PT-2026-76760

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

CVE-2026-75529: Improper Neutralization of Input During Web Page Generation

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download/ /.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

PT-2026-76739

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

CVE-2026-57485: Exposure of Sensitive Information to an Unauthorized Actor

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...

EUVD-2026-59793

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-19717: Exposure of Sensitive Information to an Unauthorized Actor

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders whi...

CVE-2026-73041

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-73041

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-73041

SiYuan is affected: versions before 3.7.4 fail to validate/escape annotation fields written to disk via the setFileAnnotation endpoint, allowing attackers to inject markup that can execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF. The CVE-2026-7304...

CVE-2026-73041: Improper Neutralization of Input During Web Page Generation

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

PT-2026-73048

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation or escaping of annotation fields written to disk via the 'setFileAnnotation' endpoint allows attackers to inject malicious markup. This markup executes as a script within the P...

ROOT-APP-PYPI-CVE-2026-27026 CVE-2026-27026 in pypdf - Patched by Root

Root has patched CVE-2026-27026 in the pypdf package for Root:PyPI. Multiple fixed versions available...

CVE-2026-73048

SiYuan before v3.7.4 contains an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint, which returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by using annotation identif...

CVE-2026-73048 SiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

EUVD-2026-58654

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

CVE-2026-73048

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotati...

EUVD-2026-58517

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

Foxit PDF Editor < 13.2.6 / 14.0.6 / 2026.1.3 Vulnerability

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2026.1.3/14.0.6/13.2.6. It is, therefore affected by vulnerability: - Foxit PDF Editor/Reader inconsistently alerts users when signature fields are...