CVE-2026-85697

Documenso 2.17.0 contains an access control flaw in its PDF-serving endpoint . The route fails to validate document visibility settings, specifically missing ownership validation on document data identifiers , allowing attackers with low privileges to read restricted documents within their team o...

CVE-2026-85697 Documenso 2.17.0 PDF Route Ignores Document Visibility

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

EUVD-2026-71146

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

CVE-2026-85697 Documenso 2.17.0 PDF Route Ignores Document Visibility

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

CVE-2026-85697 Documenso 2.17.0 PDF Route Ignores Document Visibility

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

CVE-2026-85618 ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

spring-ai-sibling-loop-poc

Spring AI PDF Reader — sibling self-loop PoC incomplete fix of CVE-2026-47851 Minimal reproduction for an infinite loop / OOM in org.springframework.ai.reader.pdf.config.ParagraphManager of org.springframework.ai:spring-ai-pdf-document-reader. Reported as a private GitHub Security Advisory to...

GHSA-W8J3-5X2H-W9CQ vulnerabilities

Vulnerabilities for packages: chromium...

Sangfor Application - download.php File Read

Reads arbitrary files via Sangfor Application /report/download.php?pdf= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor Application download.php pdf parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

PT-2026-85583

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

CVE-2026-85697: Incorrect Authorization

Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data...

PyPDF Excessive Iteration DoS

The vulnerability of the Python library for working with PDF files, PyPDF, is related to excessive iteration. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PyPDF Excessive Iteration DoS

The vulnerability of the Python library for working with PDF files, PyPDF, is related to excessive iteration. Exploiting this vulnerability can allow an attacker to cause a service failure...

PyPDF Resource Exhaustion

The vulnerability of the Python library for working with PDF files, PyPDF, is related to the unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

GHSA-V7PH-R5R6-4JCJ SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72808. Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publish RoleReader token and by the anonymous account wh...

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

CVE: This vulnerability corresponds to CVE-2026-72808. Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publish RoleReader token and by the anonymous account wh...

EUVD-2026-57409

SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents publish mode...

EUVD-2026-70735

Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...

Stack Overflow

Spring AI is vulnerable to Stack Overflow. The vulnerability is due to a deeply nested or cyclic table of contents in a PDF, where the ingestion thread processes the table of contents recursively and can trigger a StackOverflowError, allowing attackers to cause a denial‑of‑service condition...

SUSE CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...