PT-2026-84866

Name of the Vulnerable Software and Affected Versions Reader Tools PDF Reader App version 98.8 Description A path traversal issue exists within the File Handler component. This occurs when the display name argument is manipulated in the ActSplashNew.handleDeeplink function, allowing a local...

Linux Distros Unpatched Vulnerability : CVE-2026-84138

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. CVE-2026-84138 Note that Nessus relies on the...

CVE-2026-81164: Missing Authorization

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5...

CVE-2026-84852: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

PDFium DoS

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created PDF file...

PDF components Google Chrome Microsoft Edge Data Compromise

The vulnerability of PDF components in Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to manipulate data integrity through a specially created HTML page...

PDFium Component Compromise Data Compromise

The vulnerability of the PDFium component in Google Chrome and Microsoft Edge relates to the false representation of critical information to the user interface. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created PDF file...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-84310 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

pypdf: Possible long runtimes/large memory usage when retrieving outlines

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. Patches This has been fixed in pypdf==6.16.1...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +135 more potentially affected by CVE-2026-84310 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2026-84310 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2026-84310 Source advisory: OSV:GHSA-23W6-3W8W-8484...

GHSA-23W6-3W8W-8484 pypdf: Possible long runtimes/large memory usage when retrieving outlines

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires accessing the outlines of a document with either lots of entries or nested outlines with long re-used nesting paths. Patches This has been fixed in pypdf==6.16.1...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-84310 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-84310 Source advisory: OSV:GHSA-23W6-3W8W-8484...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-84310 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-84310 Source advisory: OSV:GHSA-23W6-3W8W-8484...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-84311 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-84311 Source advisory: OSV:GHSA-763M-79HH-57F2...

docrx (>=0.0.1, <=0.0.10), paperreview (0.1.0) +1 more potentially affected by CVE-2026-84311 via pypdf (3.15.0)

pypdf PYPI version 3.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docrx =0.0.1, =1.1.11, =1.1.13 Source cves: CVE-2026-84311 Source advisory: OSV:GHSA-763M-79HH-57F2...

GHSA-763M-79HH-57F2 pypdf: Possible long runtimes/large memory usage when extracting XForm objects

Impact An attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires extracting the text of a page with lots of XForm objects, where some of them might be re-used. Patches This has been fixed in pypdf==6.16.1. Workarounds If you...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-84311 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-84311 Source advisory: OSV:GHSA-763M-79HH-57F2...

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-84309 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-84309 Source advisory: OSV:GHSA-JP53-MHQP-8XCG...

Infinite loop

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Infinite loop in the insertchild method of TreeObject, whose loop can fail to reach its exit condition. An attacker can hang the...