read due to inadequate bounds checking when parsing arrays of strings in Affinity document files. Specifically, the flaw exists in Kernel::InSerialiser::LoadTypes involving a pro...

CVE-2026-101130

The Affinity by Canva application before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, coul...

CVE-2026-101130

The Affinity by Canva application before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, coul...

CVE-2026-101094

The Affinity by Canva application before 3.3.1 October 2026 release did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in...

CVE-2026-96395

The Affinity by Canva app for macOS before 3.3.1 October 2026 release did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed ...

[SECURITY] [DSA 6543-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6543-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 05, 2026 https://www.debian.org/security/faq -...

Debian dsa-6516 : ghostscript - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6516 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6516-1 [email protected] https://www.debian.org/security/...

[SECURITY] [DSA 6512-1] libreoffice security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6512-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 24, 2026 https://www.debian.org/security/faq -...

Debian dsa-6512 : fonts-opensymbol - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6512 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6512-1 [email protected] https://www.debian.org/securit...

Google Chrome Resource Management Error Vulnerability

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 148.0.7778.216 contained a resource management vulnerability. This vulnerability stemmed from the reuse of PDF files after their release, potentially allowing remote attackers to execute arbitrary code with...

Admidio has Path Traversal via Unvalidated `name` Parameter in Document Add Mode that Enables Arbitrary Server File Read

Summary The add mode in modules/documents-files.php accepts a name parameter validated only as 'string' type HTML encoding, allowing path traversal characters ../ to pass through unfiltered. Combined with the absence of CSRF protection on this endpoint and SameSite=Lax session cookies, a...

Adobe Reader Zero-Day Exploited to Steal Data via Malicious PDFs

An Adobe Reader zero-day vulnerability is being actively exploited via malicious PDFs, allowing hackers to steal data without user interaction, with no patch available...

CVE-2026-25780 Memory Exhaustion via Malformed DOC File Upload

Mattermost versions 11.3.x = 11.3.0, 11.2.x = 11.2.2, 10.11.x = 10.11.10 fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.. Mattermost Advisory ID:...

CVE-2025-65924

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

USN-7858-1 poppler vulnerability

It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a crash...

USN-7858-1: poppler vulnerability

It was discovered that poppler incorrectly handled certain PDF files. An attacker could possibly use this issue to cause a crash...

SUSE-SU-2025:3898-1 Security update for poppler

This update for poppler fixes the following issues: - CVE-2025-43718: fixed uncontrolled recursion in the regex-based metadata parser when processing specially crafted PDF files bsc1250908...

Tawk Live Chat Cross-Site Script Vulnerability

tawk.to Tawk Live Chat is an online chat software from the US company tawk.to. A cross-site scripting vulnerability exists in Tawk Live Chat that stems from not properly cleaning JavaScript code when storing PDF files, which could lead to a stored cross-site scripting attack...