39708 matches found
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
cve-2026-47851 - HIGH - Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader...
Uncontrolled Recursion
Overview org.springframework.ai:spring-ai-pdf-document-reader is a Spring AI PDF document reader Affected versions of this package are vulnerable to Uncontrolled Recursion in an ingestion thread. An attacker can cause a denial of service by submitting a PDF with a deeply nested or cyclic table of...
CVE-2026-48203
A flaw was found in the Apache Camel Solr component. A remote unauthenticated attacker can inject Solr query parameters and document fields into requests by utilizing specific header prefixes SolrParam. and SolrField. that bypass the HTTP header filter. This improper input validation allows for...
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
Impact A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerabilit...
Improper Neutralization of Special Elements Used in a Template Engine
Overview document-merge-service is a Merge Document Template Service Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine in the processing of XLSX templates using a non-sandboxed Jinja environment. An attacker can execute...
GHSA-W47Q-945M-Q9PC Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
Impact A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerabilit...
MINI-8PWP-RJPX-C7FC
Bulletin has no description...
MINI-C5VM-85RH-96V9
Bulletin has no description...
MINI-852G-356V-P296
Bulletin has no description...
MINI-VMF5-7M2F-283G
Bulletin has no description...
MINI-WGGP-225V-QGRW
Bulletin has no description...
PT-2026-80736
Name of the Vulnerable Software and Affected Versions document-merge-service versions prior to 9.1.0 Description Remote code execution is possible through server-side template injection SSTI, a flaw where an application improperly handles template inputs, allowing an attacker to inject and execut...
CVE-2026-70951
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Document Management. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful...
CVE-2026-70999
...
EUVD-2026-61898
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Document Management. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful...
EUVD-2026-61173
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...
CVE-2026-75935 Memory-amplification denial of service via declared-length preallocation in Amazon ion-java
Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users shou...
EUVD-2024-55726
A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. I...
CVE-2026-34789
A flaw was found in FreeCAD, a 3D parametric modeler. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted FCStd document. When the document is restored, attacker-controlled module attributes are processed, leading to the execution of arbitrary...
