PT-2026-79065

Name of the Vulnerable Software and Affected Versions Plate versions prior to 53.3.2 Description When converting attacker-controlled HTML through the htmlToDocxBlob function in a server-side or privileged environment, the @platejs/docx-io module fetches remote image URLs. This behavior allows for...

CVE-2026-65842: Server-Side Request Forgery (SSRF)

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.2, @platejs/docx-io fetches remote image URLs while converting attacker-controlled HTML through htmlToDocxBlob in a server-side or privileged environment. The converter can make requests to internal network resources and include the...

CVE-2026-18929

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

CVE-2026-18929 Resource Exhaustion in Carbone

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

CVE-2026-18929 Resource Exhaustion in Carbone

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

CVE-2026-18929

Carbone's yazl-based zip decompression of .docx files lacks entry-size validation, enabling zip-bomb attacks that cause excessive memory consumption and server crashes. CVSS 6.9 (MEDIUM). Fixed in versions 3.8.2, 4.26.3, and 5.4.4. No in-the-wild exploitation reported. Details: https://github.com...

CVE-2026-18929

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

CVE-2026-18929 Resource Exhaustion in Carbone

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

EUVD-2026-60574

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

PT-2026-76909

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

CVE-2026-18929: Improper Handling of Highly Compressed Data (Data Amplification)

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files. The library uses yazl for zip decompression without validating entry sizes, allowing an attacker to supply a malicious .docx file containing a zip bomb that decompresses to a...

com.alanpoi:alanpoi-all (>=1.3.4, <=3.0.0), com.alanpoi:alanpoi-analysis (>=1.3.4, <=3.0.0) +10 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.0)

org.docx4j:docx4j-core MAVEN version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.alanpoi:alanpoi-all =1.3.4, =1.3.4, =3.0.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3.0 -...

org.docx4j:docx4j-conversion-via-microsoft-graph (8.2.7), org.docx4j:docx4j-diffx (8.2.7) +8 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.7)

org.docx4j:docx4j-core MAVEN version 8.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-conversion-via-microsoft-graph 8.2.7 - org.docx4j:docx4j-diffx 8.2.7 -...

org.docx4j:docx4j-diffx (8.2.0), org.docx4j:docx4j-documents4j-local (8.2.0) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.0)

org.docx4j:docx4j-core MAVEN version 8.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.2.0 - org.docx4j:docx4j-documents4j-local 8.2.0 - org.docx4j:docx4j-documents4j-remote...

org.docx4j:docx4j-diffx (8.1.3), org.docx4j:docx4j-docx-anon (8.1.3) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.3)

org.docx4j:docx4j-core MAVEN version 8.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.3 - org.docx4j:docx4j-docx-anon 8.1.3 - org.docx4j:docx4j-export-fo 8.1.3 -...

cn.bctools:jvs-starter-word (1.1.0), org.docx4j:docx4j-diffx (8.1.1) +5 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.1)

org.docx4j:docx4j-core MAVEN version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - cn.bctools:jvs-starter-word 1.1.0 - org.docx4j:docx4j-diffx 8.1.1 - org.docx4j:docx4j-docx-anon 8.1.1 -...

com.github.paulcwarren:spring-content-docx4j (>=2.1.0, <=2.3.0), org.docx4j:docx4j-conversion-via-microsoft-graph (8.3.4) +9 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.3.4)

org.docx4j:docx4j-core MAVEN version 8.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - com.github.paulcwarren:spring-content-docx4j =2.1.0, =2.3.0 - org.docx4j:docx4j-conversion-via-microsoft-graph 8.3....

org.docx4j:docx4j-diffx (8.1.7), org.docx4j:docx4j-docx-anon (8.1.7) +3 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.7)

org.docx4j:docx4j-core MAVEN version 8.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.7 - org.docx4j:docx4j-docx-anon 8.1.7 - org.docx4j:docx4j-jaxb-internal 8.1.7 -...

org.docx4j:docx4j-diffx (8.1.0), org.docx4j:docx4j-docx-anon (8.1.0) +4 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.1.0)

org.docx4j:docx4j-core MAVEN version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.1.0 - org.docx4j:docx4j-docx-anon 8.1.0 - org.docx4j:docx4j-export-fo 8.1.0 -...

org.docx4j:docx4j-diffx (8.2.1), org.docx4j:docx4j-documents4j-local (8.2.1) +7 more potentially affected by CVE-2026-53752 via org.docx4j:docx4j-core (8.2.1)

org.docx4j:docx4j-core MAVEN version 8.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.docx4j:docx4j-core and may be impacted: - org.docx4j:docx4j-diffx 8.2.1 - org.docx4j:docx4j-documents4j-local 8.2.1 - org.docx4j:docx4j-documents4j-remote...