CVE-2026-59552

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

CVE-2026-59552 WordPress 3D Flipbook PDF Viewer & Embedder plugin <= 1.4.2 - Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

Security update for python-Pillow

This update for python-Pillow fixes the following issues: CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes being called without decompressionbombcheck bsc1270409...

SUSE-SU-2026:3268-1 Security update for python-Pillow

This update for python-Pillow fixes the following issues: - CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path bsc1271419. - CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes being called without decompressionbombcheck bsc1270409. -...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

!IMPORTANT This repository is intended for learning about...

atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...

CVE-2026-59552: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in 3D Flipbook PDF Viewer & Embedder = 1.4.2 versions...

Уязвимость функции tilingPatternFill библиотеки для отображения PDF-файлов Poppler, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость функции tilingPatternFill библиотеки для отображения PDF-файлов Poppler связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

Denial Of Service (DoS)

dompdf/dompdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper resource consumption controls during the PDF rendering phase after image dimension validation, which allows an unauthenticated attacker to submit a specially crafted HTML document containing a large...

Denial Of Service (DoS)

pypdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of unterminated inline images using the ASCII85 or ASCIIHex filters during PDF parsing, which allows an attacker to craft a malicious PDF that triggers an infinite loop and causes a denial of service...

Denial Of Service (DoS)

pypdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper detection of inline image end markers in PDF page content streams, which allows an attacker to craft a malicious PDF that triggers an infinite loop during parsing and causes a denial of service...

CVE-2026-16766 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection RCE via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the pagesize, orientation or margins...

EUVD-2026-48767

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection RCE via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the pagesize, orientation or margins...

CVE-2026-16766: Improper Neutralization of Special Elements used in an OS Command

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection RCE via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the pagesize, orientation or margins...

Linux Distros Unpatched Vulnerability : CVE-2026-16377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

Uncontrolled Resource Consumption

dompdf/dompdf is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the library trusting attacker-controlled BMP header dimensions without validating the image size before conversion, which allows an attacker to embed a crafted BMP image e.g., via a data:image/bmp;base64...

OESA-2026-3139 python-pillow security update

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816 Security Fixes: Pillow is a Python imaging library. Prior to 12.3.0,...

CVE-2026-6454

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

EUVD-2026-48462

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...

CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute

The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...