Lucene search
+L

169068 matches found

CVE
CVE
added 2026/07/29 4:34 p.m.20 views

CVE-2026-18257

In CVE-2026-18257, the issue affects the CycloneCrypto cryptographic wrapper used by S2OPC. The root cause is an improper validity period check for the root issuer certificate, which can lead to certificates issued by that root being treated as trusted. The cross-document details confirm the vuln...

5.6CVSS5.8AI score0.001EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/29 4:17 p.m.14 views

CVE-2026-54078

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

8.7CVSS0.0032EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/29 4:17 p.m.10 views

CVE-2026-54082

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

6.5CVSS0.0023EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/29 4:17 p.m.11 views

CVE-2026-54079

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

8.7CVSS0.0032EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/29 3:49 p.m.7 views

CVE-2026-66038

A flaw was found in FFmpeg, specifically within the LCL/ZLIB video decoder. A remote attacker could exploit this vulnerability by providing a specially crafted zlib stream that decompresses to a smaller size than expected. This can lead to the exposure of uninitialized heap memory, including...

7.1CVSS5.8AI score0.00245EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/07/29 3:14 p.m.6 views

veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

Summary veraPDF-validation has an XML External Entity XXE vulnerability in two PDF parsing paths validate and GFPDAcroForm.getdynamicRender. A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values o...

6.5CVSS5.9AI score0.0023EPSS
SaveExploits0References5Affected Software2
OSV
OSV
added 2026/07/29 3:14 p.m.6 views

GHSA-CG9X-G3GM-H5H6 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

Summary veraPDF-validation has an XML External Entity XXE vulnerability in two PDF parsing paths validate and GFPDAcroForm.getdynamicRender. A malicious/crafted PDF supplied to a veraPDF consumer can lead to the expansion of external entities while parsing rich-text annotation/form-field values o...

6.5CVSS5.9AI score0.0023EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/29 3:14 p.m.4 views

CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

6.5CVSS5.8AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/29 3:14 p.m.38 views

CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

6.5CVSS0.0023EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/29 3:14 p.m.46 views

CVE-2026-54082

The CVE-2026-54082 entry affects veraPDF-validation, specifically the PDFAValidator.validate(...) and GFPDAcroForm.getdynamicRender() paths. The issue stems from parsing using the default DocumentBuilderFactory, enabling XML External Entity (XXE) processing when handling rich-text annotations, fo...

6.5CVSS5.8AI score0.0023EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/29 3:11 p.m.5 views

GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

8.7CVSS6AI score0.0032EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/29 3:11 p.m.7 views

EUVD-2026-50369

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/29 3:11 p.m.43 views

CVE-2026-54078

The VeraPDF validation project contains an XXE vulnerability in the validation-model module (DictionaryKeysHelper.getRichTextStringOrStreamEntryStringRepresentation). A crafted PDF with malicious rich-text /RC or /RV entries can trigger external entity expansion and reflect local file contents in...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/29 3:11 p.m.5 views

CVE-2026-54078 veraPDF Validation XXE via Rich Text

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

8.7CVSS5.8AI score
SaveExploits0References6
OSV
OSV
added 2026/07/29 3:8 p.m.10 views

GHSA-36MM-W85J-3Q2J veraPDF Validation XXE via XFA

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions...

8.7CVSS6AI score0.0032EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/29 3:7 p.m.5 views

CVE-2026-54079 veraPDF Validation XXE via XFA

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

8.7CVSS5.8AI score
SaveExploits0References6
EUVD
EUVD
added 2026/07/29 3:7 p.m.6 views

EUVD-2026-50368

veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/impl/pd/GFPDAcroForm.java in the...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/29 3:7 p.m.41 views

CVE-2026-54079

CVE-2026-54079 affects veraPDF Validation. The XXE flaw resides in veraPDF-validation’s GFPDAcroForm.getdynamicRender() and is triggered by a crafted PDF containing a malicious XFA stream, causing external entity expansion during PDF/UA-1 validation. Consequences include local file disclosure or ...

8.7CVSS5.8AI score0.0032EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/07/29 2:54 p.m.7 views

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

8.2CVSS5.9AI score0.00157EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/07/29 2:54 p.m.6 views

io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)

A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...

7.5CVSS5.8AI score0.00249EPSS
SaveExploits0References5
Rows per page
Query Builder